Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,247 detections
Filters
Last updated
All Time
Detection languages
690
140
94
67
56
Contributors
389
247
199
52
45
Categories
787
411
262
248
188
Platforms
836
265
264
169
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,247
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
Looks for Metadata IOCs as listed in the CISA report on BrickStorm C2 malware.
I don't recommend using this query on its own; rather, use it in conjunction with behavioural analysis to look for evidence of BrickStorm activity.
https://media.defense.gov/2025/Dec/04/2003834878/-1/-1/0/MALWARE-ANALYSIS-REPORT-BRICKSTORM-BACKDOOR.PDF
I don't recommend using this query on its own; rather, use it in conjunction with behavioural analysis to look for evidence of BrickStorm activity.
https://media.defense.gov/2025/Dec/04/2003834878/-1/-1/0/MALWARE-ANALYSIS-REPORT-BRICKSTORM-BACKDOOR.PDF
This rule detects the presence and activity of the ShadyPanda malware campaign, specifically focusing on malicious Chrome extensions and their associated command and control (C2) and data exfiltration domains. It identifies the creation of files with known malicious Chrome extension IDs (ending in '.crx') and network connections to hardcoded C2 and exfiltration domains linked to the ShadyPanda campaign.
This rule detects when a domain or URL observed in Teams Messages matches a known threat intelligence indicator from Microsoft Defender Threat Intelligence. It specifically looks for hits against 'Domain' and 'URL' type indicators.
The .cfd Top-Level Domain (TLD) is often linked to malicious activities such as phishing, malware distribution, and command-and-control (C2) operations. This query detects new allowed network connections to .cfd domains that have appeared for the first time in your environment within the past 24 hours. Monitoring these connections can serve as an early warning sign of potential security breaches or users being targeted by phishing attacks. The query also provides valuable context for each newly observed domain, including its first-ever occurrence within a 30-day window, the total recent access count, and the users involved—enabling analysts to quickly evaluate the associated risk.
This rule detects outbound HTTP traffic where the User-Agent header contains the string 'Internet Explorer'. This has been seen used by malware, and the legitimate Internet Explorer browser uses the User-Agent string "MSIE". The MSIE browser was end-of-lifed in 2022. The rule specifically looks for this pattern in established, to_server HTTP flows.
This rule enables logging of JA3 and JA3S hashes in AWS Network Firewall to enhance visibility into TLS connections, useful for identifying malicious activities.
This rule configures AWS Network Firewall to block outbound traffic to IPs located in high-risk countries, such as Russia and China, as a preventive security measure.
This rule monitors AWS Network Firewall for HTTP and TLS connections to domains with uncommon TLDs to identify anomalous behavior without blocking traffic, providing visibility rather than specific threat detection.
This rule blocks connections made directly to IP addresses instead of domain names, a technique often used by malware to evade detection, leveraging AWS Network Firewall and Suricata.
This rule provides a preventive configuration for AWS Network Firewall that blocks outbound HTTP and TLS connections to domains using high-risk country-code top-level domains (ccTLDs) like .ru and .cn.
This rule blocks HTTP and TLS connections to domains with high-risk TLDs like .xyz, .info, and .top due to their frequent association with malicious activities.
Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution.
Shai-Hulud is an npm supply chain worm targeting CI/CD environments.
It installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks.
Shai-Hulud is an npm supply chain worm targeting CI/CD environments.
It installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks.
Detects common shell processes launching a reverse shell using the '/dev/tcp' redirection. This technique is known to be used by adversaries like the Clop ransomware group for persistence and command and control.
ET MALWARE Win32/Lumma Stealer Related CnC Domain in DNS Lookup (sanguen .courses)
ET MALWARE Observed Win32/Lumma Stealer Related Domain (sanguen .courses) in TLS SNI
ET INFO Blockchain RPC Domain in TLS SNI (cloudflare-eth .com)
Detects outbound network connections to the OpenAI API from unusual processes, a TTP used by the SesameOp backdoor for command and control (C2).
Detects the execution of the Ligolo-ng tunneling tool, which is used by the Silent Lynx APT group for command and control and network pivoting.
Detects suspicious process execution originating from ManageEngine applications, as observed in attacks attributed to Mint Sandstorm. The rule specifically looks for PowerShell, `lsass` related commands, `wget`, `curl`, script execution, local group modifications, network user additions, registry modifications for Defender or LSA, WMIC for process creation or shadow copy deletion, `vssadmin` for shadow deletion, and `wbadmin` for catalog deletion, all originating from a ManageEngine parent process. It filters out legitimate ManageEngine downloads.
Yara rule that detects WeaselStore infostealer.
Detects HTTP requests indicative of Oyster malware C2 beaconing, including GET requests to /reg with WordPressAgent User-Agent and application/json Content-Type, GET requests to /login with FingerPrint User-Agent, and GET/POST requests to /api/kcehc or POST requests to /api/jgfnsfnuefcnegfnehjbfncejfh.
Page 52 of 60