Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects high-frequency outbound HTTP traffic matching specific URI patterns associated with potential Adaptix C2 beaconing behavior. The rule uses a sliding window threshold (10 requests within 600 seconds) to identify repetitive check-in patterns, which is a common characteristic of malware command-and-control channels.
Detects the legacy SourTrade Mark-of-the-Web spoofing variant, where a downloaded file's Zone.Identifier data or an observed network request references the jimmywarting.github.io/StreamSaver.js helper path with an embedded attacker domain, date, and installer.exe filename — used to disguise the true download provenance of browser-assembled malware.
This rule detects potential command-and-control (C2) activity related to the NodeSnake RAT. It specifically identifies cleartext HTTP requests attempting to initiate a WebSocket upgrade (using the Sec-WebSocket-Key header) while the target host is specified as an IP address literal rather than a domain name, which is a common indicator of hardcoded or non-DNS-dependent C2 infrastructure.
This rule detects modifications to Azure Service Principal and Application object redirect URIs that match known patterns for reverse proxies, tunneling services, temporary callback infrastructure, or potential local token theft. Such changes may indicate an adversary attempting to establish persistent access, intercept authentication tokens, or bypass network controls via unauthorized application configurations.
Detects outbound HTTP GET requests to google.com that utilize a bare 'Mozilla/5.0' User-Agent header, which is indicative of the TOKYOCORE malware performing network connectivity checks. This behavior is atypical for standard browsers and can be used to identify potential beaconing activity.
Detects DNS resolution or network connections to command-and-control domains associated with ACR Stealer campaigns observed in mid-2026 intrusion chains. ACR Stealer exfiltrates browser credential stores (Login Data, Web Data) and beacons to short-lived infrastructure hosted under .icu, .sale, .cc, .com and .art TLDs. Any observed communication to these domains indicates an active infection.
This rule monitors outbound TLS traffic for Server Name Indication (SNI) fields matching known C2 or phishing domains associated with the JadeProx activity. This indicates a potential connection from an internal host to malicious infrastructure.
Repeated TLS beacon activity to external host preceding possible CornFlake RAT C2 sync
Detects XCSSET's Telegram data-theft module staging AES-encrypted configuration and chat data in ~/.tr and ~/.tr_map, correlated with the /w?tr exfiltration upload to C2.
STAC4749 DNS Query to Known C2 Domain or Cloudflare Workers.dev C2 Subdomain
This rule detects HTTP response bodies containing indicators associated with SourTrade malvertising campaigns, specifically JSON configuration fields and a base64-encoded Windows PE executable header (MZ/TVqQAAMAAAAEAAAA).
Detects a non-browser process establishing a loopback connection to a Chrome or Edge remote-debugging (CDP) endpoint. Malicious processes may abuse the Chrome DevTools Protocol to drive a headless browser, allowing the attacker to perform browser-based actions or use the browser as a covert C2 channel. This rule monitors for HTTP requests to /json/list/ or /devtools/ on 127.0.0.1 originating from processes other than chrome.exe or msedge.exe.
Detects endpoint file artifacts associated with known malicious browser extension IDs in browser extension storage paths, indicating possible installation or presence of malicious browser extensions.
Detects an unsigned process performing a specific behavioral sequence indicative of AI-assisted target profiling: high-volume software enumeration via registry keys, unauthorized access to browser data (history, cookies, bookmarks), and periodic C2-like network beaconing. The rule requires these actions to correlate within a tight 6-hour burst and exhibit persistent beaconing behavior over at least 3 days.
BlueNoroff ClickFix - Traffic to Known-Malicious Watchlist IP
This rule detects potential command and control (C2) beaconing activity associated with the AdaptixC2 framework. It identifies HTTP requests containing a specific 'X-Beacon-Id' header combined with known C2 URI patterns and a specific User-Agent string commonly observed in AdaptixC2 traffic.
Detects network traffic consistent with the SleeperGem loader communicating with a Forgejo instance hosted on git.disroot.org. The detection looks for GET requests containing specific path patterns (e.g., '/git-ecosystem/', '/raw/branch/main/') and file extensions (deploy.sh or git-credential-manager), along with a 'Git' user-agent, which is characteristic of the loader's C2 retrieval activity.
Detects DNS queries matching known malicious infrastructure domains identified in SourTrade malvertising campaigns. These domains are often used by threat actors to host malicious payloads or C2 infrastructure.
Detects network indicators related to the BlueNoroff ClickFix Kit, specifically targeting malicious TURN relay domains (edensun.xyz) used for WebRTC-based webcam exfiltration and Command and Control (C2) traffic involving Socket.IO signals that trigger malicious UI modals.
This rule detects the initial WebSocket handshake request used by the INTERLOCK NodeSnake RAT for beaconing. It looks for a GET request containing a 'Sec-WebSocket-Key' header and a specific URI pattern (?v=n;) common to the RAT's communication profile.
Detects an HTTP GET request to the Microsoft Graph API (/v1.0/users/*/calendarView) containing a specific hardcoded far-future date (2050-05-13) in the startDateTime parameter. This pattern is indicative of a command-and-control (C2) mechanism leveraging a legitimate cloud service to maintain persistent communication channels.
Page 101 of 190