Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects the installation of a potential remote monitoring and management (RMM) agent via common tools like msiexec, nssm, or sc.exe, followed by consistent HTTPS beaconing to domains hosted on Azurewebsites.net. This pattern is indicative of unauthorized remote access tools used for command and control.
Detects a sequence where an AWS Secrets Manager secret is retrieved via CloudTrail, followed within 30 minutes by an EDR-monitored process initiating an outbound network connection on a non-standard port (not 80 or 443). This behavior is consistent with an adversary using stolen credentials to pivot into a persistent command-and-control channel.
Detects endpoint network activity characterized by a host connection to the Telegram Bot API followed by a connection to a Vercel-hosted domain within 30 minutes. This behavior is indicative of a multi-stage infection chain where adversaries use Telegram for command-and-control communication or victim validation, followed by the retrieval of malicious payloads or lures from disposable infrastructure like Vercel.
Detects network beaconing and command-and-control (C2) communication patterns associated with the RatHat Android malware family. The rule identifies registration, shell command check-ins, heartbeat signals, and task fetching activity over HTTP. It uses stateful inspection (flowbits) to correlate device registration with subsequent heartbeat behavior to improve detection fidelity.
Detects network activity associated with the JWR/Outsider phishing kit, which leverages legitimate e-commerce platform parameters (e.g., Shopify/WooCommerce 'cart_data') to mimic storefront infrastructure. The rule correlates requests containing these e-commerce parameters with the loading of the phishing kit's client-side engine scripts or WebSocket workers from the same host, indicating the use of a compromised or malicious storefront-mimicry domain.
Detects the specific network-observable behavior of the JWR client engine. The rule identifies a device loading the engine script (main.js) followed within a short time window by either a fallback redirection to a_index.html or the initiation of a WebSocket connection using a specific obfuscated path pattern associated with JWR command and control.
Detects the initialization stage of a Mirage2FA phishing attack, characterized by the execution of a locally saved HTML file in a web browser, closely followed by an outbound network connection to the ipify.org API for victim IP geolocation and fingerprinting before the malicious sign-in page is rendered.
Detects DNS queries and HTTP requests associated with the OnyxC2 command and control infrastructure, including specific hardcoded domains and suspicious DNS traffic targeting newly-abused top-level domains (.top, .cyou, .lol).
Detects network traffic to specific domains (api.hhos.ru, mainapi.store) associated with the VPN-for-X browser extension's monetization API. This behavior is indicative of command-and-control or tracking communication identified as potentially malicious within the context of a browser extension.
Detects outbound web requests to the Telegram API triggered by Google Apps Script components (sidebar macros). This pattern is indicative of malicious Google Docs or Slides files using embedded scripts to exfiltrate data or perform command-and-control communication via the Telegram API when the document is opened by a user.
Detects network activity associated with the NarwhalRAT malware, specifically C2 beaconing via HTTP/DNS to known infrastructure and file downloads from staging domains.
Acronis TRU (Sept 2025) documented a FileFix campaign where a PowerShell loader downloads images from Bitbucket that conceal embedded malicious components, ultimately deploying a Go-based loader and StealC.
Detects network connection attempts from endpoints to known proxy service domains (IPRoyal, LightningProxies) that have been observed acting as infrastructure for CHOSEN BRICK Telegram-based C2 and exfiltration traffic.
Detects network connection attempts from endpoints to known proxy service domains (IPRoyal, LightningProxies) that have been observed acting as infrastructure for CHOSEN BRICK Telegram-based C2 and exfiltration traffic.
Detects network traffic to the Telegram Bot API originating from processes other than the official Telegram desktop client. The rule correlates this network activity with the presence of specific suspicious or renamed processes (e.g., SMQDService, winappx.exe) associated with the CHOSEN BRICK campaign.
Detects outbound HTTP POST requests directed to 'kmot.co/board.php', which is associated with Command and Control (C2) activity from the Chinotto Python-based backdoor attributed to APT37.
Detects HTTP POST requests to a known suspicious endpoint ('/board.php') often used by the Chinotto Python backdoor. The rule monitors for outgoing web traffic containing 'data=' parameters or connections to known malicious domains, indicating potential exfiltration of base64-encoded command output.
Detects network traffic (HTTP, TLS, and DNS) originating from the internal network directed toward Telegram's API endpoints (api.telegram.org) and domains (t.me). This behavior is often associated with the use of the Telegram Bot API as a command-and-control (C2) channel or for data exfiltration by malware.
Detects network traffic (HTTP, TLS, and DNS) originating from the internal network directed toward Telegram's API endpoints (api.telegram.org) and domains (t.me). This behavior is often associated with the use of the Telegram Bot API as a command-and-control (C2) channel or for data exfiltration by malware.
Detects network connection attempts to known malicious infrastructure, specifically targeting suspicious domains and an IP address associated with command and control (C2) activity. The rule monitors endpoint network events for communication with specified malicious URLs or a hardcoded IP.
Detects network connections or DNS queries to known suspicious domains associated with command and control infrastructure.
Page 32 of 190