Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects outbound network traffic from internal hosts to known ClickFix campaign command-and-control infrastructure, identified by specific malicious domains (grandenoid.org, mootornot.com) and associated IP addresses.
This rule detects the execution or presence of specific Go or Terraform modules known to be malicious or associated with suspicious dependency retrieval. It monitors command-line activity from terraform.exe/go.exe attempting to download/run from these paths, as well as file system events involving these specific folder paths and filenames.
This rule detects the execution or presence of specific Go or Terraform modules known to be malicious or associated with suspicious dependency retrieval. It monitors command-line activity from terraform.exe/go.exe attempting to download/run from these paths, as well as file system events involving these specific folder paths and filenames.
This rule detects the execution or presence of specific Go or Terraform modules known to be malicious or associated with suspicious dependency retrieval. It monitors command-line activity from terraform.exe/go.exe attempting to download/run from these paths, as well as file system events involving these specific folder paths and filenames.
This rule detects the execution or presence of specific Go or Terraform modules known to be malicious or associated with suspicious dependency retrieval. It monitors command-line activity from terraform.exe/go.exe attempting to download/run from these paths, as well as file system events involving these specific folder paths and filenames.
This rule detects potential malicious activity by correlating device events against a known set of malicious file hashes, domains, and URLs. It identifies files with known malicious hashes, network connections to known malicious domains, and command-line processes attempting to download files from known malicious URLs using common living-off-the-land tools like PowerShell, curl, or wget.
This rule monitors for network connections to known malicious domains or IP addresses, and for the presence or execution of files with known malicious file hashes (MD5, SHA1, SHA256). It consolidates detections from network traffic, file events, and process execution logs over a 30-day lookback period.
This rule monitors for network connections to known malicious domains or IP addresses, and for the presence or execution of files with known malicious file hashes (MD5, SHA1, SHA256). It consolidates detections from network traffic, file events, and process execution logs over a 30-day lookback period.
This rule monitors for network connections to known malicious domains or IP addresses, and for the presence or execution of files with known malicious file hashes (MD5, SHA1, SHA256). It consolidates detections from network traffic, file events, and process execution logs over a 30-day lookback period.
Detects network activity associated with a VBScript-based dropper attempting to retrieve payloads from known malicious infrastructure (cdn.imageurlgenerator.com) or abusing legitimate file hosting services (filemail.com) to bypass traditional security filters.
Detects network activity associated with the ORAX control-plane panel and management service. The rule identifies HTTP traffic containing OraxManage or OraxRDP service strings, SignalR negotiate handshakes directed to common ORAX management ports, and connections to identified ORAX C2 infrastructure domains and IP addresses.
Detects a suspicious multi-stage PowerShell execution pattern where an initial process, such as explorer.exe or common loaders, invokes PowerShell with obfuscated or download-related flags (e.g., -enc, IEX, DownloadString), followed immediately by a child PowerShell process performing further download or network operations within a short time window.
Detects network activity associated with the SilkParasite botnet. The rule identifies inbound/outbound HTTP heartbeat check-ins using a specific URI pattern (/ping?h=) and direct TCP connections to a known malicious C2 IP address.
Detects network activity associated with the Psychedelic Stealer malware command-and-control (C2) communication patterns. The rule identifies specific API endpoints used for task polling, heartbeat pings, check-ins, and task acknowledgement, as well as connections to a known malicious C2 infrastructure, all characterized by the presence of a specific 'X-API-Key' header.
Detects network communication to domains and specific file paths associated with the MacSync macOS stealer, which is used for malware dropper delivery and command-and-control (C2) operations. The rule monitors DeviceNetworkEvents for indicators such as specific malicious URLs, iCloud path abuse, and C2 infrastructure interaction.
This rule identifies potential activity related to the Kothamine malware by monitoring for specific file hashes associated with the malware in process and file execution events, as well as network connections to a specific malicious GitHub repository path used for payload delivery.
This rule detects unauthorized downloads of Tailscale VPN client binaries or related dependencies (such as wintun.dll) originating from a specific GitHub repository ('cphc811-ui'). Such activity is often associated with the Kothamine threat actor attempting to establish unauthorized remote access or command-and-control channels by provisioning VPN software on compromised hosts.
This rule detects unauthorized downloads of Tailscale VPN client binaries or related dependencies (such as wintun.dll) originating from a specific GitHub repository ('cphc811-ui'). Such activity is often associated with the Kothamine threat actor attempting to establish unauthorized remote access or command-and-control channels by provisioning VPN software on compromised hosts.
This rule detects unauthorized downloads of Tailscale VPN client binaries or related dependencies (such as wintun.dll) originating from a specific GitHub repository ('cphc811-ui'). Such activity is often associated with the Kothamine threat actor attempting to establish unauthorized remote access or command-and-control channels by provisioning VPN software on compromised hosts.
This rule detects unauthorized downloads of Tailscale VPN client binaries or related dependencies (such as wintun.dll) originating from a specific GitHub repository ('cphc811-ui'). Such activity is often associated with the Kothamine threat actor attempting to establish unauthorized remote access or command-and-control channels by provisioning VPN software on compromised hosts.
Detects Hancom HWP documents that contain an OLE BIN0001.OLE stream and specific JScript storage structures, which are indicative of a weaponized document used to execute scripts and fetch remote payloads from a specific command-and-control URL.
Page 26 of 121