Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects HTTP traffic patterns characteristic of Emotet malware command and control (C2) beaconing, specifically looking for POST requests with random alphanumeric URIs (4-16 characters) and a specific Accept-Encoding header (gzip, deflate).
Detects network traffic consistent with the default configuration of a Cobalt Strike Malleable C2 Beacon. The rule identifies HTTP GET requests to a '/updates' URI path, accompanied by the specific default User-Agent string 'Mozilla/4.0 (compatible; MSIE 6.0)', which is commonly observed in uncustomized Cobalt Strike deployments.
Detects continuous command and control (C2) beaconing activity from Remote Monitoring and Management (RMM) tools over non-standard high ports. This rule identifies RMM processes (rmm, agent, client*.exe) establishing frequent network connections to remote IPs on ports greater than 1024, excluding common ports like 3389 (RDP), 8080, and 8443, indicating potential malicious use of RMM software for C2.
Detects network activity (DNS queries, TLS SNI, and HTTP requests) directed towards known attacker-controlled command-and-control domains associated with AsyncRAT and ScreenConnect abuse.
Detects network connection activity on common C2 ports from processes executing outside of standard system directories. The rule filters out known system paths on macOS and identifies processes that establish multiple connections to non-private IP addresses, assigning a risk score based on the volume of connections and the duration of the activity to identify potential command and control (C2) beaconing behavior.
Detects network connections to known Telegram or Steam community profile pages used by the Vidar information stealer as dead-drop resolvers to retrieve secondary C2 infrastructure. The rule specifically filters for non-browser processes to reduce noise from legitimate user traffic.
Detects high-volume, potentially automated enumeration of Microsoft Graph API endpoints targeting sensitive personnel data (payroll, HR, finance). This rule identifies requests using non-standard or suspicious user agents—such as curl, python-requests, or common web client patterns—when interacting with user and group directories in the Microsoft 365 environment, characteristic of the 'Payroll Pirate' (Storm-2755/Storm-2657) campaign patterns.
This rule detects potential command and control (C2) activity associated with a known npm RAT, identified by network connections to specific C2 infrastructure (95.216.92.207:8080) or DNS resolution of 'nvidiadriver.net'. The rule specifically flags these events when performed by common execution tools like 'python.exe' or 'chost.exe', or when the process image is running from a temporary directory, which is a common persistence or execution indicator for malware.
This rule detects the installation of a new Microsoft Edge extension followed by suspicious network activity from the msedge.exe process within 24 hours. The suspicious activity includes the fetching of common steganography-friendly file types (e.g., .png, .webp, .woff2, .conf) from known StegoAd C2 domains. This behavior is indicative of a malicious extension retrieving payloads hidden in legitimate-looking media files or beaconing to attacker infrastructure.
Detects unauthorized or suspicious processes reading sensitive credential files (AWS, .env, etc.) and subsequently initiating a successful network connection to an external destination within a 5-minute window. This behavior is a common indicator of credential exfiltration.
This rule detects outbound HTTP requests to Bing's 'searchbyimage' functionality that contain an image URL pointing to a domain outside of Microsoft or Bing. This behavior is associated with a potential data exfiltration technique (referenced as CVE-2026-42824) where internal information is encoded into an image URL and passed to an external, attacker-controlled, or third-party web service via the Bing search engine to bypass traditional network egress controls.
Detects the execution of 'aws sts get-caller-identity' combined with 'curl' operations utilizing stdin data piping, often associated with unauthorized identity enumeration and data exfiltration in cloud-native environments, particularly when initiated from developer tool contexts like Amazon Q/MCP configurations.
This rule monitors for suspicious activity originating from RMM software (specifically SimpleHelp) and associated TaskWeaver processes, including process execution, service/scheduled task installation, file creation consistent with Djinn Stealer, and non-standard outbound network connections.
Campaign converting compromised FortiGate firewalls into credential stealers
Detects suspicious processes commonly associated with malicious activity establishing outbound network connections to Azure Web Apps domains. The rule aggregates connections to identify potential beaconing behavior by monitoring connection frequency and duration, flagging activity initiated by binaries frequently used for living-off-the-land attacks such as powershell.exe, rundll32.exe, and others.
Detects the deployment and activity of the Remcos Remote Access Trojan (RAT) as part of the BQTLock (BaqiyatLock) attack chain. This rule monitors for process injection into critical Windows processes, malicious Run key persistence entries, non-standard outbound TLS communication from non-browser processes, and the creation of potential keylogging artifacts in the AppData directory.
Detects DNS queries to Gofile infrastructure originating from processes executing from typically transient directories (AppData or Temp). This behavior is characteristic of VILE ransomware, which stages compressed user files in these directories before exfiltrating them via Gofile as part of a double-extortion strategy.
Detects processes running from suspicious, writable directories (Temp, AppData, Downloads) that simultaneously load the .NET Common Language Runtime (clr.dll) and initiate network connections. This behavior is indicative of a downloaded binary or payload executing managed code to perform C2 communication.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
This rule detects network connections to suspicious domains or IP addresses associated with potentially compromised or malicious VPN infrastructure. Specifically, it looks for connections to 'vpn-fortinet.com', 'ivanti-vpn.org', 'forticlient-vpn.de', or the IP address '194.76.226.93'. These indicators may suggest attempts to establish command and control, exfiltrate data, or engage in other malicious activities via compromised VPN services.
This rule detects a high volume of successful network connections to common web ports (80, 443, 8080, 8443) where the remote URL contains keywords like 'version' or 'software'. This pattern could indicate an adversary performing reconnaissance to identify installed software and their versions, potentially looking for vulnerabilities or specific applications to target. The threshold of 10 such activities within an hour for a single device is set to flag anomalous behavior.
Page 110 of 190