Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule detects network connections to known cryptomining pool IP addresses and domain names, as well as file or process executions matching specific hashes associated with known miner samples. It monitors for communication to command-and-control (C2) servers potentially used for cryptomining operations.
Detects a sequence of activity where an endpoint performs multiple anti-analysis or sandbox evasion checks (using commands like wmic, powershell, or reg to query system information or look for debugger/VM artifacts) followed within 10 minutes by an outbound network connection to a domain that has not been observed from that specific device in the last 7 days.
Detects AI agent tooling (e.g., Copilot, Cursor, Ollama) that makes outbound network calls to known AI model providers followed by the execution of suspicious shell commands within a short duration. The rule flags high-severity activities such as download-cradles, credential reconnaissance, LOLBin usage, and persistence mechanisms. Informational alerts are generated for standard CLI activity within the same timeframe.
Detects AI agent tooling (e.g., Copilot, Cursor, Ollama) that makes outbound network calls to known AI model providers followed by the execution of suspicious shell commands within a short duration. The rule flags high-severity activities such as download-cradles, credential reconnaissance, LOLBin usage, and persistence mechanisms. Informational alerts are generated for standard CLI activity within the same timeframe.
Detects AI agent tooling (e.g., Copilot, Cursor, Ollama) that makes outbound network calls to known AI model providers followed by the execution of suspicious shell commands within a short duration. The rule flags high-severity activities such as download-cradles, credential reconnaissance, LOLBin usage, and persistence mechanisms. Informational alerts are generated for standard CLI activity within the same timeframe.
Detects instances where a single process on a device communicates with two or more distinct hosted LLM provider APIs (OpenAI, Anthropic, DeepSeek, Google) within a 24-hour window. This behavior is indicative of multi-model orchestration or 'consensus' techniques, which may be employed by sophisticated implants for automated tasking, data processing, or evasion.
Detects instances where AI-based coding or agent-driven tools (e.g., Cursor, Claude Code, AutoGPT) perform suspicious file archiving/packaging activities followed by network egress to unauthorized or known exfiltration-prone services. This helps identify potential data exfiltration by AI agents or compromised development environments.
Detects instances where AI-based coding or agent-driven tools (e.g., Cursor, Claude Code, AutoGPT) perform suspicious file archiving/packaging activities followed by network egress to unauthorized or known exfiltration-prone services. This helps identify potential data exfiltration by AI agents or compromised development environments.
Detects instances where AI coding and agent tools (e.g., Claude Code, Cursor, Copilot CLI, Ollama, LangGraph) create archive or database files containing potentially sensitive data and subsequently initiate network connections to non-AI-provider or non-developer services (exfiltration services or non-standard port connections).
This rule performs a point-in-time IOC hunt within CommonSecurityLog data to detect indicators associated with NeedyMantis. It monitors for specific C2 infrastructure domains ('tripswithengine.com') and a hardcoded user-agent string ('Firefox/21.0') in proxy, firewall, or network logs, which are characteristic of this threat actor's activity.
Detects unauthorized processes attempting to read or copy sensitive browser data files (e.g., Cookies, Login Data, Local Storage) often targeted by info-stealing malware such as Vidar, LummaC2, or RedLine. The rule filters out legitimate browser-related processes and adds security context by requiring evidence of unsigned code, execution from suspicious locations (Temp/Downloads), or associated outbound network activity to reduce false positives.
Detects network, HTTP, and DNS activity associated with the known three-tier delivery infrastructure (phishing sites, relay/dispatcher servers, and payload hosts) used by the threat actor UNC6671/SilverFox/Aurora. The rule distinguishes between high-confidence confirmed connections and low-confidence DNS-only events.
This rule monitors network connections, file events, and process execution command lines for references to a list of known malicious URLs, including indicators associated with ClearFake, IClickFix, AMOS, Remus, and Mozi botnet payloads.
Detects network communication with known malicious domains and IP addresses, as well as the presence of known malicious file hashes on the system. The rule correlates network connection events, file creation events, and process creation events against predefined lists of C2 infrastructure and malware indicators.
Detects network traffic directed towards Telegram shortened URLs (t.me) which is a common command-and-control (C2) communication channel used by Vidar and other malware families to exfiltrate data or retrieve instructions.
Detects a specific bot-cloaking technique used by the Exvicy/ErrTraffic framework, where an actor makes requests to bot-decision endpoints (index.php/white.php) while providing a spoofed 'google.com' Referer header to a non-Google destination host. This technique is often used to facilitate the delivery of fraudulent content (e.g., fake Turnstile/ClickFix pages) while evading detection by security scanners and undesired geographic regions.
This rule detects obfuscated JavaScript payloads characteristic of the Exvicy malware distribution framework (a successor to ErrTraffic) being served via compromised WordPress pages. The detection logic searches for specific obfuscation patterns and 'human verification' lures within HTTP response bodies on web proxies.
This rule detects DNS queries, TLS Server Name Indication (SNI) lookups, and HTTP Host header requests directed towards a list of known domains associated with 'Exvicy' malicious activities (lure domains).
Detects outbound HTTP POST requests associated with the VelvetCake malware and Konni threat actor to the command-and-control (C2) domain 'medianewsonline.com'. The rule matches specific URI patterns ('/logout.php') and query parameters ('OKey=', 'Who=', 'Areyou=') commonly used for reconnaissance and data exfiltration.
The following analytic detects potential data exfiltration using plain HTTP POST requests. It leverages network traffic logs, specifically monitoring the `stream_http` data source for POST methods containing suspicious form data such as "wermgr.exe" or "svchost.exe". This activity is significant because it is commonly associated with malware like Trickbot, trojans, keyloggers, or APT adversaries, which use plain text HTTP POST requests to communicate with remote C2 servers. If confirmed malicious, this activity could lead to unauthorized data exfiltration, compromising sensitive information and potentially leading to further network infiltration.
IOC hunt for the HEAVYGRAM/CRUDEEXCLUDE campaign: matches known SHA256 file hashes (first-stage malware, implant, RAR/ZIP artefacts) via DeviceFileEvents and DeviceProcessEvents, plus known-malicious domains/staging infrastructure by parsed hostname across network connections, process command lines, and file origin URLs.
Page 35 of 190