Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule detects network connections to specific domains known to be associated with malicious activity or to URLs matching a common Command and Control (C2) communication pattern. The domains 'openanyworddocument.com', 'kittyfreespace.com', 'searchdocumentsfree.com', 'autoupdatet.com', 'autoupdaters.com', and 'autoupdatethis.com' are explicitly listed as indicators. Additionally, the rule identifies C2 communication attempts via a regex pattern '/api/(init|cl)/[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}' within the RemoteUrl field, which often indicates communication with a C2 server using a UUID-like identifier.
This rule detects WebSocket communication attempts from a device to known command and control (C2) IP addresses associated with the Remcos Remote Access Trojan (RAT). It specifically looks for network events where the remote URL contains 'ws://', 'wss://', or 'websocket' and the remote IP address matches one of the listed indicators of compromise (IOCs).
Detects DNS resolution to attacker-controlled AWS S3 buckets masquerading as Outlook/OneDrive service pages used by UNC6692 for phishing delivery, SNOWBELT C2, and credential exfiltration. The rule specifically looks for DNS queries to S3 domains with patterns indicative of spoofed Outlook/OneDrive service pages or specific known malicious S3 bucket names.
This rule detects suspicious activities involving AWS CLI or curl commands spawned from IDE-related processes (amazonq-language-server, Code.exe). It monitors for command patterns indicating credential discovery (aws sts get-caller-identity) or data exfiltration (curl POST requests), and correlates these with unusual CloudTrail GetCallerIdentity events occurring from non-AWS source IP addresses.
Detects the creation of an mcp.json file within the .amazonq directory, followed shortly by the execution of suspicious child processes (bash, python, curl, etc.) by VS Code (Code.exe). This pattern is often indicative of an adversary abusing developer tools or IDE extensions to perform credential discovery or data exfiltration from a development environment.
Detects outbound network communication from node.exe to the domain 'stitch-production.org'. This domain is associated with the 'Miasma' (also known as Mini Shai-Hulud) campaign, which uses malicious npm packages with post-install scripts to steal developer credentials, including Git, Docker, SSH, and cloud service configuration files.
Detects outbound network connections to URLs containing strings associated with Qakbot (Qbot) malware infrastructure and common ports used by the malware for command-and-control communication.
Detects execution of PowerShell commands associated with the Gamaredon Group's Ptero malware family. This rule monitors for suspicious PowerShell command lines (including encoded commands and common obfuscation patterns) originating from Office applications or temporary directories, correlated with network connections to known Gamaredon C2 domains or registry modifications to Run keys for persistence.
This rule detects network traffic containing keywords commonly associated with Indian payment gateways and financial transactions (NEFT, RTGS, IMPS, GST, PAN, IFSC). This could indicate data exfiltration or suspicious activity involving financial information, potentially related to malware like Remcos RAT.
Detects network communication patterns indicative of RedLine Stealer activity by looking for specific keywords in the RemoteUrl field during inbound or outbound connections.
Detects network connections from suspicious or unexpected processes to common public webhook and automation services, which may indicate data exfiltration or automated C2 communication.
This rule detects the use of JSON-RPC 'eth_call' by a non-browser process during network connection events. It specifically looks for network activity where the process is not a known web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is often associated with malware or cryptocurrency-related threats attempting to resolve dynamic commands or addresses.
Detects a network beacon triggered strictly during model initialization. If a Python process loads a model file and immediately establishes an outbound TCP connection to an unknown IP, it indicates an embedded payload phoning home.
Detects non-browser HTTP POST requests containing both 'access_token' and step-style parameters (e.g., 'step', 'stage', 'counter' followed by a number) in proxy or firewall telemetry. This rule specifically targets patterns associated with malware communication, such as SessionGate, Remus, or AnimateClipper, by excluding common browser user agents.
Detects curl.exe downloading payloads to generic .dat or .exe files in AppData, or hitting known staging IPs.
Detects a specific two-step HTTP pattern characteristic of OysterLoader's initial C2 communication. The malware first sends a registration request containing a 'WordPressAgent' User-Agent string, followed by a login request with a 'FingerPrint' User-Agent string to the same destination. This version checks for the User-Agent strings in the 'AdditionalFields' column.
This rule detects potentially suspicious outbound network connections or DNS queries to known Generative AI service domains (OpenAI, Anthropic, Google, Mistral, Cohere) from non-browser and non-developer processes. It also triggers on suspicious Windows binaries (e.g., PowerShell, bitsadmin, mshta) initiating external connections to these domains or other destinations over port 443, helping identify potential data exfiltration or automated abuse of LLM APIs.
Lumma C2Beacon
YARA
Infostealer-as-a-service targeting browser credentials and crypto wallets
PlugX NetworkIOC
YARA
Modular remote access trojan associated with long-term espionage intrusions
Infostealer distributed via fake open-source tool impersonation sites
Infostealer distributed via fake open-source tool impersonation sites
Page 133 of 190