Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,247 detections
Filters
Last updated
All Time
Detection languages
690
140
94
67
56
Contributors
389
247
199
52
45
Categories
787
411
262
248
188
Platforms
836
265
264
169
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,247
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
This rule identifies network traffic containing specific strings associated with known malicious command-and-control (C2) behavior, such as hardcoded PHP script names often used by web shells, connection attempts to Telegram API servers for exfiltration, and other identifiable strings often associated with threat actor interaction.
Detects the execution of specific suspicious filenames ('YEPlayer.exe', 'Pis2rayVPN.msi', 'YEMPlayer.msi') or command-line references to these files, combined with correlated network activity to specific suspicious domains associated with masqueraded 'microsoft.comi-site.website' URLs.
Detects instances where Chrome or Microsoft Edge are launched in headless mode with remote debugging enabled. This configuration exposes the browser's debugging interface, typically on port 9222, which can be leveraged by attackers for browser exploitation, data exfiltration, or persistence within the browser context.
This rule detects potentially unauthorized access or activity related to MySQL databases. It monitors for external network connections to the MySQL default port (3306) that originate from non-private IP addresses, and identifies suspicious process command lines using Python's PyMySQL library that attempt to authenticate as the 'root' user.
Detects excessive network activity patterns by ff-agent which may indicate beaconing or unauthorized scanning activity. Note that this rule requires a backend capable of correlation or statistical aggregation.
This rule detects a multi-stage attack chain associated with the SnappyClient RAT (Operation Turb00). The detection logic correlates: 1. Execution of known malicious processes (AlphVector, WizardDa42, VirtualAr, or Crisp); 2. Persistence mechanisms including specific registry keys (CadenceOptimizer) or file artifacts (shortcut links, scheduled tasks, Mayanex data dir, or CorsairUtil DLL); and 3. Outbound network traffic on ports 3333 or 3334 to external IP addresses.
Detects anomalous activity associated with the exploitation of RustDesk session permission bypass vulnerabilities. Specifically identifies 'rustdesk.exe' spawning suspicious child processes (indicative of post-exploitation command execution) or initiating outbound network connections on non-standard relay ports, which may signal a compromised remote access session.
Detects the execution of an AppleScript file via the osascript utility that initiates a network connection within a 5-minute window of execution. This behavior is often indicative of automated script-based network activity, such as command-and-control communication or data exfiltration.
This rule detects processes that load Pluggable Authentication Modules (PAM) libraries (libpam) and subsequently initiate network connections within a 30-minute window. This behavior is often associated with credential dumping tools or malicious implants attempting to exfiltrate cached credentials or session information from memory on Linux and macOS systems.
Detects outbound network traffic originating from internal assets destined for IP addresses identified as Command and Control (C2) infrastructure associated with the UAT-7810 threat actor group.
Detects network activity initiated by a process named 'Trustrap' communicating over common ports (80, 443, 53). The rule aggregates data by endpoint, process, and port, sorting by the frequency of connections to highlight potentially high-volume communication patterns.
Detects instances where the Claude Code AI agent process spawns shell interpreters (bash, sh) or network utilities (curl, wget, dig, nslookup) with potentially malicious command line arguments. This behavior can be indicative of indirect prompt injection or unauthorized remote code execution attempts, such as reverse shells, base64 encoded payloads, or DNS-based exfiltration.
Detects anomalous access to Cisco SD-WAN Manager (vManage) infrastructure. This includes unauthenticated REST API access, unauthorized NETCONF sessions, and suspicious OMP/DTLS peering connections, which may indicate exploitation of vulnerabilities (such as CVE-2026-20127 or CVE-2026-20182) or unauthorized management access.
Detects the execution, network activity, or installation of GSocket (gsocket/gs-netcat) tools used for creating remote access tunnels. The rule also identifies instances where the legitimate 'uptime' binary is masqueraded to execute GSocket commands or establish unauthorized network connections.
This rule detects a suspicious network connection on local port 1313 followed within 5 minutes by a PowerShell network connection to a non-standard port (not 80, 443, 8080, 8443). This behavior is characteristic of an initial exploit attempt targeting a service on port 1313, followed by a post-exploitation reverse shell.
This rule detects network connections or DNS queries originating from common web browsers (chrome.exe, msedge.exe, chromium.exe) towards domains related to Perplexity AI. Such activity may indicate data exfiltration or the use of AI tools for processing sensitive organizational data via browser-based interfaces.
Detects malicious activities targeting Cisco Catalyst SD-WAN infrastructure, including connections from known malicious IP addresses (UAT-8616), unauthenticated vManage API access attempts indicative of exploitation (CVE-2026-20182), and anomalous control-plane signaling (OMP/DTLS/NETCONF) from unauthorized external sources.
This rule detects suspicious network connections originating from internal IP addresses to common service ports (DNS, SMB, RDP, WinRM) on remote, non-internal IP addresses. It flags instances where a single process on a device makes 10 or more such connections within an hour, which could indicate reconnaissance, lateral movement, or data exfiltration attempts.
Detects suspicious behavior originating from Windows Package Manager (winget.exe) and associated DSC/Server processes. This rule identifies two specific patterns: 1) These processes spawning shells or interpreters (e.g., PowerShell, cmd, mshta) which may indicate command-line abuse or malicious script execution. 2) These processes making outbound network connections to non-private/external IP addresses, potentially indicating remote payload delivery or command and control activity.
This rule detects outgoing TCP traffic that initiates a SOCKS5 handshake (indicated by the byte sequence |05 01 00|) on destination ports other than standard web ports (80, 443, 8080, 8443). This behavior is characteristic of TOR client traffic attempting to establish an anonymous connection to an external TOR relay or node via non-standard network ports.
Detects a multi-stage execution chain associated with the 'Contagious Interview' campaign, where Visual Studio Code (Code.exe) spawns a shell process (cmd, powershell, bash, or sh) that uses network retrieval utilities (curl, wget, or http) to download content from known Lazarus group staging domains within a two-minute window.
Page 34 of 60