Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,247 detections
Filters
Last updated
All Time
Detection languages
690
140
94
67
56
Contributors
389
247
199
52
45
Categories
787
411
262
248
188
Platforms
836
265
264
169
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,247
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
Detects the use of Gsocket or gs-netcat utilities for outbound network connections on non-standard ports, as well as the execution of masqueraded 'uptime' binaries making network connections. It also monitors for DNS resolutions associated with Gsocket relay infrastructure to identify potential command and control or unauthorized tunneling attempts.
This rule detects web browser processes (Chrome, Edge, Brave, Electron) making network requests to 'raw.githubusercontent.com' that contain keywords indicative of sensitive data, such as 'credential', 'secret', 'password', 'token', 'api_key', or '.env'. This behavior may indicate an adversary attempting to download configuration files or sensitive credentials hosted on GitHub.
Detects inbound network connections initiated by common Windows Nearby Sharing processes ('NearShare.exe', 'NearbySharing.exe', 'quickshare.exe', 'NearbyConnectionsService.exe') that occur on non-standard ports, potentially indicating unauthorized or malicious use of these utilities.
Detects inbound network connections initiated by common Windows Nearby Sharing processes ('NearShare.exe', 'NearbySharing.exe', 'quickshare.exe', 'NearbyConnectionsService.exe') that occur on non-standard ports, potentially indicating unauthorized or malicious use of these utilities.
Detects network connection attempts or successes from critical Windows processes (System, svchost.exe, lsass.exe) targeting the localhost interface (127.0.0.1 or ::1) on non-standard ports (above 1024, excluding SMB ports 445/139). This behavior is often indicative of local process injection, credential dumping activity, or unauthorized inter-process communication used by malware to bypass network security controls.
This rule detects web browser processes (Chrome, Edge, Brave, Electron) making network requests to 'raw.githubusercontent.com' that contain keywords indicative of sensitive data, such as 'credential', 'secret', 'password', 'token', 'api_key', or '.env'. This behavior may indicate an adversary attempting to download configuration files or sensitive credentials hosted on GitHub.
Detects the execution of a Nuitka-compiled Python RAT (chost.exe) associated with the PostCSS typosquatting campaign. The rule identifies this malicious binary when spawned by wscript.exe, powershell.exe, or node.exe from a location outside of C:\Windows\, followed by network communication to known campaign-associated C2 infrastructure.
This rule identifies network connections (DNS queries, HTTPS/WebSocket traffic) directed toward known suspicious domains associated with potentially malicious C2 infrastructure.
This rule detects instances where Microsoft Excel (excel.exe) initiates an external network connection within 60 seconds of process startup. This behavior is often associated with the execution of malicious macros or embedded objects designed to reach out to attacker-controlled infrastructure for downloading secondary payloads or establishing command-and-control (C2) communication.
This rule detects instances where Microsoft Excel (excel.exe) initiates an external network connection within 60 seconds of process startup. This behavior is often associated with the execution of malicious macros or embedded objects designed to reach out to attacker-controlled infrastructure for downloading secondary payloads or establishing command-and-control (C2) communication.
Detects network communication with the Rokarolla trojan's command and control (C2) server ('beralisvc.info') and subsequent injection of base64-encoded HTML phishing overlays into legitimate banking application UIs. The rule identifies C2 contact via network events and the presence of specific HTML content indicators ('html_base64', 'PCFEt0NUWVBFIGh0bWw+', 'com.imaginbank.app') in HTTP responses, suggesting an overlay attack.
Detects network communication with known malicious IP addresses or URLs associated with the 'govtop.one' infrastructure, which is commonly indicative of command and control activity or malware beaconing.
This rule detects network connections on TCP ports 7000, 7001, 8770, and 5353 (commonly associated with Apple services like AirPlay, AirPrint, and Bonjour) initiated by processes other than standard Apple binaries such as iTunes, AppleMobileDeviceService, Bonjour, or mDNSResponder. This behavior may indicate an attempt to blend into expected network traffic by masquerading as legitimate Apple service communication.
This rule detects processes making a high volume of successful network connections to GitHub's raw content (raw.github.com). This behavior can be indicative of an adversary downloading tools, scripts, or other malicious content from GitHub, potentially as part of a command and control (C2) channel or for staging purposes. The rule counts connections per hour per initiating process filename and flags if the count exceeds 5.
Detects Jellyfin's automated ffprobe media scan pipeline spawning suspicious network-related shell commands. This indicates active exploitation of the PixelSmash vulnerability (CVE-2026-8461) via zero-click library scans.
Detects a non-cloud client process issuing API-style requests associated with object listing, content upload, or content download to a cloud storage service. The rule specifically targets processes with names matching patterns like 'bird', 'rok', 'game', or 'update' followed by '.exe', and command lines containing API-related keywords ('files/list', 'files/upload', 'files/download', 'oauth', 'bearer', 'api') in conjunction with cloud storage service names ('dropbox', 'pcloud', 'cloud'). This behavior is indicative of malware using legitimate cloud services for command and control or data exfiltration.
Detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group.
Detects the LegionLoader malware staging its Python-based C2 module named _socket.pyd within non-standard directories in the AppData\Roaming path. This behavior is indicative of a persistence or execution staging mechanism where the malware attempts to hide its components in user-writable directories while avoiding standard Python installation paths.
Detects the execution of Python interpreters from user-writable AppData\Roaming directories initiating external network connections. This behavior is consistent with the execution of LegionLoader malware and its associated _socket.pyd Python C2 module.
Detects potential C2 beaconing activity associated with LegionLoader by monitoring for outbound network connections to 'birdeemusic.com' domains initiated by Python or AppData/Roaming-based processes, following a precursor process launch (msiexec.exe or from AppData/Roaming) on the same host within 10 minutes.
This rule detects outbound network connections from devices to a specific remote IP address (62.102.148.212) on a set of suspicious remote ports (37393, 45839, 38471, 12345, 4444, 5555). This pattern is indicative of potential command and control (C2) communication or data exfiltration to a known malicious endpoint.
Page 43 of 60