Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule detects suspicious network connections made by processes (excluding legitimate EDR processes like mssense.exe and senseir.exe) to URLs commonly associated with EDR command and control (C2) infrastructure. This could indicate an attempt by an adversary to communicate with or manipulate the EDR agent.
Identifies mshta.exe accessing externally hosted HTA content from a user-initiated Explorer session, potentially indicating malicious remote code execution.
Detects network connections to known malicious domains associated with OilRig's steganography-based C2 infrastructure. OilRig C2 Domain Connection malicious domains extracted from OilRig telecom targeting campaign.
Detects web requests containing the specific user-agent or custom secret headers used by the Moika campaign beacon to retrieve its stage 2 payload.
Detects HTTP requests containing specific URL query parameter combinations (`ia=` and `df=`) or POST bodies containing `a=iz&b=`, which are unique to the JS.MonoGlyphRAT check-in and beaconing protocol.
Detects the export of Microsoft Teams messages, transcripts, recordings, and chat retrieval activities, particularly when performed via the Graph API. This rule identifies suspicious activity by looking for specific operation names in SaaS audit logs from Microsoft Teams and flags user agents commonly associated with automation tools (e.g., python-requests, axios, go-http, curl, wget, powershell, httpx, aiohttp, node) which could indicate post-compromise attackers using stolen tokens to silently export chat history.
Detects outbound network connections from web server processes to steamcommunity.com, which is used by this malware to fetch steganographically encoded C2 payloads from profile comments.
Detects web traffic indicating client-side injection loading JavaScript from the known malicious domain hello-mywordl.info, which is associated with a WordPress malware campaign.
Detects network connections to known CountLoader C2 domains based on McAfee Labs analysis. This rule identifies outbound network traffic from devices to a predefined list of Command and Control (C2) domains associated with the CountLoader malware. The detection logic specifically looks for the presence of these domains in the 'RemoteUrl' field of network events.
Darktrace researchers identified a Twill Typhoon–linked China‑nexus campaign targeting APJ customers. The activity observed includes CDN impersonation, legitimate binaries, and DLL sideloading to deploy a modular .NET RAT.
Detects network connections to the Cobalt Strike C2 URI path '/statistics/discover.txt', indicating active communication from a FrostyNeighbor Cobalt Strike beacon. Identifying this beacon is critical for finding fully compromised hosts under active remote control.
Detects network connections to the URI path '/employment/documents-and-resources', which is used by FrostyNeighbor's PicassoLoader to exfiltrate host fingerprinting data and assess compromised hosts for further payload delivery.
Identifies network connections to known C2 and dropper infrastructure associated with the Amatera Stealer 4.0.2 Beta and ClickFix campaign. Network indicators provide a reliable detection mechanism for compromised hosts attempting to download secondary payloads or exfiltrate data.
Detects script engines (wscript.exe, mshta.exe, cscript.exe) making outbound network connections to Cloudflare Workers domains (*.workers.dev). This is a primary C2 channel utilized by Gamaredon for GammaLoad payload delivery and beaconing.
Tycoon2FA Domain Network Traffic
Cortex XDR
Detects DNS queries or network connections resolving to known Tycoon2FA credential harvesting, kill switch, and link management domains post-takedown. This rule specifically targets precise indicators of compromise (IoCs) associated with the rebuilt Tycoon2FA infrastructure.
Tycoon2FA Kit URL Parameters
Cortex XDR
Identifies network traffic containing the distinct 'bltpg' and 'sid' parameters used by the Tycoon2FA credential harvesting platform. This rule specifically looks for HTTP network data containing both 'bltpg=' and 'sid=' within the action_network_http field, which are indicative of the Tycoon2FA phishing kit's communication patterns. The rule then deduplicates alerts based on agent hostname and remote IP to reduce alert volume.
FDMTP C2 Registration Request
Cortex XDR
Detects network HTTP requests to the '/GetCluster' endpoint containing the 'DotNet-TcpDmtp' protocol parameter, a specific C2 registration pattern used by the updated FDMTP backdoor.
Tycoon2FA Infrastructure IP Connections
Cortex XDR
Detects network traffic to IP addresses confirmed to host Tycoon2FA post-takedown components, including link management, credential harvesting, and kill switch infrastructure.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects network connections, DNS queries, or web requests to domains associated with the Mini Shai-Hulud supply-chain attack.
This attack compromised multiple npm and PyPI packages (such as TanStack, Mistral AI, and UiPath) with a payload that exfiltrates harvested credentials to the Session messaging protocol's file server and downloads additional stages from attacker-controlled domains.
This attack compromised multiple npm and PyPI packages (such as TanStack, Mistral AI, and UiPath) with a payload that exfiltrates harvested credentials to the Session messaging protocol's file server and downloads additional stages from attacker-controlled domains.
Detects network connections to the Session P2P exfiltration infrastructure used by the Mini Shai-Hulud campaign.
Page 157 of 190