Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects a network connection to Google's passkey enclave or caBLE hybrid-transport domain (*.ua5v.com) that should be correlated with EDR process telemetry to confirm the source process is non-browser, unsigned, or otherwise anomalous rather than the legitimate Chrome browser.
Detects an Xcode project or Git repository build-phase/pre-commit hook triggering an initial C2 beacon via curl GET /a?p=xcode_phase to retrieve the next infection stage.
Detects CountLoader's C2 beacon sequence: an HTTP GET to /connect carrying XOR-hex-encoded host telemetry and a Bearer token, followed within an hour by a JWT-authenticated getUpdates POST from the same host/destination pair.
SNOWBELT time-based DGA S3 bucket manifest retrieval
Detects instances where a Python interpreter (python.exe/pythonw.exe) or an executable file launched from temporary, roaming, or public directories initiates an outbound network connection to common C2/high-risk ports. This behavior is indicative of potential malware staging or C2 communication from obfuscated or temporary locations.
Detects malicious browser extension background scripts exfiltrating browser data by identifying specific message patterns (type 0x14/20 and event 0xc8/200 containing keyword, url, and count fields) or activity associated with known malicious extension IDs and native messaging hosts.
Detects network communication associated with the TOKYOCORE malware C2 infrastructure. The rule monitors for specific API endpoints (/api/victim/(log|data|command|archive)) combined with known malicious User-Agent strings (RansomAgent or fsociety/1.0), as well as suspicious multipart form data uploads that may indicate data staging or exfiltration.
Detects outbound network traffic to the 'logfriend[.]com' domain, specifically to endpoints used by the Forg365 'ForgCookie' browser extension. This extension is known to facilitate the automated refreshing of Microsoft SSO cookies, potentially enabling persistent session hijacking and bypassing MFA.
CaptiveCrunch ChocoShell disguised C2 URI pattern to known Storm-2945 C2 IP (/t/event, /t/pixel.gif, polyfill payload)
Detects XCSSET's Telegram data-theft module staging AES-encrypted configuration and chat data in ~/.tr and ~/.tr_map, correlated with the /w?tr exfiltration upload to C2.
Detects suspicious processes that repeatedly enumerate installed software via registry Uninstall keys and access sensitive browser data (History, cookies, and web-data files) over a period of multiple days, while simultaneously generating consistent outbound network beaconing. This behavior is indicative of data-stealing malware, such as the Dolphin X 'AI Profiler', which profiles victims based on their application usage and browsing habits.
Detects network activity associated with the Dolphin X malware, including DNS queries, TLS SNI requests, and direct TCP traffic to known C2 infrastructure patterns on specific ports.
Detects an HTTP POST to an IP-literal host occurring after an eth_call blockchain RPC lookup from the same host, consistent with DeviceManager/DOUBLECUP resolving and beaconing to a C2 address extracted from blockchain-sourced configuration.
Detects DOUBLECUP's session polling/telemetry beacon to /session/reg, /session/check, and /session/signal with a sid= query parameter, requiring at least 5 requests within 15 seconds to match the malware's 1.2-3 second polling cadence.
Detects a CountLoader command-and-control pattern where a process issues an HTTP GET to a /connect endpoint with XOR-hex-style query parameters, followed within one hour by an Authorization: Bearer JWT token reused by the same process, host, and agent.
Dolphin X DNS query for thedolphinx.top C2 domain
Detects Edgecution/SNOW malware suite components across the kill chain via known SHA256 file hashes (phishing HTML, AutoHotkey stager, Edgecution ZIP archive, extension background.js, Python native host backdoor) and combinations of embedded code/path strings associated with SNOWGLAZE/SNOWBASIN; requires multiple distinctive strings together to reduce false positives
Detects short-lived, randomly-named .txt files (15-30 lowercase letters) created and then deleted within 5 minutes by python.exe or pythonw.exe processes in a folder path containing "native", consistent with the Edgecution native messaging host component using temporary text files as a queue/log for C2 command exchange.
Detects HTTP GET requests with an Upgrade: websocket header directed at known UNC6692 Edgecution/SNOWBELT malware command-and-control infrastructure hosted on CloudFront subdomains via the /ws URI path. This indicates active WebSocket-based communication between an infected host and the threat actor's C2 server.
Detects the use of PowerShell to perform a fileless download-and-execute operation, characterized by the presence of web-based download cmdlets alongside in-memory execution primitives. This pattern is commonly used for staging malicious payloads such as Cobalt Strike, Sliver, or other offensive tooling while avoiding file-based detection.
Detects an Xcode project or Git repository build-phase/pre-commit hook triggering an initial C2 beacon via curl GET /a?p=xcode_phase to retrieve the next infection stage.
Page 100 of 190