Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule detects network traffic patterns associated with BlueNoroff ClickFix C2 communications. It specifically identifies GET requests to endpoints containing an 'ft?id=' parameter followed by a base64-encoded string, which indicates the delivery of encrypted tasking parameters to an infected system.
Detects network activity associated with BlueNoroff ClickFix campaigns, specifically targeting the download of suspicious Windows PE files from typosquatted CDN/payload URIs. The rule uses session tracking to correlate the initial URI request with the subsequent retrieval of executable content.
Detects instances where the Microsoft Installer process (msiexec.exe) initiates a network connection to the local IPv4 loopback address (127.0.0.1). This behavior may indicate an MSI custom-action payload attempting to interact with a web browser through the Chrome DevTools Protocol (CDP) to establish a covert command-and-control channel.
A non-browser process pivoting through the browser's CDP loopback debug port, so the RAT's own traffic never leaves 127.0.0.1. Tightened to exclude known developer tooling and browser automation frameworks (VS Code debugger, Chrome DevTools frontend, Selenium/Puppeteer/Playwright drivers) that legitimately attach to the local CDP debug port.
Detects network activity associated with the TELEPUZ malware communicating with public Polygon blockchain RPC nodes. The malware interacts with a specific smart contract (0xf55Bea1FdCf1c3ABb39ab92567C09aC1BFf6753E) to resolve its AES-encrypted Command and Control (C2) server address.
Detects communication between suspicious processes (rundll32.exe, svchost.exe, dllhost.exe, install.exe) and the Steam Community website, specifically targeting a known TELEPUZ malware dead-drop profile ID used to resolve XOR-encoded C2 addresses.
This rule detects outbound HTTP requests using the WebDAV protocol that target specific directory paths associated with the Stealth Falcon campaign staging activity. Such traffic may indicate a compromised host attempting to download tools or payloads from an adversary-controlled infrastructure.
Detects the creation of specific RabbitMQ AMQP exchanges and bindings often associated with C2 communication patterns, such as the use of 'fanout' or 'topic' exchange types paired with common internal naming conventions or payload keywords.
Detects anomalous Redis network traffic containing structures associated with GigaWiper, specifically monitoring for 'cmd.Result' fields used by the malware to exfiltrate command output from compromised systems to a C2 server.
Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.
Detects Microsoft 365 Outlook calendar events with highly anomalous future dates (specifically the year 2050) or specific subject patterns, which are indicative of a command-and-control (C2) communication channel established via calendar item properties.
Detects network communication associated with the Blind Eagle (APT-C-36) threat actor's use of AsyncRAT. This rule identifies DNS queries for a specific DuckDNS domain, matching TLS SNI for the same domain, and network connections to a known historic C2 IP address historically used via a shared VPN egress.
This query detects non-browser processes making network connections to .shop or .xyz domains which could possibly pertain to phishing, malware delivery, tracking, ad fraud, or command-and-control.
Detects endpoint activity indicative of the TELEPUZ malware interacting with the Telegram API to resolve its fallback Command and Control (C2) server. The rule monitors for DNS queries, network connections, and security log entries related to the specific channel 'chanadarkpart' and common Telegram API endpoints used for retrieving message data or user profiles.
Detects various stages of the Armored Likho APT campaign using the BusySnake stealer, including lure archive delivery, NSIS droppers, LNK shortcut abuse, PowerShell-based staging, VBScript persistence, scheduled task creation, reverse SSH tunneling, and exfiltration of browser and communication artifacts.
Detects DNS queries for the Twilio TURN relay domain 'global.turn.twilio.com', which is associated with msaRAT C2 activity. This indicator is low-confidence and intended to be used as part of a correlation with other behaviors like loopback C2 traffic or suspicious DevTools usage.
A non-browser process pivoting through the browser's CDP loopback debug port, so the RAT's own traffic never leaves 127.0.0.1. Tightened to exclude known developer tooling and browser automation frameworks (VS Code debugger, Chrome DevTools frontend, Selenium/Puppeteer/Playwright drivers) that legitimately attach to the local CDP debug port.
Detects outbound network connections to hard-coded IP addresses associated with GigaWiper malware C2 infrastructure on specific ports, which may indicate active backdoor communication.
Detects outbound network connections to hard-coded IP addresses associated with GigaWiper malware C2 infrastructure on specific ports, which may indicate active backdoor communication.
Detects outbound HTTP POST requests containing JSON-RPC 'eth_call' methods, which are indicative of EtherHiding activity where blockchain infrastructure is abused for command and control or data retrieval.
Detects outbound network connections to hard-coded IP addresses associated with GigaWiper malware C2 infrastructure on specific ports, which may indicate active backdoor communication.
Page 103 of 190