Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects outbound network communication from common web browsers (chrome.exe, msedge.exe) to a specific malicious domain and path associated with suspected Kremlin-linked screenshot exfiltration activities.
Detects a two-stage pattern indicative of command-and-control (C2) communication. The rule identifies an initial request to a 'relays.json' endpoint (relay discovery) followed by a request to an 'api.php' endpoint (dispatcher decision) within a 5-second window, both using a 13-digit timestamp query string for cache-busting. It also captures single-stage 'api.php' requests as lower confidence alerts.
Detects network, HTTP, and DNS activity associated with the known three-tier delivery infrastructure (phishing sites, relay/dispatcher servers, and payload hosts) used by the threat actor UNC6671/SilverFox/Aurora. The rule distinguishes between high-confidence confirmed connections and low-confidence DNS-only events.
Detects network, HTTP, and DNS activity associated with the known three-tier delivery infrastructure (phishing sites, relay/dispatcher servers, and payload hosts) used by the threat actor UNC6671/SilverFox/Aurora. The rule distinguishes between high-confidence confirmed connections and low-confidence DNS-only events.
Detects network, HTTP, and DNS activity associated with the known three-tier delivery infrastructure (phishing sites, relay/dispatcher servers, and payload hosts) used by the threat actor UNC6671/SilverFox/Aurora. The rule distinguishes between high-confidence confirmed connections and low-confidence DNS-only events.
Detects incoming HTTP GET requests targeting known API endpoints associated with the GhostCode phishing kit. These endpoints (/api/harvester) are used by the phishing kit to poll for session details, device codes, or flow identifiers, characteristic of credential harvesting operations.
Detects network activity and HTTP traffic associated with the Iron Man System kit, specifically targeting hardcoded C2 infrastructure (IP-based) and lure domain patterns involving specific brand tokens combined with disposable TLDs.
Detects outbound connections to and inbound responses from known command-and-control infrastructure associated with the SpiceRAT malware, as part of the SilkParasite campaign. This rule monitors established TCP traffic on ports 80 and 443.
This rule detects potential data exfiltration by monitoring for screen capture activity, identified by API calls like BitBlt or CopyFromScreen or the loading of gdi32.dll, followed by the creation of a screenshot file and subsequent network connections to GitHub domains.
Detects the execution of a scheduled task named 'MicrosoftEdgeUpdateTaskUserS-1-5-24' which triggers conhost.exe with the --headless argument or PowerShell with an EncodedCommand. This behavior is indicative of a malicious persistence mechanism masquerading as a legitimate Edge update task, specifically associated with the retrieval of payloads from the malicious domain 'indiatodays.org'.
This rule detects HTTP traffic patterns consistent with a Golang-based Remote Access Trojan (RAT) beaconing to a command and control (C2) server. It monitors for specific fitness-themed URI paths used for C2 communication and identifies the use of a hardcoded domain ('monitorondomainwintgt') within both the HTTP Host header and the TLS SNI field.
Detects outbound network traffic to the GitHub API, a known communication channel for the RUSTYSHADE malware and APT36 (Transparent Tribe) threat group, occurring outside of a previously observed operational cadence (weekdays 04:00-11:00 UTC). Deviations from this baseline pattern on weekends or off-hours suggest unauthorized C2 activity or changes in actor infrastructure.
Detects network traffic to known Transparent Tribe (APT36) C2 IP addresses and DNS resolution attempts for their associated command and control domains. This rule monitors for communication with identified malicious infrastructure often used by the group for C2 activity.
Detects network beaconing activity associated with Transparent Tribe (APT36) Golang-based remote access trojans (RAT). The rule identifies specific HTTP POST requests to suspicious domains and URI paths ('/api/gym-facility', '/api/gym-membership') that mimic legitimate fitness-related traffic to blend in with environment noise.
Detects DNS queries and HTTP GET requests directed at known typosquatted domains associated with the APT36 (Transparent Tribe) threat group, which are utilized for payload staging and delivery.
Detects the execution of processes named 'DriverInstaller.exe' or 'Automata-20.exe', the invocation of cmd.exe as a child process of these executables, or network requests originating from these processes to GitHub API and raw content endpoints. This pattern is indicative of potential initial access, tool staging, or malicious payload retrieval.
Detects potential command and control (C2) beaconing activity to GitHub repository API endpoints. The rule monitors for a high frequency of requests to specific file names commonly associated with C2 payloads (e.g., command.txt, results.txt, heartbeat.txt) and employs statistical analysis to identify consistent, non-random connection patterns that deviate from expected business usage.
Detects network activity associated with the RUSTYSHADE malware, specifically identifying the 'HCENC1:' prefix used in HTTP requests to encapsulate AES-256-GCM encrypted command and control traffic directed towards GitHub API channels.
Detects a Golang-based remote access trojan (RAT) attributed to the Transparent Tribe (APT36) threat group. The rule identifies the malware based on distinctive fitness-themed C2 API endpoints, specific function names, hardcoded authentication secrets, and embedded Go runtime markers, while also monitoring for associated persistence registry keys and file paths.
This rule detects suspicious outbound HTTP POST requests to a specific domain ('monitorondomainwintgt') containing known API endpoints ('/api/gym-facility', '/api/gym-membership', '/api/coach-instructions') often used by Golang-based Remote Access Trojans (RATs) for command-and-control communication.
Detects network activity (DNS, TLS SNI, and direct TCP connections) associated with the Transparent Tribe threat group's command-and-control infrastructure, specifically targeting the domain 'sharema128.net' and its associated IP address.
Page 68 of 190