Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule detects network traffic originating from internal hosts to external destinations consistent with default Cobalt Strike HTTP Beacon communication patterns. It specifically looks for GET requests containing URI paths commonly associated with default Cobalt Strike profiles (ca, submit.php, updates.rss) combined with a specific, hardcoded User-Agent string associated with Cobalt Strike's default configuration.
Detects the transmission of a Metasploit Meterpreter stage over HTTP, identified by an application/octet-stream response containing the DOS MZ header signature.
This rule detects outgoing HTTP POST requests containing patterns commonly associated with Emotet command-and-control (C2) communication, specifically identifying the use of an application/octet-stream content type combined with a specific, randomized URI path structure consisting of alphanumeric segments.
Detects network traffic consistent with the default Cobalt Strike Malleable C2 jQuery profile. The rule monitors for GET requests to the URI '/jquery-3.3.1.min.js' accompanied by a specific 'Accept' HTTP header, which is a known indicator of default Cobalt Strike beacon activity.
This rule detects potential command and control (C2) activity related to the Qakbot malware. It specifically monitors for established outbound TLS traffic over non-standard ports (ports other than 443) where the Server Name Indication (SNI) field contains a numeric IPv4 address instead of a domain name, which is a characteristic behavior of Qakbot C2 infrastructure.
Detects outbound network connections from endpoint processes to domains associated with a malicious browser extension. The extension is known to fetch scriptlets that enable main-world JavaScript injection and potential credential theft (e.g., document.cookie).
Detects network traffic consistent with the default configuration of a Cobalt Strike Malleable C2 Beacon. The rule identifies HTTP GET requests to a '/updates' URI path, accompanied by the specific default User-Agent string 'Mozilla/4.0 (compatible; MSIE 6.0)', which is commonly observed in uncustomized Cobalt Strike deployments.
Detects HTTP GET requests originating from internal network hosts to external destinations that match known Emotet C2 communication patterns, specifically those using hardcoded URI paths such as '/wp-content/', '/wp-admin/', or '/tmp/' combined with the 'Accept-Encoding: identity' header.
Detects outbound HTTP POST requests characteristic of QakBot malware command and control (C2) activity. The rule identifies a specific combination of a hardcoded User-Agent string ('Trident/7.0') and a URI pattern consisting of 4 to 32 alphanumeric characters ending in .php.
Detects large HTTP POST requests (over 5MB) directed at external hosts that utilize multipart or chunked encoding, which are commonly used to obfuscate or stream large volumes of data during an exfiltration event.
Detects outbound HTTP POST requests to suspicious URIs and subsequent inbound responses containing executable binary (PE) signatures, characteristic of Emotet malware command-and-control (C2) activity.
This rule monitors for HTTP POST requests to external networks containing 'gtag=' in the URI, which is a known technique used by the TrickBot malware to exfiltrate its group identifier during C2 communication.
Detects endpoint devices navigating through a sequence of two or more distinct cloud-native redirector platforms (specifically Azure Websites, Cloudflare Pages, and AWS S3 buckets) within a 5-minute window, followed by a connection to a non-cloud final destination. This behavior is highly characteristic of adversaries utilizing Traffic Direction Systems (TDS) or Bulletproof Redirect Engines to obfuscate malicious payloads and evade network security controls.
Detects network traffic consistent with the default Cobalt Strike Malleable C2 jQuery profile. The rule monitors for GET requests to the URI '/jquery-3.3.1.min.js' accompanied by a specific 'Accept' HTTP header, which is a known indicator of default Cobalt Strike beacon activity.
Detects HTTP POST requests characteristic of Emotet Epoch 4 and 5 C2 communication. The rule monitors for specific URI patterns, the presence of a 'Cookie' header, and a base64-encoded request body exceeding 80 characters, which are indicative of Emotet malware beaconing activity.
Detects HTTP traffic containing a specific session cookie pattern characteristic of PowerShell Empire C2 agent communication, utilizing regex to identify base64-encoded session identifiers.
Detects network outbound connections to known CDN domains over port 8084. This activity is often associated with the use of specific C2 frameworks (e.g., SNOWLIGHT or VSHELL) that leverage legitimate cloud infrastructure to blend malicious traffic within common CDN communication patterns.
Detects network traffic associated with TrymeLocker malware, specifically targeting Telegram API communications containing hardcoded identifiers and geolocation lookups via ipinfo.io.
Detects unauthorized inbound WebSocket connections from external (non-private) IP addresses to the AutoGen Studio MCP API endpoint at /api/mcp/ws/ on port 8081, followed by the execution of interpreter processes (autogenstudio, uvicorn, or python) on the same host, indicating a potential exploitation of an origin validation bypass for remote code execution.
This rule detects potential command and control (C2) activity associated with the SNOWLIGHT framework by identifying outbound WebSocket connections over HTTP to a specific known C2 IP (38.60.253.35) and port (8084). It correlates network flow logs (CommonSecurityLog) containing specific HTTP URL parameters (a=w64, t=ws_, p=8084) with EDR process network events (DeviceNetworkEvents) where the Windows Update Service process (wusvc.exe) is the initiator, indicating potential process masquerading or injection.
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including C2, pentest lab, credential validation, and sniffer nodes. Monitoring these connections can help identify compromised systems communicating with FortiBleed infrastructure.
Page 126 of 190