Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,247 detections
Filters
Last updated
All Time
Detection languages
690
140
94
67
56
Contributors
389
247
199
52
45
Categories
787
411
262
248
188
Platforms
836
265
264
169
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,247
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
This rule monitors network, proxy, and DNS traffic for connections to the domain 'perplexity-ai.online'. It identifies potentially suspicious activity by aggregating requests and distinguishing between general outbound traffic and traffic to specific endpoints, such as search queries that may indicate data exfiltration or reconnaissance.
Detects the execution of specific suspicious binaries (tcc.exe or LuaJit.exe) with command-line arguments indicative of shellcode loading, followed by a network connection to known C2 infrastructure (IP 207.56.8.166 or Port 18848) from the same host within 15 minutes.
Detects network and DNS indicators associated with BeepRAT, including connections to known C2 IP addresses on port 18848, resolution of known C2 domains, and suspicious DNS queries to 'doh.pub' from known loader processes (tcc.exe, HFY.exe).
Detects instances where common script interpreters (node.exe, python.exe, etc.) simultaneously access sensitive local credential files and establish outbound network connections to common web ports (80, 443, 8080, etc.), which is indicative of credential exfiltration behavior.
Detects outbound network connections to remote URLs containing keywords associated with blockchain, cryptocurrency, or Web3 technologies. This behavior may indicate an adversary utilizing blockchain services or decentralised infrastructure for command and control (C2) communication, exfiltration, or proxying.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
This rule detects indicators associated with the StegoAd malware family, specifically focusing on suspicious browser extension IDs observed in command-line arguments and network-related process activity (ProcessCreate or NetworkConnect). It monitors for known extension identifiers, StegoAd-specific C2 infrastructure domains, and payload frameworks observed in process command lines.
This rule monitors Cisco SD-WAN environment logs for indicators of unauthorized or suspicious control plane activity, including rogue peering attempts, unexpected NETCONF interactions, certificate mismatches, and unauthorized vBond/vSmart connections. It filters out known local management subnets and utilizes a threat intelligence lookup to identify potentially malicious infrastructure attempting to interface with the SD-WAN fabric.
Detects automated scraping of company location and headquarters pages
Detects network traffic associated with known Cobalt Strike Beacon request URI patterns. This rule utilizes network signature inspection to flag outbound connections containing URI fragments commonly used by Cobalt Strike default profiles.
Detects outbound network connections over port 8883 (MQTT/IoT) indicative of the Grandoreiro banking trojan. The rule identifies suspicious, unsigned, or non-whitelisted processes attempting to initiate multiple connections to external endpoints, masquerading as legitimate IoT telemetry traffic using MQTT client configurations.
This rule detects potentially suspicious network connections originating from processes residing in common Git development directories (e.g., node_modules, temp, workspace) shortly after a Git clone, pull, or fetch operation. The detection logic filters for successful connections to non-private, non-whitelisted remote endpoints, which may indicate an adversary leveraging legitimate developer tools and environments for command-and-control (C2) or payload exfiltration.
This rule detects network connections initiated by common Windows command-line utilities (powershell.exe, pwsh.exe, cmd.exe) to suspicious remote IP addresses or non-standard ports. It specifically flags known Command and Control (C2) IPs and atypical network ports to identify potential adversary activity like staging or communication.
Detects outbound network connections initiated by common AI agent runtime processes (Python, Node.js, OpenClaw) to external destinations that are not identified as known AI service providers, specifically focusing on non-standard ports or the use of WebSocket protocols. This behavior may indicate an AI agent being used for unauthorized data exfiltration, command-and-control communication, or interaction with an unverified external service.
Detects an AI agent performing outbound network connections to the stitch-design.ai domain. This behavior is indicative of a malicious AI agent attempting to fetch dynamically loaded execution instructions at runtime to evade static analysis during security vetting processes.
Detects G2M.exe making external connections shortly after loading a local g2m.dll, providing behavioural confirmation that the trusted binary has been repurposed. This rule specifically looks for network activity from G2M.exe when its process image path is located in suspicious directories like AppData, Temp, Downloads, ProgramData, or Users\Public, indicating potential abuse of a legitimate application.
Detects Python processes executing from suspicious locations like AppData or Temp folders that also establish outbound network connections. This behavior can indicate the execution of malicious Python scripts, often associated with malware, initial access, or command and control activities.
This rule monitors for suspicious activity originating from the DHCP Client service process (svchost.exe running with 'Dhcp' in the command line). It detects unauthorized child processes (such as cmd.exe or powershell.exe), unexpected child processes that deviate from established baselines, service crashes potentially indicative of exploitation, and anomalous network connections to non-standard DHCP ports or external IP addresses.
This rule detects outbound network connections from devices to a specific remote IP address (62.102.148.212) on a set of suspicious remote ports (37393, 45839, 38471, 12345, 4444, 5555). This pattern is indicative of potential command and control (C2) communication or data exfiltration to a known malicious endpoint.
This rule detects network activity associated with the Hashtopolis agent. Specifically, it looks for the string "hashtopolis" within the HTTP User-Agent header of traffic flowing from a client to a server. This activity is linked to the 'FortiBleed campaign', which involves distributed offline cracking of SHA-256 FortiGate administrator credential hashes.
This rule monitors network traffic for outbound connections to a specific remote IP address (38.60.253.35) on port 8084. This pattern is indicative of communication with a known command-and-control server or malicious infrastructure.
Page 44 of 60