Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule detects the creation of a Windows scheduled task that triggers an hourly execution of an obfuscated PowerShell script. The script incorporates XOR-encoded data and references known external malicious URLs, suggesting a persistence mechanism used by malware to download or communicate with attacker-controlled infrastructure.
Detects network activity associated with the Psychedelic Stealer malware, including C2 check-ins, API-based tasking, and communication with known C2 infrastructure using specific URI patterns and headers like 'X-API-Key'.
Detects HTTP traffic patterns associated with the Psychedelic Stealer malware command and control (C2) agent. The rule matches specific URI paths used for pinging, configuration retrieval, and tasking, while verifying the presence of the required 'X-API-Key' header, indicating established C2 communication.
Detects HTTP traffic patterns associated with the Psychedelic Stealer malware command and control (C2) agent. The rule matches specific URI paths used for pinging, configuration retrieval, and tasking, while verifying the presence of the required 'X-API-Key' header, indicating established C2 communication.
Detects evidence of the CARBONATO post-exploitation pattern, specifically identifying the installation of a Hermes Agent by monitoring the creation of a 'SOUL.md' persona file within a '.hermes' folder, followed by correlated outbound network traffic to a specific LLM gateway or known Vercel proxy infrastructure used for command relay.
This rule detects network traffic originating from internal hosts directed to the Telegram API endpoint 'api.telegram.org' with a URI pattern associated with bot interaction, potentially indicating usage of a Telegram-based Command and Control (C2) mechanism by the CARBONATO/Hermes agent.
Detects network activity associated with the NeedyMantis malware, including TLS SNI traffic to its hard-coded C2 domain, initial beaconing over HTTPS to specific paths, and potential exfiltration or reconnaissance markers in the server's Set-Cookie header response.
Detects network activity associated with the NeedyMantis malware, including TLS SNI traffic to its hard-coded C2 domain, initial beaconing over HTTPS to specific paths, and potential exfiltration or reconnaissance markers in the server's Set-Cookie header response.
Detects outbound network traffic associated with the NeedyMantis actor, specifically identifying a hardcoded outdated Firefox/21.0 User-Agent in HTTP requests attempting to upgrade to a WebSocket connection, as well as direct TLS communication with the identified C2 domain corp.tripswithengine.com.
Detects communication patterns associated with the RatHat Android banking trojan. The rule identifies a multi-stage C2 flow: first, the device fetches malicious overlay configurations (templates for spoofed login screens) and subsequently exfiltrates captured credentials or form data to the adversary's infrastructure via POST requests.
Detects DNS queries for RatHat C2 panels using characteristic naming patterns and specific malicious domains, as well as outbound network connections to known RatHat C2 IP infrastructure.
Detects the installation of a potential remote monitoring and management (RMM) agent via common tools like msiexec, nssm, or sc.exe, followed by consistent HTTPS beaconing to domains hosted on Azurewebsites.net. This pattern is indicative of unauthorized remote access tools used for command and control.
Detects the installation of a potential remote monitoring and management (RMM) agent via common tools like msiexec, nssm, or sc.exe, followed by consistent HTTPS beaconing to domains hosted on Azurewebsites.net. This pattern is indicative of unauthorized remote access tools used for command and control.
Detects a specific behavioral chain associated with the CHOSEN BRICK implant. This rule identifies when a suspected malicious process writes image/screenshot files (.png, .jpg, .bmp) to disk, followed by a network connection to the Telegram Bot API within a 15-minute window, suggesting potential data exfiltration.
Detects execution of the CHOSEN BRICK implant (process names smdqservice.exe or winappx.exe) initiating a network connection to Telegram infrastructure (C2) followed by a network connection to a cloud object-storage provider (vultrobjects.com, storjshare.io, or backblazeb2.com) for data exfiltration within a 30-minute window.
Detects HTTP traffic patterns associated with the VelvetCake malware used by North Korean threat actors Konni and Kimsuky. These signatures identify beaconing behavior to known free-hosting infrastructure, specifically monitoring for unique URL parameters ('OKey=', 'Who=', 'Areyou=cake') and common file naming conventions associated with the C2 communication.
Detects command-line execution of scripting tools (e.g., PowerShell, Python, WScript) that simultaneously reference AI service domains (OpenAI, Anthropic), perform network request functions, reference API keys, and utilize encoding or decoding operations. This pattern is indicative of unauthorized use of local scripts to interact with AI APIs, potentially for data exfiltration or automated processing of sensitive information.
Detects network communication to 'imageurlgenerator.com' where a VBScript downloader is attempting to retrieve a staged payload. The request pattern targets specific URI structures resembling GUID-based identifiers ending in '.txt', which is characteristic of the XHOPLESS malware delivery chain.
This rule set detects network communication patterns associated with the AnonyMousKIT phishing kit, specifically targeting the exfiltration of captured user credentials to the Telegram Bot API and communication with known phishing panel infrastructure. It monitors for DNS lookups of 'anomkit.shop', established TCP connections to the associated backend relay, and HTTP requests containing specific credential-related keywords directed towards the Telegram API.
Detects network traffic consistent with the XMRig cryptocurrency mining tool communicating with a Monero mining pool via TLS. The rule identifies specific SNI domains and direct connection attempts to known proxy IP addresses associated with cryptomining activities.
Detects activity associated with a potential RMM (Remote Monitoring and Management) agent communicating with known malicious infrastructure and accessing sensitive files like credentials or IDs. This often indicates an adversary leveraging legitimate RMM tooling for post-compromise activity or exfiltration.
Page 31 of 190