Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule monitors for network connections to known malicious domains or IP addresses, and for the presence or execution of files with known malicious file hashes (MD5, SHA1, SHA256). It consolidates detections from network traffic, file events, and process execution logs over a 30-day lookback period.
This rule monitors for network connections to known malicious domains or IP addresses, and for the presence or execution of files with known malicious file hashes (MD5, SHA1, SHA256). It consolidates detections from network traffic, file events, and process execution logs over a 30-day lookback period.
This rule monitors for network connections to known malicious domains or IP addresses, and for the presence or execution of files with known malicious file hashes (MD5, SHA1, SHA256). It consolidates detections from network traffic, file events, and process execution logs over a 30-day lookback period.
Detects network connection attempts to known typosquatted domains (thecovnresation.com/net) commonly associated with the CLEANGULP malware beaconing activity, specifically targeting the /beacon/pre-register URI path.
Detects network connection attempts to known typosquatted domains (thecovnresation.com/net) commonly associated with the CLEANGULP malware beaconing activity, specifically targeting the /beacon/pre-register URI path.
This rule identifies potential malicious activity by detecting the presence of known malicious file hashes (SHA256 and MD5) on endpoints and monitoring for DNS queries or network connections to a known malicious staging domain (yapw.life). The detection correlates file execution, file activity, and network communication to identify stages of an attack such as malware installation or C2 communication.
This rule detects outbound TLS traffic to the domain 'trace-flow.ru', which is associated with Max Messenger covert telemetry beaconing behavior. The rule inspects the Server Name Indication (SNI) field in the TLS handshake for the specific domain string.
This rule detects outbound TLS traffic to the domain 'trace-flow.ru', which is associated with Max Messenger covert telemetry beaconing behavior. The rule inspects the Server Name Indication (SNI) field in the TLS handshake for the specific domain string.
This rule detects outbound TLS traffic to the domain 'trace-flow.ru', which is associated with Max Messenger covert telemetry beaconing behavior. The rule inspects the Server Name Indication (SNI) field in the TLS handshake for the specific domain string.
Detects network traffic to the domain 'trace-flow.ru', which is associated with the 'Max Messenger' malware's concealed telemetry and C2 channel. The rules monitor for TLS connections to this domain, including instances where the certificate subject contains 'VK LLC' and 'Moscow'.
Detects network traffic to the domain 'trace-flow.ru', which is associated with the 'Max Messenger' malware's concealed telemetry and C2 channel. The rules monitor for TLS connections to this domain, including instances where the certificate subject contains 'VK LLC' and 'Moscow'.
Detects network traffic to the domain 'trace-flow.ru', which is associated with the 'Max Messenger' malware's concealed telemetry and C2 channel. The rules monitor for TLS connections to this domain, including instances where the certificate subject contains 'VK LLC' and 'Moscow'.
Detects network activity associated with a VBScript-based dropper attempting to retrieve payloads from known malicious infrastructure (cdn.imageurlgenerator.com) or abusing legitimate file hosting services (filemail.com) to bypass traditional security filters.
Detects network activity associated with the ORAX control-plane panel and management service. The rule identifies HTTP traffic containing OraxManage or OraxRDP service strings, SignalR negotiate handshakes directed to common ORAX management ports, and connections to identified ORAX C2 infrastructure domains and IP addresses.
This rule detects a specific HTTP request pattern associated with the JWR-family Phishing-as-a-Service (PhaaS) platform. The detection looks for a WebSocket handshake initiation (GET request with specific URI segments 'webSocket/QT/' and a known hardcoded string) and an 'Upgrade' header, which are indicative of a command-and-control (C2) channel establishment.
Detects a suspicious pattern where a user browser visits a Google Document and subsequently initiates a connection to the Telegram Bot API within a short timeframe (10 minutes). This sequence is indicative of malicious Google Apps Scripts embedded in documents attempting to exfiltrate victim information (IP, geolocation, device details) as part of a reconnaissance phase before a ClickFix-style payload delivery.
Detects network activity associated with the SilkParasite botnet. The rule identifies inbound/outbound HTTP heartbeat check-ins using a specific URI pattern (/ping?h=) and direct TCP connections to a known malicious C2 IP address.
Detects network activity associated with the Psychedelic Stealer malware command-and-control (C2) communication patterns. The rule identifies specific API endpoints used for task polling, heartbeat pings, check-ins, and task acknowledgement, as well as connections to a known malicious C2 infrastructure, all characterized by the presence of a specific 'X-API-Key' header.
Detects a process accessing browser credential files (Login Data) followed by an outbound network connection to a suspicious exfiltration endpoint commonly associated with credential-stealing malware.
Detects outbound network requests to Google Gemini AI API endpoints from processes that are not common web browsers or known development tools. This behavior is indicative of unauthorized use of LLM services by non-browser applications, such as the RatHat UI-automation module, for processing sensitive data or automation tasks.
Detects network communication to domains and specific file paths associated with the MacSync macOS stealer, which is used for malware dropper delivery and command-and-control (C2) operations. The rule monitors DeviceNetworkEvents for indicators such as specific malicious URLs, iCloud path abuse, and C2 infrastructure interaction.
Page 40 of 190