Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,247 detections
Filters
Last updated
All Time
Detection languages
690
140
94
67
56
Contributors
389
247
199
52
45
Categories
787
411
262
248
188
Platforms
836
265
264
169
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,247
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
This rule detects network connections made to specific non-standard ports (7777, 8080, 8443) where the remote URL contains substrings associated with proxy or tunneling activities ('proxy', 'tunnel', 'hide'). This behavior is commonly associated with malware attempting to evade security controls by routing traffic through unauthorized intermediaries or obfuscated tunnels.
Detects network traffic associated with known Cobalt Strike Beacon request URI patterns. This rule utilizes network signature inspection to flag outbound connections containing URI fragments commonly used by Cobalt Strike default profiles.
Detects outbound network connections over standard SSH ports (22, 2222) initiated by process names typically associated with web requests or package management (curl, git, php), potentially indicating unauthorized remote access, lateral movement, or data exfiltration from a compromised host to an external, non-private network address.
This rule detects anomalous activities associated with RustDesk, such as spawning suspicious child processes, dropping files related to known session permission bypass proof-of-concepts, communicating with non-standard relay servers, or performing file write operations in sensitive system temporary directories, which indicates potential session hijacking or unauthorized remote access.
This rule detects when a command-line shell (bash, sh, cmd, powershell) is spawned by a parent process (curl, git, php, ssh) that has recently established an outbound network connection on port 22 (SSH). It also flags instances where the child shell process subsequently opens a network listener, often indicating a potential reverse shell or unauthorized remote access attempt.
Detects outbound network connections initiated by common AI agent runtime processes (Python, Node.js, OpenClaw) to external destinations that are not identified as known AI service providers, specifically focusing on non-standard ports or the use of WebSocket protocols. This behavior may indicate an AI agent being used for unauthorized data exfiltration, command-and-control communication, or interaction with an unverified external service.
Detects instances where the Excel process (excel.exe) initiates outbound network connections to non-private IP addresses on specific ports often associated with command and control or data exfiltration. This rule specifically excludes known Microsoft-owned CDN and update infrastructure, aiming to identify potential exploitation activity, such as that potentially associated with CVE-2025-60727.
Malvertising loader delivering CastleStealer via malicious Google Ads
Campaign converting compromised FortiGate firewalls into credential stealers
Detects network activity initiated by qemu-system-x86_64.exe to internal subnets using common lateral movement ports (21, 88, 389, 445, 636) or the execution of known tools netbird.exe or cookie_exporter.exe. This rule flags potential virtualization-based lateral movement or unauthorized tool usage.
Detects network connection activity originating from QEMU virtualization processes (qemu-system-x86_64, qemu-system-i386, qemu-system-aarch64) to external (non-private/non-local) IP ranges. This could indicate the use of virtualization tools to facilitate tunneling, proxying, or lateral movement within an environment.
This rule detects processes that perform a DNS query or network connection to common public IP geolocation services (e.g., ipify, icanhazip) followed by an outbound network connection to an external destination within a short time frame. It excludes common browser processes and standard system utilities, aiming to identify potentially malicious programs, custom scripts, or living-off-the-land binaries performing reconnaissance of the host's public network identity followed by external connectivity.
Detects processes making HTTP/HTTPS requests to localhost on ports 40341 or 40342 for '/metadata'. This pattern can indicate local service discovery, inter-process communication, or potentially malicious activity attempting to interact with local services, possibly for credential access or privilege escalation.
This rule detects suspicious activity based on a set of Indicators of Compromise (IOCs) including malicious IP addresses, domains, URLs, and file hashes (SHA256). It monitors network connection events for communication with known malicious IPs, domains, or URLs, and file/process events for the execution or presence of files with known malicious SHA256 hashes.
This rule detects network connections from internal devices to identified APT Command and Control (C2) IP address ranges over common ports (8080, 443, 21, 22, 23, 25, 445). This traffic pattern is indicative of unauthorized external communication commonly associated with malware or adversary activity.
Detects browser processes connecting to internal IP addresses followed by a connection to an external (non-whitelisted) destination within a 2-minute window. This behavior is indicative of potential data staging or exfiltration, where a web browser is used to access internal resources before transferring data to an external site.
This rule detects potential deployment of the 'gs-netcat' utility by identifying specific suspicious command-line patterns or file masquerading (where a file's original name doesn't match its current filename while residing outside standard system paths). It correlates these process execution events with subsequent outbound network connections on high ports (>10000) within a 5-minute window to identify potential reverse shell activity.
Detects browser processes connecting to internal IP addresses followed by a connection to an external (non-whitelisted) destination within a 2-minute window. This behavior is indicative of potential data staging or exfiltration, where a web browser is used to access internal resources before transferring data to an external site.
Detects browser processes connecting to internal IP addresses followed by a connection to an external (non-whitelisted) destination within a 2-minute window. This behavior is indicative of potential data staging or exfiltration, where a web browser is used to access internal resources before transferring data to an external site.
This rule detects potential JDY botnet activity characterized by host fingerprinting and data exfiltration patterns. It looks for repeated POST requests to specific URI patterns ('/gate', '/report', '/scan') accompanied by a significant volume of outbound data, indicative of automated C2 communication or data staging. The rule aggregates metrics per host to identify high-volume exfiltration patterns and calculates a risk score based on the frequency of requests and the diversity of destination IPs.
This rule identifies network connections (DNS queries, HTTPS/WebSocket traffic) directed toward known suspicious domains associated with potentially malicious C2 infrastructure.
Page 37 of 60