Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,247 detections
Filters
Last updated
All Time
Detection languages
690
140
94
67
56
Contributors
389
247
199
52
45
Categories
787
411
262
248
188
Platforms
836
265
264
169
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,247
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
This rule detects instances where MSBuild.exe initiates network connections to external IP addresses. MSBuild.exe is a legitimate Microsoft utility, but it can be abused by adversaries to proxy execution of malicious code and establish command and control (C2) communications. The rule filters out connections to internal, loopback, and non-routable IP spaces to focus on potentially malicious external communication attempts.
Detects the execution of common browser executables in headless mode with command-line arguments indicative of data exfiltration, malicious rendering (dump-dom), or external requests (http/data:text/html;base64,). This activity, especially when initiated by non-standard parent processes, can be a sign of automated web scraping, vulnerability scanning, or other malicious automated browser activity.
This rule detects network connections (both inbound and outbound) on TCP/UDP port 18789, excluding connections initiated by processes from well-known publishers like Microsoft, Apple, and Google. This port is not commonly used by legitimate applications and could indicate the presence of custom malware, command and control (C2) communication, or other unauthorized network activity.
This rule detects a suspicious attack chain, potentially related to 'ClickFix' or similar social engineering campaigns. It correlates multiple events within a 5-minute window: a browser being launched from an email client, a file download from a browser into the Downloads directory, and a command prompt being launched from explorer.exe executing a command that references the Downloads directory. Additionally, it looks for network connections initiated by common document types, which could indicate malicious document activity.
KQL Query
Detects Adobe Reader initiating unexpected network connections, which may indicate an exploit fetching a secondary payload or communicating with a C2 server.
Detects suspicious behavior associated with an Adobe Reader zero-day exploit, including specific network connections, suspicious user-agent strings, registry persistence, and specific image loads (e.g., ntdll.dll or bootsvc.dll).
Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file.
Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.
Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.
Detects unusual outbound network connections from ATM devices (identified by device names containing 'ATM', 'NCR', 'DIEBOLD', 'WINCOR'). The rule flags connections to public IP addresses, excluding common internal networks and standard web/DNS ports (80, 443, 53). Alerts are triggered if an ATM device shows a high number of connections, unique remote IPs, or significant data transfer, indicating potential compromise or unauthorized activity.
This rule detects suspicious activity across process events, file events, and network events by looking for specific SHA1/SHA256 hashes, command line arguments, folder paths, and remote URLs. The indicators suggest potential malware execution, file manipulation, or command and control communication.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
Detects the installation or execution of compromised npm packages related to the Axios supply chain attack, with execution or reference to the dropped macOS RAT payload.
This rule detects network connections from devices to known malicious infrastructure, specifically the domain 'sfrclak.com' or the IP address '142.11.206.73'. These indicators are associated with potential compromise or command and control activity.
Detects installation and post-installation activity associated with OpenClaw and its known variants — an open-source AI agent family classified as a Potentially Unwanted Application (PUA). Monitors for npm global install commands, execution of shell installer scripts, OpenClaw-related binary or package files written to disk, and outbound network activity originating from known OpenClaw agent processes. Covers 33 known variants of the OpenClaw family including Clawdbot, Moltbot, Ironclaw, MalClaw, and others.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
Detects network communication patterns associated with EtherRAT, including beaconing to 'aurineuroth.com' and CDN-like URLs. Additionally, it identifies host-based fingerprinting activities often performed by EtherRAT, such as hidden PowerShell execution, discovery of MachineGuid, antivirus product information, domain membership, and video controller details, as well as the creation of 'svchost.log' in AppData.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
This rule detects the presence of specific 'NODE_CHANNEL' values ('anglmf', 'cryptoexth4', 'complexarchaeologist1') in process command lines or network event initiating process command lines on macOS systems. These values have been observed in the GhostClaw/GhostLoader malware campaign, indicating potential execution or network communication related to this threat.
Detects Node.js making outbound connections to suspicious domains or IPs
This detection rule identifies activity related to the TeamPCP Telnyx PyPI backdoor, specifically targeting versions 4.87.1 and 4.87.2 of the 'telnyx' package. It looks for command-line executions involving 'pip install telnyx==4.87.1' or 'pip install telnyx==4.87.2'. Additionally, it detects network connections to the IP address 83.142.209.203 on port 8080 requesting 'ringtone.wav' or 'hangup.wav', which are indicators of the backdoor's communication. The rule also identifies persistence mechanisms by looking for 'msbuild.exe' in the Windows Startup folder path '\Microsoft\Windows\Start Menu\Programs\Startup\msbuild.exe'.
Page 49 of 60