Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects WebSocket connections to the AutoGen Studio MCP control plane on ports 8080 or 8081, specifically looking for URLs containing '/api/mcp/ws/' and 'server_params=', which may indicate an attempt at Remote Code Execution (RCE) via malicious server parameters.
Detects execution of PowerShell commands that reflectively load a .NET assembly into memory using System.Reflection.Assembly::Load. The rule specifically flags behavior associated with the 'ROOTBOY' implant, which involves invoking the 'Extension.SubRoutine' class method 'Run2' and communicating with the C2 domain 'hellolargeworld.com'.
Detects the RemotePC RMM component (rpccmdhost.exe) being used to spawn PowerShell processes with suspicious command-line arguments. The rule specifically looks for evidence of hidden PowerShell execution designed to bypass TLS certificate validation and download external scripts or stagers from a known C2 IP address associated with ROOTBOY activity.
Detects communication between a macOS host and the Telegram Bot API using the 'getUpdates' method. This behavior is indicative of the 'Gaslight' malware family using Telegram as a command-and-control (C2) channel via polling, typically characterized by repeated HTTP requests to 'api.telegram.org'.
Detects the presence of Remcos RAT by correlating a specific mutex (Remcos_Mutex_Inj) indicative of active malicious processes with an outbound network connection to a known command-and-control (C2) IP address (62.102.148.212) on port 37393. This combination is characteristic of Remcos RAT operations used for unauthorized audio and webcam surveillance.
This rule detects network traffic patterns associated with the Turla group's STOCKSTAY malware, specifically identifying WebSocket upgrade requests directed at the external domain 'canal1zac1a.onrender.com'. This pattern is indicative of a Command and Control (C2) channel initiation.
Detects HTTP traffic attempting to upgrade a connection to a WebSocket protocol directed towards the known Turla-associated command-and-control infrastructure 'driverx86-adobe.onrender.com'. This pattern is characteristic of the STOCKBROKER component within the STOCKSTAY malware framework, observed in recent phishing campaigns.
Detects anomalous HTTP GET requests targeting the ClawHub API for 'skills' that match known patterns of malicious file downloads, specifically identifying poc.py scripts or skill.md files which are indicative of the ClawHavoc campaign activity.
Detects anomalous HTTP responses containing high-entropy, potentially multi-layered obfuscated payloads. The rule specifically monitors for patterns suggesting Base64, ROT13, and Hex encoding in the response body, which is consistent with methods used to deliver obfuscated malicious AI skills or scripts via web traffic.
This rule monitors network traffic for HTTP POST requests directed toward specific destination ports (443 or 8770) that return HTTP status codes in the 4xx range (client errors), excluding known legitimate URI paths. This pattern may indicate scanning activity, exploitation attempts, or unauthorized access attempts against internal services or misconfigured applications.
Detects outbound web traffic directed towards common password management services (e.g., 1Password, LastPass, Bitwarden) originating from user agents associated with AI and LLM tools (e.g., OpenAI, Claude, Copilot). This combination of destinations and user agents is highly anomalous and may indicate potential credential exfiltration or interaction with automated agents acting on behalf of a user to access sensitive vault data.
This rule detects network activity involving known suspicious domains and the download of specific, potentially malicious files (archives and installers). The monitoring focuses on HTTP/proxy/DNS traffic where hostnames, URLs, or query parameters match indicators of malicious activity.
This rule detects processes that load .NET-related modules (clr.dll or dotnet.exe) and maintain a network connection (port 80 or 443) for more than one hour during standard business hours. This behavior is indicative of potentially persistent, long-running .NET-based applications or potentially malicious tools maintaining persistence and C2 communication.
Detects network traffic associated with the Turla group's STOCKSTAY malware, specifically identifying outbound WebSocket upgrade requests directed to the known command-and-control domain weatherdataai.theworkpc.com.
This rule detects network traffic patterns associated with the Turla group's STOCKSTAY malware, specifically identifying WebSocket upgrade requests directed at the external domain 'canal1zac1a.onrender.com'. This pattern is indicative of a Command and Control (C2) channel initiation.
Detects anomalous HTTP responses containing high-entropy, potentially multi-layered obfuscated payloads. The rule specifically monitors for patterns suggesting Base64, ROT13, and Hex encoding in the response body, which is consistent with methods used to deliver obfuscated malicious AI skills or scripts via web traffic.
Detects outbound network traffic established by a client using the default self-signed TLS certificate generated by Metasploit for Meterpreter Reverse HTTPS sessions. The rule looks for the common default subject fields 'CN=metasploit' and 'O=msf' within the TLS handshake.
This rule detects potential Cobalt Strike Beacon check-in activity over HTTP. It identifies incoming GET requests where the URI is abnormally short and the HTTP Referer header is missing, which are common indicators of default Cobalt Strike malleable C2 profiles.
Detects HTTP POST requests characteristic of QakBot command-and-control check-ins. The rule looks for an 'established' flow to an external network using a POST method, with a request body containing 'qbot' followed by a version string pattern, which is indicative of the malware reporting system info to its C2 server.
Detects outbound HTTP POST requests where the Content-Length is at least 10MB and the Content-Type header indicates the transfer of archived data (zip or x-tar). This pattern is often associated with the staging and exfiltration of compressed sensitive data from an internal host to an external network destination.
This rule monitors for HTTP POST requests to external networks containing 'gtag=' in the URI, which is a known technique used by the TrickBot malware to exfiltrate its group identifier during C2 communication.
Page 137 of 190