Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
These YARA rules detect indicators of compromise (IOCs) associated with a campaign where malicious actors compromised developer accounts to distribute malicious Google Chrome extensions. The rules search for a specific set of C2 IP addresses, domains, extension names, and unique extension IDs known to be part of this supply chain attack.
This rule detects node.js processes that either attempt to read sensitive cloud credential or configuration files (AWS, Google Cloud, Azure) or establish network connections to a specific remote IP address (85.137.53.71) on ports 8080 or 8081. This behavior is indicative of credential theft or potential command and control (C2) activity from a compromised node environment.
Detects established TLS traffic over WebSockets where the certificate subject field lacks a common name (CN), often indicative of non-standard, self-signed, or improperly generated TLS certificates used by command-and-control (C2) agents to bypass standard certificate validation or hide within encrypted channels.
This rule monitors network HTTP header traffic for specific strings commonly associated with social engineering, scamming, or phishing campaigns, such as '4.8-star' ratings or 'over 2 million users' claims, which are often used to deceive users into interacting with malicious content.
Detects outbound network traffic from internal hosts to known IP addresses associated with AnyDesk relay infrastructure, which may indicate unauthorized use of remote access tools.
Detects HTTP traffic identified as MarkiRAT command and control beaconing, characterized by a specific multipart POST request structure directed at a known malicious URI and domain.
Detects HTTP POST requests directed at a '/save.php' URI, a common signature associated with the Kratos phishing kit used for capturing and exfiltrating user credentials.
This rule identifies network traffic containing specific strings associated with known malicious command-and-control (C2) behavior, such as hardcoded PHP script names often used by web shells, connection attempts to Telegram API servers for exfiltration, and other identifiable strings often associated with threat actor interaction.
This rule detects potential automated bot, crawler, or scraper activity by identifying network requests that contain suspicious strings in the URI (e.g., 'captcha') or User-Agent header (e.g., 'bot', 'crawler', 'spider'). The rule aggregates events by DNS query and remote IP, flagging entities that exhibit high-frequency requests across multiple unique User-Agents, which is a common behavior of sophisticated web scrapers or automated scanning tools attempting to bypass simple detection.
Detects known malicious indicators, including C2 domain connections, suspicious file hashes, and specific mutexes often associated with malware execution.
This rule detects unauthorized or suspicious access attempts to a MinIO storage service by monitoring network traffic for default credentials, specific API calls like 'ListBuckets', or access to sensitive paths like 'terraform-state'. It triggers when traffic either targets the 'minio.internal' hostname or the local loopback address on port 9000, specifically looking for common MinIO administrative indicators.
Detects unauthorized access to sensitive credential files, such as credentials.json or .env, through HTTP GET requests, or the creation/staging of a credentials file at /tmp/creds.json, which may indicate attempts to exfiltrate or steal credentials from the local system.
day0 ToxicEyeRAT
YARA
These YARA rules detect the ToxicEye Remote Access Trojan (RAT), a malicious tool written in C# that leverages the Telegram Bot API for command and control. The rules identify specific hardcoded configuration settings (Telegram bot tokens, addresses for crypto wallets, persistence settings, and file grabber configurations), unique project strings (author attribution, warning messages), and debug logs associated with the malware's functional modules such as keylogging, credential stealing, file exfiltration, and system destructive capabilities like boot sector overwriting.
KQL Query from file: The Hunt for QR Phisher
Detects HTTP POST requests directed to the 'avenger-sync.live' domain by the PamStealer malware. The rule identifies specific C2 or exfiltration traffic patterns, including the '/api/sync' URI and a specific JSON-formatted data envelope in the request body, commonly used by the malware for communication.
Detects outbound network traffic consistent with CrySome RAT Command and Control (C2) communication, including direct connections to a known hardcoded IP address on port 5555 and the observation of the '##CRYCFG##' configuration marker within the TCP stream.
Detects DNS requests or network connections to the typosquatted domain and hardcoded IP associated with the DAEMON Tools supply chain attack, as well as additional network relations tied to the installer.
Detects instances where 'db.dll' is loaded by a process, followed closely by outbound network activity from processes typically associated with disk analysis tools like WinDirStat or suspected DLL hijacking patterns using uxtheme.dll. This behavior often suggests the presence of a malicious payload or credential harvesting module being used to interact with remote databases.
This Suricata rule detects potential exfiltration of stolen data by the StealC or Amadey malware families. It specifically looks for an HTTP POST request to a .php URI containing a 'PK' header (the magic bytes for a ZIP file), suggesting the transmission of compressed stolen logs to a C2 server.
Detects established TLS connections to external networks where the server certificate subject contains a Common Name (CN) but lacks Organization (O) or Organizational Unit (OU) fields. This pattern is characteristic of basic, potentially malicious self-signed certificates used by command-and-control (C2) frameworks to mask communication.
Detects network communication with the Telegram API (api.telegram.org) originating from processes located in suspicious, user-writable directories such as Downloads, Temp, or AppData. This behavior is indicative of potential command and control (C2) communication or data exfiltration via the Telegram Bot API by malware.
Page 105 of 190