Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,247 detections
Filters
Last updated
All Time
Detection languages
690
140
94
67
56
Contributors
389
247
199
52
45
Categories
787
411
262
248
188
Platforms
836
265
264
169
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,247
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
Identifies the SimpleHelp binaries making outbound network connections to untrusted/anomalous IPs, bypassing the configured corporate RMM domains. This rule specifically looks for processes named 'JWrapper*.exe' making network connections to URLs that do not end with 'simple-help.com' or a specified corporate RMM domain, and to remote IPs that are not within the 10.0.0.0/8 private range.
This rule detects anomalous network connections originating from common communication applications (Teams, Slack, Discord, Skype) to non-standard ports (not 80, 443, 8080, 8443) and to IP addresses not typically associated with Microsoft or other major cloud providers (e.g., not starting with 13. or 51.). It specifically looks for a high volume of such connections (10 or more within an hour) from a single process on a device, which could indicate protocol tunneling or the use of these applications for command and control.
This rule monitors for suspicious activity originating from the DHCP Client service process (svchost.exe running with 'Dhcp' in the command line). It detects unauthorized child processes (such as cmd.exe or powershell.exe), unexpected child processes that deviate from established baselines, service crashes potentially indicative of exploitation, and anomalous network connections to non-standard DHCP ports or external IP addresses.
This rule detects suspicious command-line activity that may indicate the leakage of API keys, specifically those resembling OpenAI API keys (starting with 'sk-', 'sk_live_', or 'sk_test_'). It looks for these patterns in conjunction with common data transfer utilities like curl, wget, powershell, or python, when executed by a process that is not a standard shell or explorer process. The rule triggers if two or more such events occur within an hour on the same computer.
Detects potential Trickbot activity by searching for known Trickbot-related keywords ('trickbot', 'server=', 'botnet', 'moduleload') in process command lines, combined with network-related keywords ('http', 'port'). This rule specifically looks for Event ID 4688 (a process creation event in Windows Security Event Logs) and analyzes its CommandLine field.
Detects outbound network connections to URLs containing strings associated with Qakbot (Qbot) malware infrastructure and common ports used by the malware for command-and-control communication.
Detects potential ransomware activity characterized by the creation of files with a specific extension (.prinzeugen) followed by outbound network communication to known malicious IP addresses within a 24-hour window, which is indicative of double-extortion ransomware behavior.
This rule detects network connections from internal devices to identified APT Command and Control (C2) IP address ranges over common ports (8080, 443, 21, 22, 23, 25, 445). This traffic pattern is indicative of unauthorized external communication commonly associated with malware or adversary activity.
This rule detects the creation of the 'class-wc-subscription-diagnostics.php' backdoor file followed by a network connection to the command and control (C2) domain 'generate.2faplugin.org' within a 30-minute window on the same device. This correlation indicates a potential supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels, leading to 2FA exfiltration.
Aggregates all traffic over the custom ShapedPlugin C2 port 2871 to identify potential lateral movement or widespread beaconing.
Detects patterns indicative of double extortion ransomware attacks, specifically the staging of large volumes of archived data followed by suspicious command and control (C2) communications. The rule identifies the creation, modification, or movement of multiple large archive files (RAR, 7z, ZIP, TAR, GZ, CAB) in common temporary or system directories, and correlates this activity with outbound network connections to known C2 indicators such as Tor/I2P/VPN/proxy services or non-RFC1918 IP addresses.
Detects patterns indicative of double extortion ransomware attacks, specifically the staging of large volumes of archived data followed by suspicious command and control (C2) communications. The rule identifies the creation, modification, or movement of multiple large archive files (RAR, 7z, ZIP, TAR, GZ, CAB) in common temporary or system directories, and correlates this activity with outbound network connections to known C2 indicators such as Tor/I2P/VPN/proxy services or non-RFC1918 IP addresses.
This rule detects suspicious sign-in attempts to Azure AD where Conditional Access policies were not applied, the sign-in was successful, and the user agent string indicates a bot, crawler, headless browser, or common scripting tools like curl, wget, or python. It specifically looks for multiple such logins or logins from multiple unique devices within a 5-minute window for the same user and risk detail.
Detects network connections to IP addresses and domains associated with ShinyHunters' infrastructure, observed during the Oracle PeopleSoft data theft campaign.
This rule detects suspicious sign-in attempts to Azure AD where Conditional Access policies were not applied, the sign-in was successful, and the user agent string indicates a bot, crawler, headless browser, or common scripting tools like curl, wget, or python. It specifically looks for multiple such logins or logins from multiple unique devices within a 5-minute window for the same user and risk detail.
This rule tracks the execution of a file named 'uds.exe' and subsequently monitors for any network connections initiated by this process within a 10-minute window of its creation. This behavior is indicative of a compiled payload attempting unauthorized network exfiltration shortly after dynamic compilation, as observed in the 'Operation SilentCanvas' campaign.
This rule detects network connections initiated by 'bun.exe' to specific IP address ranges (94.154.172.0/24 or 91.195.240.0/24) that have been identified as malicious command and control (C2) infrastructure. This indicates potential compromise of a system where 'bun.exe' is being used for malicious communication.
Detects Sliver C2 framework based on default TLS certificate
Detects HTTP C2 communication patterns associated with Remcos RAT loader by monitoring network events for specific URLs and known malicious IP addresses. This rule identifies outbound network connections to hardcoded malicious IPs and specific URL paths often used for command and control by Remcos.
This rule detects patterns associated with the APT29 Wineloader backdoor. It looks for the creation of ActiveX objects for Wscript.Shell and Scripting.FileSystemObject, XMLHttpRequest for HTTP requests, specific `certutil -decode` commands, `tar -xf` commands, the presence of `SqlDumper.exe` in a specific path, and generic URL patterns. These indicators suggest potential execution of malicious scripts, file manipulation, data exfiltration, and command and control communication.
This rule detects the use of TLS protocol on port 443 with a specific content signature, indicating potential Command and Control (C2) activity. It triggers an alert if 20 such connections are observed from the same source within 60 seconds.
Page 46 of 60