Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule monitors for network connections to a specific remote IP (62.171.185.97) associated with suspicious activity. It flags connections involving specific high-risk ports, the use of Wget/1.18 for user agents, or access to the '/pwned' URL path, which are common indicators of automated attack tools or post-exploitation activity.
Detects evidence of potential data exfiltration activities including the execution of known exfiltration scripts, the use of netcat for unauthorized data transfer to a specific C2 IP, and the presence or access of BloodHound dump files. The rule also monitors for network communication with a known command and control IP address.
Detects the deployment and execution of the MeshCentral remote management agent on PeopleSoft servers, which is indicative of unauthorized access by the ShinyHunters threat group. The rule triggers on the execution of the meshctrl.js script using the RunCommand function with suspicious loopback WebSocket connections, or the direct execution of the meshagent binary from within the /opt/meshcentral/ directory.
Detects suspicious processes (e.g., node.exe, chost.exe, python) accessing sensitive credential files and subsequently exfiltrating data to the Telegram Bot API via HTTPS POST requests within a 10-minute window. This behavior is indicative of infostealer malware, such as those observed in the Friday Harvest campaign, harvesting and exfiltrating system data.
Detects network connections from a host to the api.adblock-for-youtube.com domain at the /api/v2/rules endpoint. This behavior is associated with the 'Adblock for YouTube' browser extension (cmedhionkhpnakcndndgjdbohmhepckk) as it retrieves remote JavaScript scriplets for rule updates, which can be a vector for unauthorized code execution if the domain is compromised or used maliciously.
This rule detects network connections or DNS queries originating from an endpoint towards domains or IP addresses associated with BlueKit command-and-control (C2) infrastructure, including TLDs (pk, ws, cc, su) and onion-based addresses. This activity is indicative of potential malware communication or C2 beacons.
Detects HTTP GET requests to api.adblock-for-youtube.com to retrieve scriptlet rules. This endpoint is used by various browser extensions to fetch dynamic configuration updates, which can potentially facilitate MAIN-world JavaScript injection.
Detects Python scripts or processes accessing common browser credential and cookie storage files (such as Login Data, key4.db, or cookies.sqlite) and subsequently making outbound network connections, indicating potential theft and exfiltration of browser data.
This rule monitors network logs (proxy, web gateway, and DNS) to detect connections to a curated list of known malicious domains associated with phishing, credential harvesting, and malware delivery infrastructure.
This rule identifies suspicious outbound network traffic potentially related to data exfiltration or command-and-control (C2) communication. It monitors for connections to the Telegram Bot API utilizing 'sendMessage' methods, often used by malware for exfiltrating credentials or sensitive data, as well as connections to known 'Bluekit' PhaaS (Phishing-as-a-Service) operator domains.
This rule detects potentially malicious browser activity by monitoring for Google Chrome outbound network connections to known command-and-control (C2) domains associated with malicious browser extensions (e.g., BadBlocker). It also flags the installation or loading of specific, known-malicious browser extension IDs on endpoints.
Detects exploitation attempts against LB-LINK routers via parameter injection in the 'set_LimitClient_cfg' endpoint (CVE-2023-26801) and subsequent command-and-control behavior, including outbound connections to known RondoDox staging IPs and DNS queries for associated malicious domains.
This rule detects potentially malicious activity related to the npm ecosystem. It identifies Node.js processes accessing .npmrc files (which contain authentication tokens) followed by immediate outbound network communication. Additionally, it detects suspicious command-line patterns associated with automated npm publishing (indicative of worm-like propagation) and the presence of npm credentials in the environment or command lines of non-npm processes.
Detects C2 fallback channel switching between backup domain names
This rule detects network traffic indicative of command and control (C2) activity using the WebSocket protocol targeting a specific suspicious destination IP (38.60.253.35). The rule identifies WebSocket connections or traffic containing specific URL parameters ('a=w64', 't=ws_') commonly associated with malicious tooling or C2 communication patterns.
Detects a potential Remote Code Execution (RCE) chain originating from AI orchestration frameworks (such as AutoGen/Uvicorn). The rule identifies an execution flow where an AI framework launches a browser automation process (e.g., Playwright/Chromium), which subsequently spawns a suspicious OS shell or LOLBin (Living-off-the-Land Binary) that immediately initiates an external network connection. This behavior is indicative of an AI agent being coerced to bypass security controls via MCP (Model Context Protocol) WebSocket loopback trust, leading to command execution and external C2 communication.
Detects malware checking internet connectivity via external IP services
Detects concurrent suspicious network beaconing to Telegram API or IPInfo and high-volume destructive file operations (deletion or modification) on a specific host, indicative of TrymeLocker ransomware activity.
Detects network communication with known SNOWLIGHT dropper C2 infrastructure (IP 38.60.253.35, port 8084), as well as unauthorized network activity originating from the Windows Update service (wusvc.exe) and suspicious file execution of a known malicious hash associated with this activity.
Detects the use of curl.exe to upload files to the temp.sh service while simultaneously passing the resulting temp.sh URL within the User-Agent string to a C2 server. This specific exfiltration and beaconing TTP was observed in the Notepad++ supply chain attack.
Detects network connections to specific IP addresses associated with websocket protocols
Page 132 of 190