Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects HTTP traffic containing a specific session cookie pattern characteristic of PowerShell Empire C2 agent communication, utilizing regex to identify base64-encoded session identifiers.
Detects outbound HTTP POST requests to external networks that match a known Emotet C2 traffic pattern. The rule specifically looks for HTTP POST requests using an 'application/x-www-form-urlencoded' Content-Type and a URI structure consisting of randomized alphanumeric segments (4-20 characters long). This structure is characteristic of Emotet's communication with its command-and-control infrastructure.
Detects the use of the HTTP CONNECT method on non-standard ports (8888, 9999, 4444). The CONNECT method is frequently used by HTTP proxies to establish TCP tunnels; unauthorized use of this method on uncommon ports is a common indicator of protocol tunneling used to bypass network egress filtering or for command and control (C2) communication.
Detects HTTP beaconing activity indicative of Cobalt Strike Malleable C2 communication. The rule monitors for specific URI patterns ('/updates', '/pixel', '/submit.php') in combination with a default User-Agent string commonly used by Cobalt Strike malleable profiles.
Detects outbound HTTPS traffic on high ports where the TLS SNI header consists of a 8-20 character random alphanumeric string. This pattern is indicative of default configurations for Metasploit Meterpreter Reverse HTTPS payloads attempting to establish a Command and Control connection.
Detects HTTP beaconing activity to a /submit.php URI with a default Cobalt Strike User-Agent string. This is indicative of a default or poorly customized Cobalt Strike malleable C2 profile being used for command and control communication.
Detects outbound HTTPS traffic containing TLS certificates with common names associated with known command-and-control (C2) frameworks like Metasploit and Empire. These frameworks often use self-signed certificates with default or easily identifiable issuer names when establishing C2 communication.
Detects HTTP POST requests characteristic of QakBot command-and-control check-ins. The rule looks for an 'established' flow to an external network using a POST method, with a request body containing 'qbot' followed by a version string pattern, which is indicative of the malware reporting system info to its C2 server.
Detects network connections resolving to specific domains or UUID-based API endpoints used by Lorem Ipsum's primary C2 cluster following the late-May ClickFix pivot. This rule identifies known command and control (C2) infrastructure by matching specific domain names and a UUID-based API endpoint pattern in network connection URLs.
Detects suspected malicious activity associated with the Dropping Elephant threat group. The rule monitors for two behaviors: 1) IP address geolocation fingerprinting by identifying non-browser processes communicating with ipify.org and ip2c.org within a 60-second window, and 2) Direct network connections to known Dropping Elephant C2 domains, specifically gcl-power.org and chinagreenenergy.org.
Detects outbound network traffic established by a client using the default self-signed TLS certificate generated by Metasploit for Meterpreter Reverse HTTPS sessions. The rule looks for the common default subject fields 'CN=metasploit' and 'O=msf' within the TLS handshake.
Detects network activity initiated by PowerShell or PWSH processes connecting to a known GIFTEDCROOK C2 IP address or utilizing high non-standard ports (>=8000) for outbound communication. This rule monitors for potential beaconing or command and control activity originating from non-Microsoft signed processes in public network ranges.
Detects command and control (C2) activity attributed to threat actor UAC-0226 by monitoring for direct network connections to known hardcoded C2 IP addresses from suspicious process paths or PowerShell, and by identifying beaconing patterns (regular HTTPS intervals) originating from non-browser processes in sensitive locations like ProgramData or AppData/Local/Temp.
This rule detects a sequence of behaviors indicative of credential theft followed by data staging and exfiltration. It identifies processes accessing sensitive browser credentials or KeePass database files, followed by the creation of a ZIP archive within user profile directories, and concludes with an outbound HTTPS connection to a non-trusted, non-Microsoft external destination by the same process.
Detects outbound WebSocket connections from endpoints to known infrastructure associated with the Turla group's STOCKSTAY malware. The rule monitors DeviceNetworkEvents for successful connections or attempts to specific domains (glitch.me, onrender.com, theworkpc.com) or connections containing WebSocket-related headers in the metadata, which indicate C2 activity.
Detects network traffic associated with the EvilTokens phishing kit's 'killed' gate check mechanism. The kit GETs /api/device/gate/<PAGE_ID> with the ngrok-skip-browser-warning header. When the backend returns a killed flag, the phishing page wipes the DOM and renders a fake 'Page Not Found - Microsoft' error to evade analysis or block specific victims.
This rule detects unauthorized modifications to Firefox registry keys related to the 'SmartWindow' AI feature, specifically identifying instances where the feature is silently enabled without user consent or where the SmartWindow endpoint and API key configurations are redirected to non-standard, potentially malicious URLs. It also monitors for Firefox process executions involving SmartWindow-related arguments, which may indicate exploitation of this browser-based feature.
This rule detects multiple attempts (10 or more within an hour) from a single IP address to access administrative interfaces on a web server. It specifically looks for URI queries containing keywords like 'admin', 'wp-admin', or 'administrator' in W3CIISLog data. Such activity often indicates a brute-force attack or scanning for administrative login pages.
Detects an unusually high volume (100 or more within an hour) of API calls (POST, DELETE, PUT methods to URIs containing 'api') originating from a single IP address. This activity could indicate various malicious behaviors such as brute-force attacks, credential stuffing, web application attacks, or a denial-of-service attempt against the API endpoint.
Detects network activity associated with the EKZ Stealer malware, specifically an HTTP POST request used to exfiltrate base64-encoded credentials to a known malicious destination at 83.138.53.110/service/save.php.
This rule detects network connections to known IP addresses associated with FortiBleed activity, categorizing them by their suspected role (e.g., C2, pentest lab, credential validation, sniffer node). It monitors both successful connections and connection attempts.
Page 114 of 190