Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,650
12,597
8,408
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects outbound HTTP POST requests characteristic of the Sauron Loader malware, utilizing a specific, randomized URI path structure and a known malicious User-Agent string to establish C2 communication.
Detects outbound network traffic from internal hosts to known domains associated with the Sauron Loader malware family. These alerts monitor for TLS connections where the Server Name Indication (SNI) matches domains identified as part of the malware's C2 infrastructure.
Detects network communication associated with the Casbaneiro (Metamorfo) banking trojan, specifically identifying DNS queries, TLS SNI headers, HTTP Host headers, and direct IP connections to known malicious C2 infrastructure.
This rule monitors for known malicious file hashes, IP addresses, C2 domains, and specific URL markers associated with identified threat activity. It consolidates multiple detection vectors including file activity, process execution, network connections, and DNS queries to identify compromised devices communicating with attacker-controlled infrastructure.
Detects outbound network connections from devices to specific suspicious domains identified in the detection logic. This rule monitors for connections to 'ns2.asiainfo.it.com' and 'www.wordcheck.info', which may be indicative of malware communication, command and control, or malicious web activity.
Detects network activity associated with the SloppyRAT malware, specifically identifying C2 authentication attempts via HTTP POST requests containing specific headers and user-agent strings, as well as TLS connections to known malicious domains and IP addresses.
Detects periodic outbound HTTP POST requests consistent with C2 beaconing behavior associated with the Latrodectus malware. The rule identifies multiple POST requests occurring within a 10-minute window, a pattern often used by Latrodectus for command-and-control heartbeats.
Detects outbound TCP traffic originating from internal hosts to known command and control infrastructure associated with the SilkParasite campaign and the SpiceRAT malware family.
Detects network activity associated with the SilkParasite actor's NodeEdgeRAT malware, including DNS queries, TLS SNI, HTTP Host headers, and direct IP connections to the identified command-and-control infrastructure 'hoster-kg.com'.
Detects anomalous, high-volume file access or download activity in Microsoft SharePoint Online or OneDrive for Business originating from a 'python-httpx' user agent. This pattern often indicates automated data collection or exfiltration attempts using programmatic tools.
Detects potential ClickFix-style social engineering attacks where a victim is prompted to execute an encoded PowerShell command (often via copy-paste into a terminal). The rule specifically monitors PowerShell processes initiated by shell environments (explorer.exe, cmd.exe, or WindowsTerminal.exe) that execute encoded, hidden scripts to perform multiple suspicious network requests for files (e.g., .zip, .enc, .bin) from non-standard domains.
This rule detects instances where a process associated with a known StealC command-and-control (C2) IP address subsequently spawns a hidden cmd.exe instance. It correlates network connections to known malicious infrastructure with the creation of hidden command shells within the same device session, specifically looking for common parent processes like web browsers or system utilities.
Detects network traffic to GitHub API endpoints that matches patterns indicative of RUSTYSHADE malware communicating with a private repository for command and control. The rule specifically looks for access to repository content paths related to commands, results, heartbeats, screenshots, or information files, coupled with the inclusion of an Authorization token in the HTTP header.
This rule detects the execution of 'DriverInstaller.exe' (either by filename or a known malicious SHA256 hash) that subsequently initiates network connections to GitHub domains. This behavior is indicative of potential malicious activity, such as downloading secondary payloads, command-and-control communication, or beaconing from a suspected rogue or masquerading driver installation utility.
Detects potential C2 activity associated with MQTTDoor or MatrixDoor malware by monitoring suspicious network traffic patterns. This includes unauthorized processes connecting to MQTT brokers (hivemq.com), non-chat applications interacting with a Matrix homeserver, and geo-location lookups (ip-api.com) occurring shortly after process execution.
Detects the ClosedQuorum 'unhook' evasion technique where a process patches ntdll's EtwEventWrite to suppress ETW telemetry, occurring within a 5-minute window of the same process initiating outbound network connections to known LLM C2 provider APIs or Discord webhooks used for AI-arbitrated decision cycles.
Detects the ClosedQuorum 'unhook' evasion technique where a process patches ntdll's EtwEventWrite to suppress ETW telemetry, occurring within a 5-minute window of the same process initiating outbound network connections to known LLM C2 provider APIs or Discord webhooks used for AI-arbitrated decision cycles.
This rule detects activities associated with the AMOS (Atomic macOS Stealer) malware family by monitoring for known malicious file hashes on endpoints and network communication with domains linked to its command-and-control infrastructure.
This rule detects network traffic indicative of the SCKIT MemTensor worm establishing a command-and-control (C2) beacon. The detection identifies TLS connections where the Server Name Indication (SNI) matches a specific pattern of a 12-character hexadecimal string followed by .skyleen.fr.
This rule detects network traffic indicative of the SCKIT MemTensor worm establishing a command-and-control (C2) beacon. The detection identifies TLS connections where the Server Name Indication (SNI) matches a specific pattern of a 12-character hexadecimal string followed by .skyleen.fr.
This rule detects network traffic indicative of the SCKIT MemTensor worm establishing a command-and-control (C2) beacon. The detection identifies TLS connections where the Server Name Indication (SNI) matches a specific pattern of a 12-character hexadecimal string followed by .skyleen.fr.
Page 46 of 190