Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule detects malicious activity by monitoring for specific known indicators, including hashes of malicious files (ProcessRollup2), network connections to known C2 infrastructure (NetworkConnectIP4), and URL clicks (UrlClick) associated with malicious domains or paths. It acts as a multi-stage indicator correlation rule to identify execution or communication with known threats.
This rule monitors for indicators of compromise (IOCs) associated with Operation SideCopy, including specific file hashes, known command-and-control (C2) IP addresses, malicious domains, and URLs. It triggers on file creation, process execution, and network connections matching these known indicators.
This rule detects outgoing HTTP POST requests that contain a ZIP file with a filename prefix of 'StolenData_' in the request body. This is a known behavior of the TokenGrabber stealer family, which exfiltrates collected victim data (e.g., browser credentials, session tokens) to a remote server, often via a Discord webhook or similar infrastructure.
Detects unauthorized processes attempting to access Discord's local storage (LevelDB) where authentication tokens are stored, followed by a network request to the Discord API user validation endpoint, which is a pattern indicative of token extraction and liveness testing by malware.
Detects HTTP connections between internal hosts and suspected C2 infrastructure associated with the Operation SilkParasite campaign. The rule specifically monitors for connections to known malicious IPs and identifies the retrieval of a cloned RTX Corporation homepage content, which acts as a decoy for the SpiceRAT malware.
Detects network communication with infrastructure identified as SilkParasite command and control by matching specific TLS certificate subjects and SHA-256 fingerprints associated with SpiceRAT.
This rule correlates multiple telemetry sources (File Events, Certificate Info, Network Events, and DNS Events) to detect known malicious indicators, including specific file hashes, IP addresses, domains, and URLs associated with malicious activity.
This rule correlates multiple telemetry sources (File Events, Certificate Info, Network Events, and DNS Events) to detect known malicious indicators, including specific file hashes, IP addresses, domains, and URLs associated with malicious activity.
Detects outbound HTTP requests from endpoints to a known C2 infrastructure associated with mobile device spyware. The rule identifies two specific stages: polling for new commands using a GET request and posting command execution results using a POST request, both targeting an MDM-mimicking API structure.
Detects outbound HTTP requests from endpoints to a known C2 infrastructure associated with mobile device spyware. The rule identifies two specific stages: polling for new commands using a GET request and posting command execution results using a POST request, both targeting an MDM-mimicking API structure.
Detects cleartext HTTP POST requests to specific URI endpoints (/api/v1/devices/register or /api/v1/devices/heartbeat) known to be used by the Corp_MDM Android spyware for C2 communication, registration, or heartbeat signals.
Detects cleartext HTTP POST requests to specific URI endpoints (/api/v1/devices/register or /api/v1/devices/heartbeat) known to be used by the Corp_MDM Android spyware for C2 communication, registration, or heartbeat signals.
Detects outbound network traffic and HTTP requests originating from the internal network destined for a known malicious infrastructure associated with 'Corp MDM'. The traffic includes C2 communication patterns, specific API URI paths, and potential login interactions on non-standard ports, consistent with phishing, malware delivery, or unauthorized administrative access.
Detects outbound network traffic and HTTP requests originating from the internal network destined for a known malicious infrastructure associated with 'Corp MDM'. The traffic includes C2 communication patterns, specific API URI paths, and potential login interactions on non-standard ports, consistent with phishing, malware delivery, or unauthorized administrative access.
This rule monitors for network connections to Telegram-related domains (t.me, telegra.ph, teleg.run) initiated by processes other than standard web browsers. This behavior is frequently associated with malware or adversary tools utilizing the Telegram API for command and control (C2) or data exfiltration, as it bypasses legitimate browser usage.
This rule monitors for network connections to Telegram-related domains (t.me, telegra.ph, teleg.run) initiated by processes other than standard web browsers. This behavior is frequently associated with malware or adversary tools utilizing the Telegram API for command and control (C2) or data exfiltration, as it bypasses legitimate browser usage.
This rule detects potential malicious activity by matching file hashes against a known list of malicious indicators and monitoring for suspicious network connections. The network monitoring includes connections to hardcoded malicious IP addresses, specific C2 URLs, and DNS queries for known fallback domains used in malicious infrastructure when the initiating process is not a recognized web browser or wallet application.
This rule detects potential malicious activity by matching file hashes against a known list of malicious indicators and monitoring for suspicious network connections. The network monitoring includes connections to hardcoded malicious IP addresses, specific C2 URLs, and DNS queries for known fallback domains used in malicious infrastructure when the initiating process is not a recognized web browser or wallet application.
Detects network communication associated with the SectopRAT/ArechClient2 remote access trojan, specifically identifying its characteristic length-prefixed, AES-encrypted command-and-control handshake on non-standard ports. The rule matches traffic containing a specific length-prefixed packet structure starting with null bytes, typically seen during C2 check-in.
Detects network communication associated with the SectopRAT/ArechClient2 remote access trojan, specifically identifying its characteristic length-prefixed, AES-encrypted command-and-control handshake on non-standard ports. The rule matches traffic containing a specific length-prefixed packet structure starting with null bytes, typically seen during C2 check-in.
Detects network communication associated with the SectopRAT/ArechClient2 remote access trojan, specifically identifying its characteristic length-prefixed, AES-encrypted command-and-control handshake on non-standard ports. The rule matches traffic containing a specific length-prefixed packet structure starting with null bytes, typically seen during C2 check-in.
Page 37 of 190