Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,247 detections
Filters
Last updated
All Time
Detection languages
690
140
94
67
56
Contributors
389
247
199
52
45
Categories
787
411
262
248
188
Platforms
836
265
264
169
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,247
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
Detects DNS requests originating from endpoints targeting the 'adblock-for-youtube.com' domain. This activity may be associated with browser extensions that exhibit unexpected or potentially unwanted network behavior.
Detects network connections from the 'Adblock for YouTube' browser extension to its remote API endpoint (api.adblock-for-youtube.com). These connections are associated with fetching 'scripletsRules', a post-installation mechanism used to deliver dynamic payloads and potentially bypass extension security reviews.
This rule detects suspicious network connections, process activity, and file events related to Node.js or systemd-userdbd, potentially indicating C2 communication or the presence of malicious tools. Specifically, it looks for outbound TCP connections to port 4444, process command lines containing shell commands or 'node-pty', and file paths/names associated with 'apintergrationpost' or 'node-pty'.
Detects outbound network connections to remote URLs containing keywords associated with blockchain, cryptocurrency, or Web3 technologies. This behavior may indicate an adversary utilizing blockchain services or decentralised infrastructure for command and control (C2) communication, exfiltration, or proxying.
This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.
This rule detects network connections from devices to a specific IP address (62.102.148.212) and a set of associated ports (37393, 45839, 38471, 12345, 4444, 5555). This IP address and these ports are known indicators of compromise for the Remcos Remote Access Trojan (RAT) Command and Control (C2) infrastructure. Detection of such connections indicates potential Remcos RAT activity within the environment.
Detects potential ransomware activity characterized by the creation of files with a specific extension (.prinzeugen) followed by outbound network communication to known malicious IP addresses within a 24-hour window, which is indicative of double-extortion ransomware behavior.
Detects HTTP C2 communication patterns associated with Remcos RAT loader by monitoring network events for specific URLs and known malicious IP addresses. This rule identifies outbound network connections to hardcoded malicious IPs and specific URL paths often used for command and control by Remcos.
This rule detects suspicious command-line activity that may indicate the leakage of API keys, specifically those resembling OpenAI API keys (starting with 'sk-', 'sk_live_', or 'sk_test_'). It looks for these patterns in conjunction with common data transfer utilities like curl, wget, powershell, or python, when executed by a process that is not a standard shell or explorer process. The rule triggers if two or more such events occur within an hour on the same computer.
Detects the execution of VILE ransomware by identifying specific dropped file artifacts (vile_icon.ico, vile_deadlines.json, vile_user_files.zip) and correlating these file events with outbound network connections made by the same process to remote non-private IP addresses, indicating the likely exfiltration of harvested system metadata.
EchoCreep Sends an Up Success Check-In
Cortex XDR
Detects a Go backdoor or renamed service process emitting the distinctive 'Up Success' runtime message used during Discord channel check-in. This rule specifically looks for network events where the process name matches common system processes (searchapp, service, update) and the command line contains 'Up Success'.
Detects an iox-derived proxy process generating a key and initialisation vector while configuring hard-coded forwarding settings. This behavior is indicative of the SmuxProxy malware, which is known to use these techniques for encrypted communication and data forwarding.
This rule detects network connections to known malicious IP addresses or attempts to resolve specific domains associated with malicious activity. It monitors for outbound network traffic patterns identified as potential indicators of compromise (IOCs) linked to command and control (C2) servers.
Detects network traffic to known Storm-2949 ScreenConnect infrastructure IPs. This rule identifies outbound network connections from devices to specific IP addresses associated with command and control (C2) infrastructure used by the Storm-2949 threat group, leveraging ScreenConnect for remote access.
Detects outbound network connections to 'stitch-design.ai' or 'stitch-google.com', which are identified as malicious domains utilized by a compromised AI agent skill. This skill attempts to bypass security vetting by dynamically fetching its instructions from these attacker-controlled external domains post-installation.
Correlates a non-browser headless runtime (Node/Bun) querying the GitHub API for the specific commit 'OhNoWhatsGoingOnWithGitHub'. This could indicate a supply chain attack where malicious code within a Node.js or Bun.js application attempts to communicate with a GitHub dead drop for command and control or data exfiltration.
Detects unexpected outbound network connections from the ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe processes. Threat actors use WinGet DSC execution to establish reverse shells or download payloads. Network activity from these processes is highly unusual.
Detects command-line parameters indicating RPC calls to Ethereum/Polygon for C2 resolution, specifically looking for 'eth_call' and known blockchain service providers like 'drpc.org', 'tenderly', 'flashbots', or 'blastapi'. This activity is indicative of the EtherHiding malware.
This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.
Detects Sliver C2 framework based on default TLS certificate
This rule detects processes generating network connections to multiple known malicious ports (4444, 7211, 8000, 8001, 8002, 10000) within a 30-minute window. This behavior is indicative of command and control (C2) beaconing, where a compromised system periodically communicates with a C2 server. The rule is designed to identify a pattern of C2 activity that might be used across different threat campaigns, leveraging ports commonly associated with various C2 frameworks or custom C2 implementations.
Page 45 of 60