Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,989 detections
Filters
Last updated
All Time
Detection languages
1,774
868
397
195
188
Contributors
1,070
924
756
221
96
Categories
2,448
1,307
1,164
785
713
Platforms
2,415
1,310
658
528
133
Products / Services
1,307
886
808
561
337
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
3,989
CVEs
6
5
5
5
5
IDS Classtypes
564
275
11
8
6
IDS Protocols
537
174
64
64
12
Detects dual remote-access activity initiated by PowerShell. The rule tracks two behaviors: the installation of an UltraVNC server listener on ports 5800/5900, and PowerShell-spawned executables dropped into common user-writable directories (Temp, AppData, etc.) establishing network connections to known Larva-24009 C2 infrastructure.
Detects a specific fingerprinting activity by the ClickFix Traffic Direction System (TDS) within HTTP POST request bodies. The rule identifies the combination of 'mode:php', a 'MacIntel' platform string (spoof-check), and WebGL rendering fields ('webglVendor', 'webglRenderer') in a JSON-encoded body, which is characteristic of the macOS ClickFix infostealer campaign delivery.
Persistent multi-day exfil retry with per-package tracking ID beacon
Detects a settings.json (editor settings/telemetry opt-out) file read followed within a 30-second window by network transmission from the same host, a pattern consistent with the Open VSX 'evil twin' extension campaign in which extensions read local developer configuration/telemetry preference files and then exfiltrate the harvested data over the network.
Detects network connections to uncommon or suspicious top-level domains (TLDs) initiated by processes other than standard web browsers. The rule filters out known browser processes and analyzes network traffic patterns, including connection count and prevalence across the fleet, to identify potentially anomalous or malicious C2 activity.
Detects HTTP requests to a Cloudflare Workers subdomain
(*.workers.dev) targeting the /token/v1/{UID} signaling endpoint, originating from a headless Chrome user agent. Chaos ransomware's msaRAT offloads all C2 signaling to the browser via CDP-injected JavaScript, performing WebRTC SDP
Offer/Answer exchange through this trusted developer platform to evade domain reputation blocking.
(*.workers.dev) targeting the /token/v1/{UID} signaling endpoint, originating from a headless Chrome user agent. Chaos ransomware's msaRAT offloads all C2 signaling to the browser via CDP-injected JavaScript, performing WebRTC SDP
Offer/Answer exchange through this trusted developer platform to evade domain reputation blocking.
Detects network, process, and file activity referencing the specific hard-coded VAPID public key used by SNOWBELT in the UNC6692/Edgecution campaign for push-notification-based registration, correlating browser extension file drops (background.js, extension.log) with the key's appearance in network traffic or process command lines.
This rule detects the execution of the Cloudflare Tunnel utility (cloudflared.exe) or similarly named binaries from non-standard, suspicious locations like temporary directories or public user folders. This pattern is commonly used by attackers to establish unauthorized persistent network tunnels (reverse proxies) into the victim's environment, bypassing firewall restrictions.
Detects instances where a Python interpreter (python.exe/pythonw.exe) or an executable file launched from temporary, roaming, or public directories initiates an outbound network connection to common C2/high-risk ports. This behavior is indicative of potential malware staging or C2 communication from obfuscated or temporary locations.
This rule detects anomalous patterns of Microsoft Graph API activity involving the /calendar, /events, and /calendarView endpoints. It identifies application identities performing high-frequency create (POST/PATCH) and read (GET) operations within a short time window. This behavior is indicative of a compromised mailbox being used as a C2 dead-drop channel, where the calendar is used to exchange commands and results between the adversary and the compromised environment.
Detects DNS queries to mangorbit.com and its subdomains, C2 infrastructure associated with the Open VSX Evil Twin extensions campaign
Detects installation of malicious "evil twin" Open VSX extensions impersonating AMD, Azure, or Salesforce that carry the tell-tale version 0.0.1 or 0.0.2, identified via file creation/write events in VS Code / Open VSX extension directories.
TOKYOCORE RansomAgent User-Agent HTTP Traffic to Public File Hosting Service
Detects DNS/TLS/IP traffic to known CaptiveCrunch AitM doppelganger domains and C2/redirect IP infrastructure via exact-match indicators.
Detects direct, unproxied outbound TLS traffic from a scoped server/DMZ network segment to the DeepSeek or Aliyun DashScope LLM APIs at a repeated rate, indicative of Hermes Agent autonomous attack orchestration.
Detects HTTP traffic to the hardcoded Heroku-hosted SNOWGLAZE C2 endpoint (sad4w7h913-b4a57f9c36eb.herokuapp.com) where the client requests a WebSocket upgrade on the /ws URI and sends a JSON body containing login, password, and uuid fields used to authenticate the tunnel to the actor's C2 infrastructure.
This rule detects the execution of the Cloudflare Tunnel utility (cloudflared.exe) or similarly named binaries from non-standard, suspicious locations like temporary directories or public user folders. This pattern is commonly used by attackers to establish unauthorized persistent network tunnels (reverse proxies) into the victim's environment, bypassing firewall restrictions.
Outbound HTTP exfiltration to mangorbit.com C2 subdomains
Larva-24009 HeptaX C2 beacon to shared infrastructure (get-command/index/new-upload/post_proc)
TLS beaconing to disposable AMOS distribution/redirector domain
This rule detects DNS queries, HTTP Host headers, and TLS SNI values indicative of interaction with specific doppelganger domains designed to impersonate Microsoft online services (ms365-device.com, ms365-live.com, m365-owa.com, owa-ms365.com). Such activity is commonly associated with phishing or C2 infrastructure targeting Microsoft 365 environments.
Page 99 of 190