Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule detects network connections and DNS queries associated with the QTFY proxy infrastructure, including specific domains, known proxy management system IPs, and suspicious IP ranges. This behavior is indicative of command and control (C2) activity utilizing proxy services to obfuscate traffic.
This rule detects the concurrent existence of specific process names (calibre-launcher.dll or wint.exe) and a specific file (SysPr.prx) on a device, combined with network connections to a specific Cloudflare R2 bucket. This pattern is indicative of potential malware activity involving suspicious DLLs, file drop-offs, and communication with remote infrastructure.
Detects outbound TLS traffic where the Server Name Indication (SNI) matches the hardcoded domain 'ms.checrity.com', which is associated with ShadowPad backdoor activity.
Detects outbound web requests directed at public NPM mirrors and CDNs (unpkg, npmmirror, yarnpkg, jsdelivr) that contain strings matching known malicious package names associated with the 'Beamglea/ClickFix' campaign. This activity is typically indicative of a victim visiting a deceptive Cloudflare CAPTCHA phishing page designed to execute malicious scripts in the browser.
This rule detects a suspicious sequence of events where a process with a name resembling an updater (AutoUpdate.exe or au.exe) accesses a specific remote configuration file from a herokuapp.com URL, followed by the creation or modification of specific application binaries (e.g., InstaTime.exe, ffmpegsumo.dll). This pattern is indicative of a supply chain compromise or an automated software update hijacking where malicious binaries are staged to replace legitimate application components.
Detects periodic heartbeat beaconing activity to the domain 'tt.yeyoujs.com' over both encrypted TLS (SNI observation on port 9443) and DNS queries. This pattern is indicative of a command-and-control (C2) channel establishing or maintaining persistence.
Detects periodic heartbeat beaconing activity to the domain 'tt.yeyoujs.com' over both encrypted TLS (SNI observation on port 9443) and DNS queries. This pattern is indicative of a command-and-control (C2) channel establishing or maintaining persistence.
Detects network requests originating from the Netch gateway tool or similar environments, attempting to fetch auto-configuration profiles for Shadowsocks from the external domain 'www.sheng886.top' using the '/api/v1/internal/shadowsocks/auto-config' endpoint. The rule specifically matches the Go-http-client user agent, which is common in automated scripts and Go-based proxy tools.
This rule detects network traffic indicative of the PEEP Browser RAT, specifically HTTP beacons targeting the URI path '/api/commands'. It monitors for unique HTTP headers ('X-PEEP-Agent-Id', 'X-PEEP-Agent-Key') and connections to known malicious infrastructure.
Detects processes that access sensitive browser credential or cookie files (e.g., Login Data, Cookies) followed by network activity within a 10-minute window, which is a common behavior pattern of information-stealing malware such as Amatera or ACR Stealer.
Detects malicious network connections, file downloads, or process execution associated with the REVSTEALER malware campaign, which utilizes hijacked YouTube channels to distribute fake game-cheat videos that lure users into downloading 'resightloader.exe' from specific malicious domains.
Detects unauthorized devices or processes attempting to communicate with the Telegram Bot API (/sendMessage or /sendDocument) and monitors for credential-related terms within the request metadata. This often indicates the use of Telegram as a command-and-control (C2) channel for data exfiltration or credential theft.
Detects unauthorized devices or processes attempting to communicate with the Telegram Bot API (/sendMessage or /sendDocument) and monitors for credential-related terms within the request metadata. This often indicates the use of Telegram as a command-and-control (C2) channel for data exfiltration or credential theft.
Detects HVNC final payload masquerading as Windows Update Assistant, combining Firefox credential theft strings, hardcoded AV process names, and XOR-encoded C2 host configuration
Detects HVNC final payload masquerading as Windows Update Assistant, combining Firefox credential theft strings, hardcoded AV process names, and XOR-encoded C2 host configuration
Detects the download of ZIP files with filenames matching known phishing patterns associated with NFe (Nota Fiscal Eletrônica) campaigns, correlated with access to specific malicious or suspicious download URLs within a 15-minute window.
Detects execution patterns associated with 'NinjaMare' style malware, where a process masquerading as a browser (e.g., tenbrowser.exe, fireflybrowser.exe) performs an external IP geolocation lookup followed by suspicious registry or file modifications indicative of browser hijacking or extension installation within a five-minute window.
Detects network activity communicating with Google Drive domains (drive.google.com and www.googleapis.com). This rule monitors outbound traffic, which may indicate the use of Google Drive as a command-and-control (C2) channel or for unauthorized data exfiltration.
Detects network activity associated with the CurlRAT malware during its beaconing phase. The rule monitors for process command line arguments containing 'writeservice_info' or 'atd_get_system_info', which indicate the collection of system information, and correlates this with network connections that potentially transmit a ~10KB data payload characteristic of its check-in mechanism.
This rule monitors for outbound network connections to domains and IP addresses associated with known phishing, loader, and C2 infrastructure, including specific ClickFix patterns.
Detects inbound emails associated with the Mirage phishing campaign. The detection monitors for known malicious domains in sender information and URL links, as well as specific command-and-control (C2) IP addresses and URL patterns.
Page 87 of 190