Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects network traffic associated with Cavern Manticore command-and-control communication. The rule identifies a specific HTTP request pattern characterized by a static User-Agent string resembling a Chrome/Edge browser on Windows and the inclusion of a specific 'X-User-token' header in the HTTP request.
Detects periodic, low-variance network beaconing behavior indicative of the SnappyClient RAT, specifically monitoring for simultaneous connections to control (port 3333) and data (port 3334) ports. The detection utilizes statistical analysis of inter-arrival times (low coefficient of variation) and restricts alerts to rare destination IP addresses contacted by a limited number of internal hosts.
This rule detects potentially malicious network traffic that suggests command and control or data exfiltration. It identifies connections using non-standard ports (above 1024, excluding common ports) or abnormally long DNS queries, often associated with DNS tunneling. The rule aggregates these events by host and destination to identify persistent or high-volume patterns indicative of covert channels.
Detects execution of processes associated with the CrySome Remote Access Trojan (RAT), identified by known binary names ('patch_diag.exe', 'patch.exe') or file hash. Additionally, it monitors for outbound network connections to a specific, hardcoded C2 IP address (193.26.115.42) on port 5555, which is associated with CrySome RAT's hVNC-enabled client.
Detects HTTP GET requests to the URI '/beacon' destined for a known JadePuffer command-and-control server IP address (45.131.66.106) on port 4444. This signature identifies potential beaconing activity, which is a common communication pattern for malware implants communicating with an adversary-controlled server.
Detects the execution of Python processes via the command line that include both the '-c' flag for executing inline code and specific code patterns related to network data retrieval ('urllib.request.urlopen') or decoding obfuscated data ('base64.b64decode'). This behavior is commonly used by adversaries to download and execute secondary payloads or handle C2 communication.
Detects anomalous PowerShell activity associated with the EKZ Stealer, characterized by a multi-stage chain involving file download, hidden process execution, temporary file staging, base64 encoding, and exfiltration via HTTP POST requests, followed by cleanup of logs.
This rule detects a multi-stage attack pattern involving the execution of PowerShell via explorer.exe, followed by subsequent sub-process activity that attempts to access sensitive browser-stored credentials (Login Data or Cookies) or specific cryptocurrency wallet data, combined with a concurrent network connection attempt, indicative of credential exfiltration via a command-and-control (C2) beacon.
[IOC based] Surfaces every macOS host that contacts api.ipify.org or ipinfo.io/json. These are MiniRAT's exfiltration endpoints but are also used by many legitimate tools.
Detects recurring connection patterns characteristic of the SnappyClient RAT, specifically monitoring for heartbeat-like beaconing at regular intervals on ports 3333/tcp and 3334/tcp. The rule correlates traffic across both ports from the same device to the same destination to identify potential command-and-control communication.
Detects HTTP GET requests to signindat.com for suspected malicious payloads, including executables (.exe) and scripts (.ps1), as well as a decoy PDF document. The rule identifies communication with an external host using generic User-Agent strings, characteristic of the CrySome RAT multi-stage download process.
This rule detects a suspicious pattern involving mass HTTP scraping behavior (high frequency of requests to numerous distinct remote IP addresses) occurring on the same host, correlated with the creation of multiple new user accounts (Windows Event ID 4720) within the same 30-minute time window. This behavior is indicative of a compromised host being used for automated reconnaissance or data collection alongside persistence mechanism establishment.
Detects potential exfiltration activity involving PowerShell scripts interacting with a specific remote IP address, using System.Net.WebClient to upload file contents, and referencing a common local staging file (C:\ProgramData\log.txt).
Detects HTTP traffic containing a User-Agent string associated with the NetSupport Manager remote access tool. This activity is indicative of the tool being used for unauthorized remote access or as a C2 channel, often seen in the context of the ClickFix campaign.
Detects authentication and Office activity where User-Agent strings match known malicious, reconnaissance, scanning, or C2 tool fingerprints. Helps identify automated attacks, credential stuffing, and adversary tooling.
This rule detects potentially unauthorized or suspicious WebSocket connections established over TCP port 1313. It specifically looks for Socket.IO traffic utilizing the 'EIO=4' protocol version and 'websocket' transport, while explicitly checking for the absence of Authorization headers and Sec-WebSocket-Protocol headers. The pattern matching on the raw payload suggests identification of initial handshake or messaging sequences (e.g., '0{' or '40') indicative of unauthenticated interaction with a WebSocket service.
Detects outbound network communication to ports 80 or 443 that lacks standard application-layer protocol signatures (HTTP/HTTPS/TLS). This behavior is characteristic of the Gh0stRAT malware, which uses a non-standard zlib-compressed protocol with a specific 'Gh0st' header, commonly observed in TA4922 operations.
Detects outbound HTTP POST requests to a /gallery URI endpoint, which is associated with Cavern Manticore C2 beacons. The detection logic inspects the HTTP request body for a specific Base64-encoded pattern following XOR 0x48 encoding, indicating potential command-and-control communication.
Detects network proxy requests from Go-based HTTP clients targeting Dropbox and gofile.io, which are common indicators of VILE ransomware communication or data exfiltration activities.
Detects the second-stage Rust-based Mach-O binary downloaded and executed by the PamStealer JXA stager, identified via embedded C2 domain strings
This rule identifies network connections over port 1313 that initiate a Socket.io WebSocket upgrade request. The detection checks for the presence of the '/socket.io/' URI path, the 'EIO=4' protocol version parameter, and the 'transport=websocket' requirement, which are characteristic of Socket.io communication. This can be used to monitor for potentially unauthorized C2 channels or application-specific tunneling.
Page 106 of 190