Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects the specific execution pattern associated with CurlRAT, where common Linux daemons (crond, atd, agetty, polkitd) perform an outbound network connection and subsequently spawn an interactive shell (sh, bash, dash) as the root user within a 5-minute window.
Detects anomalous network connections to the local Chrome DevTools Protocol (CDP) debugging interface (127.0.0.1) associated with suspicious commands or function calls. This pattern is indicative of msaRAT malware attempting to perform process injection, bypass Content Security Policy (CSP), or execute code within a target browser process.
Detects network connections, DNS resolutions, or TLS SNI values matching known TWINLOOT command-and-control infrastructure, including the attacker-registered domains sharepointx.th2ch.com and lpi-web.com and the failover IP 193.24.211.221. TWINLOOT is a modular Python implant that hides its C2 inside trusted Microsoft cloud services (Graph API, SharePoint Online, Teams TURN relay) while also relying on dedicated attacker-controlled infrastructure for direct TLS/WebSocket tunneling and failover.
Detects periodic outbound TLS connections over port 443 exhibiting beaconing behavior (5+ established connections with a non-empty SNI from a source host within 300 seconds), consistent with BridgeAgent malware C2 heartbeat/reverse-shell maintenance. Correlate with EDR detections of a process masquerading as /usr/bin/gnome-shell running as root and persisted via a fraudulent zabbix_agent.service.
Detects Microsoft Edge being launched in a headless state with remote debugging enabled, hidden window dimensions, and a specific temporary user data directory naming convention. This pattern is characteristic of the TWINLOOT technique, where an adversary controls a headless browser via the Chrome DevTools Protocol (CDP) to conduct C2 communications and data exfiltration through legitimate Microsoft Graph API endpoints, effectively blending malicious traffic with normal browser activity.
Detects domain fronting abuse of Cloudflare CDN where the TLS SNI (outer front domain) differs from the inner HTTP Host header actually requested, a technique used to smuggle C2 traffic behind a trusted Cloudflare-fronted domain
Detects the execution of pythonw.exe, which is used as a host process for the SynkLoader RAT, initiating outbound network connections to identified adversary-controlled C2 domains. This behavior is indicative of an established command-and-control channel for command retrieval and data exfiltration.
Detects outbound HTTP POST requests characterized by an 'application/octet-stream' content type, a specific URI structure consisting of three components (20-40 characters, alpha-numeric, 20-40 characters), and an encrypted payload. This behavioral pattern is associated with SynkLoader malware command-and-control (C2) communications.
Detects C2Looper v1 malware communication patterns, specifically plaintext HTTP beaconing to /api/beacon or /api/result endpoints with characteristic JSON body fields (id, user, host, pid, cmd, arg, seq), as well as direct network connections to known C2Looper command-and-control infrastructure on TCP port 8888.
This rule monitors network connections for traffic directed towards domains and IP addresses associated with a known malicious campaign distributing fake VPN browser extensions, as identified by Socket.dev. These domains and IPs are used for command and control or malicious communication by the browser extensions.
Detects msedge.exe launched headless (--headless / --headless=new) with CDP remote debugging enabled (--remote-debugging-port=), a temp profile directory matching the launcher-edge- naming pattern, and window flags positioning it off-screen (--window-position=-32000,-32000, --window-size=1,1). This combination matches the TWINLOOT implant's technique of spawning a headless Edge instance with a Chrome DevTools Protocol connection, using the browser's authenticated same-origin session to proxy Microsoft Graph API C2 traffic so it blends in with legitimate browser network activity while remaining invisible on-screen. Excludes known browser-automation/CI framework parent processes and the --enable-automation flag to reduce false positives.
references:
- https://detections.ai/inspirations/01a01ade-da64-7718-8281-426118171583
- https://detections.ai/inspirations/01a01ade-d9a6-742d-8e2f-f60b5efce416
- https://detections.ai/inspirations/01a01ade-da04-700d-ba14-769eef28e475
- https://github.com/ontinue-research/threat-intel-iocs/blob/main/Public/2026-07-27-TWINLOOT-IOCs.md
- https://www.ontinue.com/resource/python-implant-hiding-its-entire-c2-inside-microsoft-365-azure/
references:
- https://detections.ai/inspirations/01a01ade-da64-7718-8281-426118171583
- https://detections.ai/inspirations/01a01ade-d9a6-742d-8e2f-f60b5efce416
- https://detections.ai/inspirations/01a01ade-da04-700d-ba14-769eef28e475
- https://github.com/ontinue-research/threat-intel-iocs/blob/main/Public/2026-07-27-TWINLOOT-IOCs.md
- https://www.ontinue.com/resource/python-implant-hiding-its-entire-c2-inside-microsoft-365-azure/
Detects unauthorized, non-browser processes accessing sensitive Chromium-based browser credential files (e.g., 'Local State', 'Login Data', 'Cookies') followed by suspicious outbound network connections. This pattern is characteristic of credential-stealing malware (infostealers) like Amatera, Lumma, and Remus.
Detects outbound HTTP traffic indicative of pyCodeVx RAT check-in behavior. The rule identifies communication with ddnsfree.com C2 domains or requests containing the 'pyCodeVx' marker in the URL or User-Agent, coupled with a base64-encoded, fixed-format victim/session ID.
MacSync Stealer (formerly known as Mac.c) is a macOS information stealer offered as a Malware-as-a-Service (MaaS). On May 5, 2026, researchers identified a new C2 domain (jacksonvillemma[.]com) delivering the malware's Stage 2 loader. Notably, this new infrastructure was active just days after the operator's previous C2 domain was publicly exposed, highlighting the threat actor's agility in rotating their delivery architecture.
Detects network traffic consistent with the ClickFix macOS loader, specifically identifying POST requests containing 'event=pasted' and a 'BuildID' header, which are indicative of a beaconing or telemetry heartbeat.
This rule detects QUIC network traffic where the TLS certificate subject and issuer match specific patterns associated with 'RAT System' and 'RAT CA'. This signature indicates potential command-and-control (C2) communication utilizing self-signed certificates for authentication pinning in an attempt to masquerade or secure malicious traffic.
This rule detects a multi-stage attack pattern associated with Akira ransomware, including AD enumeration using PowerShell, data staging with WinRAR, S3 exfiltration via s5cmd, AnyDesk service installation, registry manipulation for persistence via Safe Mode, and boot configuration changes to facilitate EDR bypass. It also incorporates detection for specific IOCs like attacker jump host RDP connections and malicious file hashes.
Detects outbound network connections from internal hosts to known IP addresses associated with Dark Caracal's GoCaracal malware command and control infrastructure.
Detects an AI agent sandbox exfiltrating harvested PII/session context by embedding it as an x-auth-token query parameter in an outbound HTTP request to an external host — the network-observable exfiltration stage of Cryptographic Context Injection.
Detects DNS resolution and outbound network connection attempts to the hardcoded C2 domain 'aroclenetapp.net' associated with the SynkLoader StreamMaster reverse VNC module. This module is used to exfiltrate screenshots and capture keyboard/mouse input.
Detects outbound HTTP POST requests to known SynkLoader C2 domains or URI patterns, characterized by 'application/octet-stream' Content-Type headers. The rule targets specific hardcoded domains used by the malware and a suspicious nested URI path pattern commonly associated with its beaconing behavior.
Page 93 of 190