Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects HTTP PUT/POST requests targeting external domains with URI patterns and filename structures characteristic of TheGentlemen ransomware group's data exfiltration activities. The rule monitors for large HTTP request payloads (>50KB) and suspicious TLS subject fields (e.g., presence of CN without an O field) associated with potential C2 communication.
Detects repetitive network traffic to the Slack API endpoint '/api/conversations.history' using the 'Go-http-client' User-Agent. This behavior is indicative of the Graphalgo RAT polling Slack for command-and-control (C2) instructions.
KQL Query from file: Network detection - C2 domains and static key
Detects network communication from 'rnpkeys.exe' to external IP addresses. This behavior is indicative of the Sauron Loader malware, which utilizes a side-loaded 'rnpkeys.exe' binary to establish beaconing and C2 communication as part of its registration process.
Detects HTTP traffic identified as Sauron Loader, characterized by specific POST requests to hardcoded domains, URI path structures, and user-agent strings indicative of automated C2 activity.
Detects HTTP traffic identified as Sauron Loader, characterized by specific POST requests to hardcoded domains, URI path structures, and user-agent strings indicative of automated C2 activity.
Detects instances where the rnpkeys.exe process initiates a network connection shortly after its execution. The RNP (OpenPGP) utility is generally used for local cryptographic operations; unexpected network activity from this process may indicate potential misuse, data exfiltration, or malicious use of the tool for command-and-control communication.
This rule monitors network connections, file events, and process execution command lines for references to a list of known malicious URLs, including indicators associated with ClearFake, IClickFix, AMOS, Remus, and Mozi botnet payloads.
This rule detects potentially malicious C2 communication by monitoring high-frequency HTTP POST requests from the 'rnpkeys.exe' process. It aggregates network events over 30-second windows and flags activity exceeding a threshold of 5 POST requests directed at known suspicious domains or specific high-port network destinations, which is characteristic of beaconing or data exfiltration activity.
Detects network traffic consistent with a hardcoded C2 channel used by PolinRider or NullReceiver malware families. The rule monitors TCP traffic directed to a specific IP address (193.26.115.131) and port (15152) that contains serialized command/status structures formatted with specific JSON-like content patterns.
Detects network activity, including HTTP requests and TLS SNI traffic, directed towards the known GRIMWEDGE C2 domain 'ocr.opusaccel.top'. This includes monitoring for repeated polling behavior indicative of a command and control heartbeat mechanism.
Detects a network request to download a file named 'msgbox.exe' using the curl command-line utility, consistent with the activity observed from threat actor UTA0560 (GRIMWEDGE). This rule monitors for HTTP GET requests targeting the specific file path while the User-Agent string begins with 'curl/'.
Detects periodic outbound network traffic to the Telegram Bot API (api.telegram.org) indicative of potential command and control (C2) beaconing, specifically monitoring for repeating connections over extended time intervals.
Detects outbound HTTP GET requests containing an 'auth=' parameter with a long string of alphanumeric characters, characteristic of an OAuth token exfiltration attempt by a malicious Twitch extension (JeetBot). The rule flags requests to external destinations that are not official Twitch, Twitch Video Network, or JTV domains.
Detects network communication associated with the Rapuncel MaaS (Malware-as-a-Service) campaign, specifically identifying the Command and Control (C2) connection, GitHub Pages-based redirect chains, and subsequent delivery of large, suspicious ZIP archives containing renamed executable/system files.
Detects instances where PowerShell scripts are executed via the Windows Task Scheduler from within potential staging directories (ProgramData with randomized folder names). The rule identifies execution that uses common PowerShell obfuscation flags (e.g., -EncodedCommand) and requires secondary hardening bypass flags (e.g., -WindowStyle hidden), followed by correlated network activity to a specific suspicious C2 domain.
Detects Xray-core C2 tunnel traffic where the TLS SNI is spoofed to appear as 'dl.google.com'. The detection specifically looks for this behavior originating from non-browser processes such as 'wkspbroker.exe' or 'radcui.dll', which is indicative of malicious tunneling activity.
Detects a behavioral chain where a process establishes persistence using a 'WindowsUpdate' Registry Run key or a scheduled task, followed within five minutes by an outbound network connection from the same process. The rule specifically excludes cases where a ZIP file was written to disk, identifying potential in-memory staging for exfiltration.
Detects outbound network traffic containing the hardcoded user-agent string 'Remcos', which is indicative of a Remcos RAT beacon communicating with a command-and-control (C2) server. The rule inspects HTTP requests to identify this specific malware signature within the established communication flow.
This rule monitors network traffic, DNS queries, and user web clicks to detect interactions with known malicious domains associated with credential harvesting and phishing campaigns, specifically those impersonating security or SSO portals.
Detects various indicators of compromise (IOCs) including known malicious file hashes, suspicious file names commonly associated with staging or initialization in web directories, and network communication to known malicious domains or URLs. It also monitors process execution command lines for references to these IOCs, excluding common browser processes.
Page 22 of 190