Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects anomalous HTTP GET requests to the Microsoft Teams trap-exp/tokens endpoint that do not carry the expected 'Teams' user-agent string. This pattern is indicative of the DragonForce backdoor attempting to illicitly request Skype authentication tokens.
Detects anomalous HTTP GET requests to the Microsoft Teams trap-exp/tokens endpoint that do not carry the expected 'Teams' user-agent string. This pattern is indicative of the DragonForce backdoor attempting to illicitly request Skype authentication tokens.
Detects anomalous HTTP GET requests to the Microsoft Teams trap-exp/tokens endpoint that do not carry the expected 'Teams' user-agent string. This pattern is indicative of the DragonForce backdoor attempting to illicitly request Skype authentication tokens.
This rule monitors for known malicious file hashes, command and control (C2) domains, and specific download URLs associated with identified threats. It correlates these indicators across process execution, file activity, and network connection logs to identify potential compromises or malicious activity related to the aware-cr1 infrastructure.
Detects outbound HTTP POST requests destined for 'aware-cr1.com' targeting the URI '/api/beacon', which is indicative of command-and-control (C2) communication associated with the 2CLoader malware.
Detects a sequential pattern where a browser process (Chrome, Edge, or Safari) accesses an AI chat platform's conversation API, followed within 5 minutes by a network connection to a known unauthorized exfiltration destination (api.pbapi.xyz). This pattern suggests the potential use of a browser-based tool or extension (e.g., Poper Blocker or similar) to intercept and exfiltrate AI chat history.
This rule performs a point-in-time sweep for known Indicators of Compromise (IOCs) associated with the NeedyMantis threat actor group. The detection logic searches for specific file, process, and image-load SHA256 hashes, communication with a known C2 domain (tripswithengine.com), and the use of a hard-coded user-agent string (Firefox/21.0) across various telemetry sources within the last 30 days.
This rule monitors for indicators of compromise (IOCs) associated with the Lunex Malware-as-a-Service (MaaS) campaign. It aggregates telemetry from file creation, process execution, and network connections to identify the presence of known malicious hashes, C2 IP addresses, phishing-related domains, and specific payload URLs.
Detects periodic, beacon-like network activity targeting public platforms such as Steam community profiles or Telegram (api.telegram.org / t.me) originating from suspicious processes (script interpreters, unsigned binaries). This behavior is characteristic of LummaC2 and similar malware families using public web services as dead-drop resolvers for C2 fallback communication.
This rule detects network connections initiated by unsigned executables that were recently created (within one hour) in common staging directories such as AppData, Temp, or ProgramData. It specifically targets beacons to the Telegram Bot API or Discord webhooks, which are common patterns for command-and-control (C2) communication used by malware such as the Amadey bot.
Detects HTTP POST requests to Telegram Bot API and Discord webhooks containing large, Base64-encoded strings within request bodies, which may indicate exfiltration of reconnaissance data or sensitive information.
Detects network requests to the domain 'cloud-ack.workers.dev', which is known to be used as a redirector for hosting Microsoft authentication lookalike pages to conduct phishing attacks.
This rule detects potential command and control (C2) beaconing activity where specific suspicious API endpoints (/api/v1/ping.php and /api/v1/connect.php) are accessed by common system processes (msedge_proxy.exe or WindowsUpdate.exe). The logic clusters these network requests by device and process, triggering an alert when both endpoints are observed from the same process on a single device, a common indicator of a C2 communication pattern.
This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of unwanted applications. This activity can signify possible compromised hosts on the network.
Detects suspicious activity associated with Cobalt Strike Beacon communication, specifically monitoring for known default named pipes and specific user-agent strings commonly used by Cobalt Strike in HTTP/S traffic.
Detects indicators of Cobalt Strike activity, including the creation of default named pipes, process injection into common LOLBins without legitimate parent processes, and network communication patterns consistent with Cobalt Strike malleable C2 profiles.
This rule detects HTTP GET requests initiated by the Windows PowerShell User-Agent where the destination host is a decimal-encoded IP address. This pattern is commonly associated with ClickFix-style social engineering attacks, where users are tricked into executing obfuscated PowerShell commands to download malicious payloads.
Detects network traffic destined for api.telegram.org that follows the specific URL structure pattern associated with the CARBONATO Hermes Agent bot command-and-control channel.
Detects HTTP traffic where the Host header contains a decimal-encoded IP address, which is a technique often used in stager evasion and obfuscation (notably associated with 'ClickFix' or similar browser-based malvertising campaigns) to bypass domain-based filtering or reputation systems.
Detects unauthorized exfiltration of sensitive information, such as camera credentials or location data, directed to the Telegram Bot API as part of the 'Operation CameraSwarm' campaign.
Detects HTTP POST requests originating from the internal network directed at a known suspicious C2 infrastructure IP address (156.227.0.13), indicating potential C2 check-in activity associated with AdaptixC2 malware.
Page 11 of 190