Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,247 detections
Filters
Last updated
All Time
Detection languages
690
140
94
67
56
Contributors
389
247
199
52
45
Categories
787
411
262
248
188
Platforms
836
265
264
169
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,247
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
Detects indicators associated with the JDY botnet targeting SOHO and IoT infrastructure. The rule monitors for suspicious firmware update attempts to non-vendor hosts, identifies high-rate outbound scanning from edge devices, and flags devices that show re-emergence of suspicious behavior after a quiet period.
Detects network connection attempts or successes from critical Windows processes (System, svchost.exe, lsass.exe) targeting the localhost interface (127.0.0.1 or ::1) on non-standard ports (above 1024, excluding SMB ports 445/139). This behavior is often indicative of local process injection, credential dumping activity, or unauthorized inter-process communication used by malware to bypass network security controls.
This rule detects web browser processes (Chrome, Edge, Brave, Electron) making network requests to 'raw.githubusercontent.com' that contain keywords indicative of sensitive data, such as 'credential', 'secret', 'password', 'token', 'api_key', or '.env'. This behavior may indicate an adversary attempting to download configuration files or sensitive credentials hosted on GitHub.
Detects inbound network connections initiated by common Windows Nearby Sharing processes ('NearShare.exe', 'NearbySharing.exe', 'quickshare.exe', 'NearbyConnectionsService.exe') that occur on non-standard ports, potentially indicating unauthorized or malicious use of these utilities.
This rule detects a multi-stage malicious activity pattern where a process performs system reconnaissance (process enumeration followed by network configuration enumeration) followed by an outbound network connection to a non-internal IP address. The rule uses transaction correlation on the ProcessGuid/ParentProcessGuid to link these distinct events into a single chain within a 2-minute time window.
Detects network connections initiated by a non-Microsoft signed rundll32.exe process. The rule identifies processes named rundll32.exe that are not signed by Microsoft and are communicating over common ports associated with malicious activity, specifically focusing on external IP addresses and multiple connection attempts.
Detects outbound network traffic from browser processes to known BadBlocker extension command-and-control infrastructure (api.adblock-for-youtube.com or get.adblock-for-youtube.com), followed by subsequent outbound HTTPS connections to arbitrary external domains. This sequence is indicative of malicious browser extension activity involving the exfiltration of session cookies or authentication tokens from the victim's browser.
Detects outbound network connections from endpoint processes to domains associated with a malicious browser extension. The extension is known to fetch scriptlets that enable main-world JavaScript injection and potential credential theft (e.g., document.cookie).
Detects processes that load .NET runtime assemblies (clr.dll/coreclr.dll) from non-standard paths while concurrently performing named pipe inter-process communication and initiating outbound network connections. This behavior is often indicative of fileless execution, living-off-the-land techniques, or lateral movement where a process is repurposed as a proxy or command-and-control conduit.
This rule detects potential command and control (C2) beaconing activity by identifying devices communicating with known suspicious remote IP addresses at regular, repeating intervals. It calculates the time difference between consecutive connections to specific suspicious IPs and identifies devices that establish at least three connections within one-hour bins, adhering to a 1 to 15-minute heartbeat interval.
This rule detects multiple outbound network connections to a specific set of known malicious C2 IP addresses on specific ports within a one-hour window. This behavior is indicative of a multi-payload delivery pattern associated with malware families such as Remcos, Agent Tesla, and RedLine.
Detects network activity associated with Cobalt Strike Beacon behavior by identifying specific file extensions (.bin, .stager, .update, .task, .post) commonly used in Beacon staging and communication profiles within network inspection events.
This rule detects successful outbound network connections from an endpoint to a known Tor directory authority IP address. Establishing a connection to these authorities is a strong indicator that the system is attempting to join the Tor network or is interacting with Tor infrastructure, which may be unauthorized in enterprise environments.
This rule detects network connections on TCP ports 7000, 7001, 8770, and 5353 (commonly associated with Apple services like AirPlay, AirPrint, and Bonjour) initiated by processes other than standard Apple binaries such as iTunes, AppleMobileDeviceService, Bonjour, or mDNSResponder. This behavior may indicate an attempt to blend into expected network traffic by masquerading as legitimate Apple service communication.
This rule detects network communication to a known command and control (C2) server (23.254.164.123:443) associated with the 'protocal.cjs' backdoor, which is part of the 'easy-day-js' npm supply chain compromise. The detection specifically looks for TLS traffic with a Server Name Indication (SNI) and general IP traffic to this C2 address.
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
Detects potential DcRAT activity characterized by a process spawning under a svchost.exe parent, subsequent loading of GDI display libraries for screen capturing, and outbound network communication on non-standard ports, which indicates data exfiltration.
This rule detects potentially malicious activities involving Microsoft Copilot and Microsoft Graph, specifically focusing on unauthorized mailbox access via non-interactive sessions and patterns indicative of Server-Side Request Forgery (SSRF) during search operations. It monitors for anomalous interaction with the Graph API, specific Copilot search parameters, and suspicious image search requests.
Detects instances where the Windows Service Host process (svchost.exe) initiates more than five network connections to external (non-private/non-local) IP addresses within a short timeframe. This behavior is often characteristic of command-and-control (C2) activity or beaconing by malicious code masquerading as or injecting into system services.
This rule detects processes running from suspicious temporary directories (AppData, Temp, LocalAppData, TCC) initiating frequent outbound network connections to a specific non-standard destination port (18848). This behavior is often indicative of automated Command and Control (C2) heartbeats or beacons, particularly when associated with binaries executing from untrusted or user-writeable locations.
Detects specific suspicious processes (MediumInstStart.exe or pcl2bmp.exe) initiating network connections or DNS requests to identified malicious IP addresses (188.208.141.177) or domains (couldinstallup.com, workdrive.zoho.com, zohoapis.com) within a one-hour window. These processes are indicative of potential malware or unauthorized C2 activity.
Page 40 of 60