Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects outbound network connections initiated by the 'build-script-build' executable, which is the compiled output of a Rust 'build.rs' script. While legitimate build scripts may fetch dependencies, unexpected network activity from this process could indicate malicious code injection during the build process, such as a software supply chain attack attempting to download secondary payloads.
Detects the loading of the msaRAT 'lib.dll' malicious module into Google Chrome or Microsoft Edge browser processes. This DLL is used to facilitate encrypted C2 communication, specifically performing ECDH key exchange and ChaCha-Poly1305 encryption on top of WebRTC DataChannel traffic.
Detects network traffic patterns associated with the msaRAT remote access trojan, specifically identifying suspicious WebRTC DataChannel creation, binary data handling, and custom window messaging bindings used for command-and-control communication.
Detects HTTP traffic communicating with known domains (grove-12.com and trekmesh15.com) associated with the Codex ClickFix/AMOS campaign, specifically looking for indicators of payload staging or beaconing activity through specific URI patterns.
Detects DNS queries to Cloudflare Workers subdomains that mimic the QUICAgent beaconing pattern. Adversaries utilize these workers as dead-drop resolvers to retrieve updated C2 instructions or redirection information, effectively blending in with legitimate traffic to the workers.dev domain.
Detects network traffic consistent with SynkLoader malware communicating with its C2 infrastructure. The rule identifies suspicious TLS SNI requests to known hardcoded domains and HTTP POST requests using the application/octet-stream content type, which are characteristic of SynkLoader C2 beaconing.
Detection rule for a specific Rust-based Windows x64 backdoor known as C2Looper. The rule uses file hashes, debug strings, hardcoded configuration files/paths, and specific C2 API endpoints to identify the malware presence.
Detects outbound HTTP POST requests with a specific URI pattern associated with C2Looper malware communication, indicating potential C2 activity or data exfiltration.
This rule monitors outgoing HTTP traffic for a specific numeric URI path pattern ( /49890878) which is characteristic of beaconing behavior to a command-and-control (C2) server. Such static, non-descriptive URI paths are frequently used by malware to maintain consistent connectivity to an adversary-controlled infrastructure.
This rule detects suspicious network connections to GitHub and Postimg where specific assets are retrieved by a non-browser User Agent. This behavior is associated with the TWINLOOT campaign, where a Python-based implant retrieves fake loading-screen assets as part of a C2 communication sequence, utilizing legitimate image and video hosting services as dead-drop resolvers.
Detects outbound network traffic from internal hosts to known command-and-control (C2) server IP addresses associated with C2Looper malware on port 8888.
Detects periodic (beaconing) HTTP POST requests directed to '/api/beacon' from endpoints. The detection logic monitors for consecutive connections occurring within a 3-second interval, specifically searching for JSON payloads containing identification fields (id, user, host, pid) characteristic of C2Looper backdoor traffic.
Detects outbound connections to the known Rust supply-chain C2 infrastructure, plus a lower-confidence rule for the broader Hostwinds range on port 9089.
Detects periodic beaconing and configuration polling by the TWINLOOT implant using Azure Blob Storage as a dead-drop mechanism. The rules identify specific TLS SNI patterns and HTTP requests for 'cfg.json' files hosted on Azure Blob storage using non-browser user-agents.
This rule detects browser-based runtime evaluations that utilize WebRTC's RTCPeerConnection and createDataChannel APIs, often indicative of an adversary attempting to establish a covert command-and-control (C2) channel directly from a compromised browser session.
Detects the StopAndProtect two-stage PowerShell chain: stage 1 downloads/executes stage 2, which reflectively loads a base64-encoded .NET assembly and invokes an Execute method.
This rule detects a multi-stage attack pattern associated with Akira ransomware, including AD enumeration using PowerShell, data staging with WinRAR, S3 exfiltration via s5cmd, AnyDesk service installation, registry manipulation for persistence via Safe Mode, and boot configuration changes to facilitate EDR bypass. It also incorporates detection for specific IOCs like attacker jump host RDP connections and malicious file hashes.
Attackers began actively exploiting CVE-2026-63030 and CVE-2026-60137 in WordPress Core in July 2026. The vulnerabilities involve the WordPress REST API batch-processing functionality and were used to deploy persistent web shells and malicious plugins. WordPress subsequently released fixes in versions 7.0.2, 6.9.5 and 6.8.6.
Detects network activity (DNS queries and TLS connections) to the known command-and-control (C2) domain 'vm180012.hosted-by.qwins.co' associated with the PureLogs Stealer malware.
Detects the botking RAT's C2 beacon: HTTPS POST with the 'i am botking' registration marker and form-urlencoded action=check polling, plus associated TLS/DNS indicators.
Detects malicious JavaScript injection attempts by msaRAT that leverage the Chrome DevTools Protocol (CDP) Runtime.evaluate method. The malware attempts to execute specific code snippets to facilitate flow-controlled data transfers over WebRTC DataChannels using Base64ToArrayBuffer conversions and a 24KB buffer threshold.
Page 94 of 190