Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule detects PowerShell activity where commands are used to perform reconnaissance (e.g., whoami, ipconfig, or network group enumeration) and the output is exfiltrated or sent via a POST request to a specific external IP address (202.182.102.5).
Detects malicious behavior attributed to the Miasma/TonRAT malware, specifically targeting node.js or bun.exe runtime environments. The rule identifies suspicious network connections to command and control (C2) domains, access to sensitive developer credential files (e.g., .npmrc, .aws/credentials), execution of identified credential-harvesting functions in process command lines, and the execution of specific suspicious preinstall scripts.
Detects network activity associated with Gamaredon threat group backdoors (PteroVDoor and PteroPSDoor) exfiltrating data to S3-compatible cloud storage providers. The rule identifies suspicious outbound network requests to specific domains ('wasabisys.com', 'i3storage.com') originating from processes that are not common browsers or trusted software, or by command-line execution of PowerShell, curl, or wget.
Detects the Amazon Q Developer language server or extension host spawning suspicious child processes (bash, sh, zsh, python, node) that execute commands involving AWS STS identity retrieval, external data exfiltration via network tools like curl/wget, or direct references to AWS credential environment variables. This pattern is indicative of potential Remote Code Execution (RCE) via malicious Model Context Protocol (MCP) auto-execution.
Malvertising loader delivering CastleStealer via malicious Google Ads
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
Lumma C2Beacon
YARA
Infostealer-as-a-service targeting browser credentials and crypto wallets
Latin American banking trojan using DLL side-loading and overlay attacks
Detects unexpected child processes (e.g., shell, Python, network utilities) spawned from vLLM or Python worker processes, or suspicious file/network activity related to vLLM/Python processes. This rule aims to identify potential exploitation of CVE-2026-22778, an FFmpeg JPEG2000 heap overflow vulnerability, which could lead to arbitrary code execution within AI/ML environments.
Dridex C2Beacon
YARA
Banking trojan and loader using malicious Office macro delivery
Form-grabbing and credential stealing malware-as-a-service
Form-grabbing and credential stealing malware-as-a-service
Credential and browser data stealer distributed via OXLOADER campaigns
Loader malware delivering follow-on ransomware payloads
Credential and browser data stealer distributed via OXLOADER campaigns
Detects DNS resolutions for major AI/LLM provider domains (e.g., OpenAI, Anthropic, Google AI) originating from processes that are not common, known browsers or development tools. This behavior is indicative of potentially malicious applications or malware using AI APIs for automated tasks, such as content exfiltration or sophisticated C2 communication.
This rule detects the execution of known Vidar or SnappyClient loader processes (NeuroManag.exe or VirtualAr.exe) followed by repeated network connections to specific C2 infrastructure IP addresses or common dead-drop resolver services such as Telegram, Steam, or specific attacker-controlled domains. The rule identifies suspicious beaconing behavior following the process launch, indicating active command and control communication.
This rule detects processes executing from commonly abused, high-write temporary or user-specific directories (AppData, Temp, ProgramData) that simultaneously initiate network connections to external IP addresses over HTTP/HTTPS ports (80/443). This pattern is frequently indicative of initial stage malware, downloader behavior, or command and control communication originating from non-standard execution paths.
This rule detects processes running from common user-writable directories (AppData, Temp, ProgramData, etc.) that concurrently establish outbound network connections to non-private (non-RFC1918) IP addresses. It explicitly excludes common browsers, accessibility tools, and known Windows system or product-related paths to reduce noise.
Detects network activity and DNS queries associated with known TA4922 command-and-control infrastructure, including specific domains and IP addresses. It also employs behavioral analysis to identify beaconing patterns from processes that are not identified as standard web browsers or authorized system/application utilities.
Detects DNS resolution attempts or direct network connections to the domain 'vtps.us', which is associated with TA4922 command and control (C2) infrastructure.
Page 123 of 190