Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,247 detections
Filters
Last updated
All Time
Detection languages
690
140
94
67
56
Contributors
389
247
199
52
45
Categories
787
411
262
248
188
Platforms
836
265
264
169
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,247
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
This rule detects the initial WebSocket handshake request used by the INTERLOCK NodeSnake RAT for beaconing. It looks for a GET request containing a 'Sec-WebSocket-Key' header and a specific URI pattern (?v=n;) common to the RAT's communication profile.
Detects the use of curl.exe to download a specific file named 'update_ms.msi' from a known malicious IP address. This behavior is indicative of a stager for msaRAT being downloaded onto a Windows host, potentially disguised to mimic a legitimate Windows update file.
Detects files containing 3+ TOKYOCORE ransom note strings combined with 2+ C2-related strings (Tier 2 cluster overlap)
This rule monitors and aggregates external network connections originating from a specific host. It specifically highlights connections to external domains or IPs that have a low frequency (1-10 connections), which may indicate beaconing activity, command and control (C2) communication, or low-and-slow data exfiltration attempts.
Detects the creation of specific RabbitMQ AMQP exchanges and bindings often associated with C2 communication patterns, such as the use of 'fanout' or 'topic' exchange types paired with common internal naming conventions or payload keywords.
This rule detects command line execution containing environment variable keys associated with the LabubaRAT malware family (e.g., ZM_ORG, ZM_KEY, ZM_SERVER). These variables are used to configure the malware's communication parameters, polling intervals, and C2 server settings during its execution.
Detects network traffic originating from the internal network directed towards a specific IP range associated with known PureRAT command and control infrastructure.
Detects the execution of Microsoft Edge WebView2 (msedgewebview2.exe) as a child process of the NVIDIA system runtime (nvidia-sysruntime.exe). This pattern is associated with LabubaRAT, where the legitimate NVIDIA process is abused to launch WebView2 for command-and-control (C2) communication and data exfiltration.
This rule detects network traffic originating from the internal network directed towards a hardcoded IP address associated with the CrashStealer malware. The rule flags outbound traffic to this specific destination, which is indicative of command and control communication or data exfiltration.
Detects DNS queries targeted towards specific '2miners.com' solo mining pool subdomains (e.g., solo-zeph.2miners.com, solo-rvn.2miners.com). Such activity is often associated with unauthorized cryptocurrency mining (cryptojacking) performed on compromised systems.
This rule detects command line execution containing environment variable keys associated with the LabubaRAT malware family (e.g., ZM_ORG, ZM_KEY, ZM_SERVER). These variables are used to configure the malware's communication parameters, polling intervals, and C2 server settings during its execution.
Detects the execution of Microsoft Edge WebView2 (msedgewebview2.exe) as a child process of the NVIDIA system runtime (nvidia-sysruntime.exe). This pattern is associated with LabubaRAT, where the legitimate NVIDIA process is abused to launch WebView2 for command-and-control (C2) communication and data exfiltration.
This rule detects unauthorized or suspicious access to the Komari remote administration panel over unencrypted HTTP. Detecting such access is critical as it indicates potential management interface exposure or unauthorized administrative activity within the network.
Detects the creation of specific RabbitMQ AMQP exchanges and bindings often associated with C2 communication patterns, such as the use of 'fanout' or 'topic' exchange types paired with common internal naming conventions or payload keywords.
Detects the creation of specific RabbitMQ AMQP exchanges and bindings often associated with C2 communication patterns, such as the use of 'fanout' or 'topic' exchange types paired with common internal naming conventions or payload keywords.
This rule detects command line execution containing environment variable keys associated with the LabubaRAT malware family (e.g., ZM_ORG, ZM_KEY, ZM_SERVER). These variables are used to configure the malware's communication parameters, polling intervals, and C2 server settings during its execution.
Detects ClickFix-style social engineering attacks where users are coerced into pasting and executing malicious commands (PowerShell/mshta) via the Windows Run dialog (explorer.exe), or instances where PowerShell processes spawned from the Run dialog perform network communication over suspicious ports commonly associated with this campaign.
Detects the 'ff-agent' process exhibiting unusual network behavior, specifically involving multiple network protocols or connections to a high number of distinct remote ports within a one-hour window. This behavior is indicative of potential command and control (C2) communication, network reconnaissance, or proxy activity.
This rule detects execution of commands or network traffic containing strings indicative of EDR bypass attempts, obfuscation frameworks, or C2 hosting/infrastructure. This usually signals active adversary efforts to evade defensive controls or setup command-and-control communication.
This rule identifies processes that initiate network connections with a significant time delay (greater than 300 seconds) after the process was initially created. This pattern of delayed connection can be indicative of C2 beaconing behavior, where malware sleeps for a period of time before attempting to check in with a command-and-control server.
Detects the execution of Microsoft Edge WebView2 (msedgewebview2.exe) as a child process of the NVIDIA system runtime (nvidia-sysruntime.exe). This pattern is associated with LabubaRAT, where the legitimate NVIDIA process is abused to launch WebView2 for command-and-control (C2) communication and data exfiltration.
Page 33 of 60