Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects DNS resolution and subsequent TLS connection to the ACRStealer Telegram-based Dead Drop Resolver domain (res.explicittweak.cc), used to fetch C2 configuration via Telegram's IP range.
Detects a DNS query for diagrtrack.com, a typosquat of Windows DiagTrack registered to serve as this backdoor's C2 infrastructure (dormant since early 2021).
Detects network activity associated with the TWINLOOT malware, identifying command-and-control communication through TLS ALPN, custom HTTP User-Agent strings, and specific SNI values for known C2 infrastructure.
KQL Query
Detects execution of RClone from non-standard directories or outbound transfer to cloud endpoints outside an approved destination list, consistent with Gunra's pre-encryption data-exfiltration tooling.
This rule detects high volumes of network traffic originating from processes other than common web browsers (chrome, msedge, firefox) to specific edge computing and logging infrastructure (ingest.sentry.io, workers.dev, pages.dev). This behavior is indicative of non-browser processes, potentially malicious implants or scripts, using legitimate cloud-based edge services as command-and-control (C2) infrastructure or for data exfiltration.
This rule identifies network connections using deprecated, insecure TLS versions (TLS 1.0, 1.1) or weak cipher suites (RC4, 3DES, NULL). The use of these legacy cryptographic protocols is a security risk, as they are vulnerable to various attacks like man-in-the-middle, and may indicate misconfigured servers, legacy infrastructure, or attempts by an adversary to downgrade encryption to facilitate traffic interception or inspection.
This rule detects high volumes of network traffic originating from processes other than common web browsers (chrome, msedge, firefox) to specific edge computing and logging infrastructure (ingest.sentry.io, workers.dev, pages.dev). This behavior is indicative of non-browser processes, potentially malicious implants or scripts, using legitimate cloud-based edge services as command-and-control (C2) infrastructure or for data exfiltration.
Detects the exact watering-hole script fetch (fonts.chrorne[.]com /dist/js/*.chunk.js) injected into shared government webmail installations, which opens a WebSocket back to Jewelbug C2 and exfiltrates session cookies and usernames.
This rule identifies network connections using deprecated, insecure TLS versions (TLS 1.0, 1.1) or weak cipher suites (RC4, 3DES, NULL). The use of these legacy cryptographic protocols is a security risk, as they are vulnerable to various attacks like man-in-the-middle, and may indicate misconfigured servers, legacy infrastructure, or attempts by an adversary to downgrade encryption to facilitate traffic interception or inspection.
Detects execution of the SimpleChatProxy/'Chat Proxy' tool correlated with outbound traffic to an attacker-hosted image endpoint, used for operator-victim messaging and remote screenshot retrieval.
Detects Shai-Hulud / ChainDrop activity by correlating known malicious hashes, npm/Node/Bun execution, payload artifacts, IDE persistence, credential discovery, cloud metadata access, GitHub exfiltration, C2 domains, Ethereum RPC activity, staging files, persistence artifacts, and known IOC IP connections.
Detects network activity associated with the BumbleBee malware, including domain-generation algorithm (DGA) pattern matches within TLS Server Name Indication (SNI) fields and direct connections to known C2 infrastructure IP addresses over HTTPS.
KQL Query
This rule monitors DeviceNetworkEvents for outbound connections to specific known malicious IP addresses (31.97.137.157 and 46.183.25.232) on port 45000, or connections to the domain 'bet.slotgambit.com'. These indicators are consistent with command and control (C2) activity.
Correlates network connections to known OnyxC2 C2/delivery domains and Cloudflare-fronted IPs with the malware's sideloaded-process indicators to detect delivery and command-and-control traffic.
Detects curl POSTing hardcoded username/password-style credentials to a /login endpoint on a known tunnel domain (ngrok, Cloudflare Quick Tunnel, or localhost.run), indicating credential submission to an attacker-exposed tunnel endpoint.
Detects a 32-byte ICMP echo request carrying the backdoor's 8-byte bot ID, explicitly excluding the standard Windows ping.exe payload pattern (the dominant legitimate traffic at this size) and rate-limited to reduce alert volume.
Detects HTTP GET requests to a specific Cloudflare Workers domain ('is-01-ast.ols-img-12.workers.dev') used for msaRAT WebRTC signaling, characterized by the presence of spoofed 'Origin' and 'Referer' headers pointing to 'microsoft.com' alongside a 'HeadlessChrome' user agent, indicating malicious command-and-control behavior.
Detects outbound network connections initiated by a process identifying itself as 'HeadlessChrome' within the User-Agent string. This behavior is indicative of a headless browser being misused as a proxy for Command and Control (C2) communication, as observed in msaRAT infections.
Detects Abyssos RAT C2 traffic via its literal HELLO|...|v2.4F registration banner combined with an AES-GCM-sized payload to two known hardcoded C2 IPs.
Page 96 of 190