Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
This rule monitors endpoint telemetry (DNS queries, network connections, file creation, and process execution) to identify matches against a predefined list of known malicious indicators, including IP addresses, domains, and file hashes (SHA256). The rule differentiates between confirmed malicious activity and low-confidence indicators, providing a prioritized view of potential threats.
Detects a network connection handshake indicating the use of Chisel, a fast TCP/UDP tunnel over HTTP, specifically identifying potential command-and-control beaconing activity.
Detects network activity related to the 'Blinder Tunnel' C2 infrastructure. The rules identify a Chisel tunnel client initiating a WebSocket handshake (identifiable by the 'chisel-v3-channel' header) to external infrastructure and a DNS lookup for a specific domain (soroshpasargad.com) identified as a relay nameserver used by the threat actor CL-STA-1178.
Detects network activity related to the 'Blinder Tunnel' C2 infrastructure. The rules identify a Chisel tunnel client initiating a WebSocket handshake (identifiable by the 'chisel-v3-channel' header) to external infrastructure and a DNS lookup for a specific domain (soroshpasargad.com) identified as a relay nameserver used by the threat actor CL-STA-1178.
Detects network activity related to the 'Blinder Tunnel' C2 infrastructure. The rules identify a Chisel tunnel client initiating a WebSocket handshake (identifiable by the 'chisel-v3-channel' header) to external infrastructure and a DNS lookup for a specific domain (soroshpasargad.com) identified as a relay nameserver used by the threat actor CL-STA-1178.
This rule detects various malicious indicators of compromise (IOCs) across multiple telemetry sources, including DNS queries, web network traffic, file executions, process creation, and email activity. It monitors for interactions with known malicious domains, URLs, file hashes, and specific sender email addresses to identify potential malware distribution or C2 activity.
Detects HTTP GET requests for AgtaBackupAgent.msi or AgtaBackupAgent.version, which are indicative of the download phase of the AgtaBackup Remote Access Trojan (RAT).
Detects network connections over port 443 to domains that have not been observed in the environment during the preceding 30-day window, specifically targeting domains with character-diversity patterns indicative of algorithmic generation rather than standard human-readable naming conventions.
This rule detects network communication attempts to a specific set of domains associated with the AgtaBackup Remote Access Trojan (RAT). It monitors DeviceNetworkEvents for outbound connections directed toward known command-and-control (C2) infrastructure used by this threat actor.
This rule detects known malicious activity including network connections to a specific C2 IP address (69.48.229.140), downloading files from specific C2 URLs, the presence of known malicious file hashes (SHA256), and communications involving specific actor-associated email addresses.
This rule performs an indicator of compromise (IOC) sweep for activities associated with the TOPHIT / VHX Harvester / @prime0 NPM typosquatting campaign. It detects known malicious C2 network connections (IPs and URLs), file artifacts (hashes) on endpoints, and suspicious email activity involving specific operator email addresses.
Detects HTTP GET requests to Backblaze B2 storage hosting specific archive files identified as payloads for the RustyShade/RustyMove malware family, often used by the APT36 threat group.
Detects HTTP traffic containing the 'User-token' header, which is indicative of command-and-control (C2) communication patterns associated with the curlRAT backdoor, often attributed to North Korean threat actors such as APT37, Lazarus, or Kimsuky.
Detects network activity associated with a malicious NPM package (typosquatting) beaconing to a known C2 server (69.48.229.140) and performing command and control operations, including command polling and data exfiltration, specifically from a Node.js environment.
This rule detects various malicious indicators including known file hashes, IP addresses, domains, and specific URLs associated with threat activity. It consolidates hits from process, file, and network telemetry to alert on potential compromise or communication with identified command-and-control (C2) infrastructure.
This rule monitors for sustained, repeated network connections from specific processes (often legitimate binaries used by the NeedyMantis group for loader activities) to known NeedyMantis-associated C2 domains. It triggers when an initiating process, associated with known loader activity, maintains a persistent communication pattern consistent with an active WebSocket C2 session.
Detects host and browser fingerprinting reconnaissance behavior associated with the Macfinger/ClickFix infection chain. The rule identifies multiple disparate indicators (ClickFix tracker domain, ipinfo.io geolocation lookups, and known AMOS C2 IP contact) occurring on the same device within a 15-minute window, effectively reducing noise from isolated or benign network lookups.
Detects various indicators of compromise (IOCs) including known malicious file hashes, suspicious file names commonly associated with staging or initialization in web directories, and network communication to known malicious domains or URLs. It also monitors process execution command lines for references to these IOCs, excluding common browser processes.
This rule detects potential post-exploitation activity where a web server process spawns a command shell, executes system discovery commands, and immediately initiates an outbound network connection. This behavior is indicative of a web-based exploit leading to interactive command execution and subsequent C2 communication.
This rule detects activity involving known malicious indicators of compromise (IOCs), including specific IP addresses, domains, and file hashes. It monitors network connections, file system activity, process execution, and email attachments, filtering out common security tools to reduce noise.
This rule detects potential persistence via scheduled tasks that masquerade as legitimate network components (e.g., 'System Health Monitor'), as well as abnormal use of WebDav via rundll32.exe or net.exe in the context of the Star Blizzard (COLDRIVER) campaign. It monitors for task creation/updates, schtasks command lines, registry artifacts related to task scheduling, and suspicious WebDav network utility usage, while excluding common security tool processes.
Page 9 of 190