Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects network, HTTP, and DNS activity associated with the known three-tier delivery infrastructure (phishing sites, relay/dispatcher servers, and payload hosts) used by the threat actor UNC6671/SilverFox/Aurora. The rule distinguishes between high-confidence confirmed connections and low-confidence DNS-only events.
This rule detects the sequence of an external file download over HTTP, followed by the immediate creation and execution of an executable file (.exe, .dll, .scr) on the endpoint. It specifically filters out common system installers (e.g., msiexec.exe, trustedinstaller.exe) to reduce noise, focusing on potentially malicious payloads delivered via network channels.
Detects outbound connections to and inbound responses from known command-and-control infrastructure associated with the SpiceRAT malware, as part of the SilkParasite campaign. This rule monitors established TCP traffic on ports 80 and 443.
Detects network traffic to known Transparent Tribe (APT36) C2 IP addresses and DNS resolution attempts for their associated command and control domains. This rule monitors for communication with identified malicious infrastructure often used by the group for C2 activity.
Detects the execution of processes named 'DriverInstaller.exe' or 'Automata-20.exe', the invocation of cmd.exe as a child process of these executables, or network requests originating from these processes to GitHub API and raw content endpoints. This pattern is indicative of potential initial access, tool staging, or malicious payload retrieval.
Detects potential command and control (C2) beaconing activity to GitHub repository API endpoints. The rule monitors for a high frequency of requests to specific file names commonly associated with C2 payloads (e.g., command.txt, results.txt, heartbeat.txt) and employs statistical analysis to identify consistent, non-random connection patterns that deviate from expected business usage.
Detects execution of APT36's RUSTYSHADE backdoor, typically delivered via a DriverInstaller executable or zip file, and specifically tracks downloads from Backblaze B2 storage buckets using PowerShell.
Detects malicious scheduled task creation using names intended to mimic Microsoft Edge update tasks. The rule identifies suspicious process activity including the spawning of conhost.exe with headless flags, PowerShell commands with encoded arguments, and attempts to fetch external scripts from the known malicious typosquatted domain indiatodays.org, all of which are characteristic of APT36 (Transparent Tribe) activity.
Detects the historical HPlus HTS fraud infrastructure chain. The rule monitors for the reading of a configuration file named 'config.Ini', followed by an outbound FTP connection (port 21), and the subsequent launch of an executable, which is indicative of a Quasar RAT deployment sequence.
This rule detects suspicious outbound HTTP POST requests to a specific domain ('monitorondomainwintgt') containing known API endpoints ('/api/gym-facility', '/api/gym-membership', '/api/coach-instructions') often used by Golang-based Remote Access Trojans (RATs) for command-and-control communication.
Detects network activity (DNS, TLS SNI, and direct TCP connections) associated with the Transparent Tribe threat group's command-and-control infrastructure, specifically targeting the domain 'sharema128.net' and its associated IP address.
Detects macOS shell processes (bash/sh/zsh) executing curl to fetch portable Python bootstrap files from known indicators associated with CRPx0/ClickFix campaigns. This typically involves downloading python-build-standalone environments or staging scripts from external endpoints.
This rule detects network connections or process command lines associated with known malicious domains, IP addresses, or payload URLs. Additionally, it correlates connections to common public file-sharing platforms or APIs (e.g., Gofile, Telegram) if these events occur on the same device within a 60-minute window of a confirmed malicious infrastructure event, reducing false positives from legitimate uses of shared infrastructure.
This rule detects network connections or process command lines associated with known malicious domains, IP addresses, or payload URLs. Additionally, it correlates connections to common public file-sharing platforms or APIs (e.g., Gofile, Telegram) if these events occur on the same device within a 60-minute window of a confirmed malicious infrastructure event, reducing false positives from legitimate uses of shared infrastructure.
Detects the use of PowerShell's 'WriteAllBytes' method to write a file to the user's Local AppData Temp directory, immediately followed by the creation of a known or suspicious executable file in that same location. This pattern is commonly indicative of a stage in a fileless-style malware attack or automated payload delivery.
This rule monitors for indicators of compromise (IOCs) associated with a specific AutoIT-based malware delivery chain. It tracks the execution and presence of specific malicious file names and SHA256 hashes, as well as network connections to a identified command-and-control (C2) infrastructure IP address (158.51.122.136). The detection spans file creation, process execution, image loading, and network communication events to identify the multi-stage attack lifecycle.
This rule monitors for indicators of compromise (IOCs) associated with a specific AutoIT-based malware delivery chain. It tracks the execution and presence of specific malicious file names and SHA256 hashes, as well as network connections to a identified command-and-control (C2) infrastructure IP address (158.51.122.136). The detection spans file creation, process execution, image loading, and network communication events to identify the multi-stage attack lifecycle.
Detects HTTP traffic from internal hosts to the 'gapidriver.com' domain, specifically identifying the GapiUpdate stager behavior. The rule looks for authenticated GET requests to '/api/get.php' using a specific Bearer token and User-Agent, as well as status reporting to '/api/rest.php'.
This rule detects potentially malicious attempts to import certificates into the Windows certificate store using command-line tools like certutil or direct modification of the registry. This behavior is frequently associated with attackers attempting to establish persistence, bypass certificate validation, or install rogue trust anchors for man-in-the-middle operations.
Detects anomalous behavior indicative of the GRAYRABBIT shellcode which uses manual module walking and hash-based API resolution to load 'urlmon.dll' dynamically, followed shortly by an outbound network connection to a known malicious staging IP. This pattern reflects an evasion technique designed to avoid static import table analysis.
Detects outbound network traffic from internal hosts to known MeshCentral Command and Control (C2) infrastructure. MeshCentral is legitimate remote monitoring and management (RMM) software that is frequently abused by threat actors to maintain persistent remote access to victim environments. This rule monitors for established TCP connections on specific ports associated with MeshCentral C2 nodes.
Page 39 of 121