Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects network traffic associated with the malicious npm package 'indexed-btree', which uses the Telegram Bot API to exfiltrate data. The rules monitor for connections to api.telegram.org via HTTPS and identify specific hardcoded bot tokens and chat IDs associated with the malicious campaign.
Detects outbound network traffic (HTTPS and TLS) directed at the specific S3-compatible object storage host 'ams1.vultrobjects.com'. This pattern is associated with 'HEAVYGRAM', a threat actor or toolkit using Vultr S3 buckets for potential data exfiltration.
Detects outbound HTTP/POST requests from checkout or payment page environments to known malicious domains associated with GrelosGTM digital skimmer infrastructure. This behavior is indicative of unauthorized data exfiltration, where payment information is sent to an attacker-controlled server instead of the legitimate payment gateway.
Detects instances where a service principal or entity identified as an AI agent, bot, or assistant accesses files in SharePoint or OneDrive that are likely to contain sensitive credentials, secrets, or configuration files (e.g., .pem, .pfx, .env, id_rsa).
Detects high-volume, systematic API requests to AI inference endpoints from a single user ID, which may indicate automated model extraction or scraping attacks against AI services.
This rule detects anomalies in outbound network data transfer by comparing the current daily volume of data sent to external, non-private IP addresses against the historical average for those specific sources. It alerts when the daily volume exceeds 500MB and shows a significant spike (3x or more) compared to historical baseline data or when no historical data is available for a new source connection.
Detects HTTP traffic to the Telegram Bot API (/sendPhoto) originating from internal network hosts, which is indicative of potential exfiltration of captured images (e.g., screenshots or webcam captures) to an adversary-controlled Telegram channel.
This rule detects network upload operations (HTTP POST or similar requests ending in '/upload') to a specific external IP address (2.26.126.50). It specifically monitors for processes other than common web browsers, and filters for connections where significant data volume (greater than 10KB) is transferred or the data size is unknown.
This rule detects network upload operations (HTTP POST or similar requests ending in '/upload') to a specific external IP address (2.26.126.50). It specifically monitors for processes other than common web browsers, and filters for connections where significant data volume (greater than 10KB) is transferred or the data size is unknown.
Detects outbound HTTP POST requests to the Telegram Bot API (/sendPhoto) that contain sensitive system information, including host credentials (port, login, password) and Shodan host data. This behavior is indicative of an information-stealing malware attempting to exfiltrate captured credentials via a Telegram bot.
Detects the use of PowerShell to perform recursive file/directory enumeration within sensitive user profile directories (Desktop, Documents, Downloads, Pictures, OneDrive) immediately followed by a network connection over port 443. This behavior is indicative of potential data staging and exfiltration activity performed by a malicious script or threat actor.
Detects periodic beaconing and C2 communication patterns associated with the RapidRust Golang RAT, attributed to the APT36 (Transparent Tribe) threat group. The rule monitors for specific DNS queries to typosquatted domains, TLS SNI mismatches, and specific HTTP API polling activities commonly used by this malware for C2 tasking.
Detects instances where AI coding assistants or tools (e.g., Claude, Copilot, Gemini) invoke git.exe to clone or fetch repositories from non-standard (non-GitHub) hosts, followed by a checkout operation within a short timeframe. This behavior may indicate an attacker using automated tools to stage or exfiltrate sensitive code repositories to unauthorized infrastructure.
Detects instances where AI coding assistants or tools (e.g., Claude, Copilot, Gemini) invoke git.exe to clone or fetch repositories from non-standard (non-GitHub) hosts, followed by a checkout operation within a short timeframe. This behavior may indicate an attacker using automated tools to stage or exfiltrate sensitive code repositories to unauthorized infrastructure.
Detects instances where AI coding assistants or tools (e.g., Claude, Copilot, Gemini) invoke git.exe to clone or fetch repositories from non-standard (non-GitHub) hosts, followed by a checkout operation within a short timeframe. This behavior may indicate an attacker using automated tools to stage or exfiltrate sensitive code repositories to unauthorized infrastructure.
Detects unauthorized devices or processes attempting to communicate with the Telegram Bot API (/sendMessage or /sendDocument) and monitors for credential-related terms within the request metadata. This often indicates the use of Telegram as a command-and-control (C2) channel for data exfiltration or credential theft.
Detects high-frequency, automated interactions with popular AI assistant web interfaces (e.g., Gemini, Perplexity, Claude, Copilot) from common browser processes. This pattern often indicates unauthorized automated data submission or scraping, which may follow or facilitate automated exfiltration of browser-resident data.
Detects a suspicious sequence of Git operations ('fetch' followed by 'checkout') executed within a 5-minute window, where the initiating process is a known AI-assisted development tool (Claude, Codex, Copilot, or Gemini). This behavioral pattern may indicate an attempt to use AI tooling to facilitate the unauthorized access or exfiltration of code repositories.
This rule performs a hunting activity across multiple telemetry sources (Network, Email, Endpoint) to detect known indicators of compromise (IOCs) associated with Anthropic threat intelligence reporting (September 2026). It looks for specific malware file names, command-line patterns, service installations, phishing email addresses, and C2 communication URLs.
Detects network communication to known MovieReaper C2 infrastructure (deadhub.org or 193.23.118.155) originating from a masqueraded 'msedge.exe' process located in 'C:\ProgramData\Microsoft\Windows\Telemetry\', indicating potential C2 check-ins or data exfiltration by the file manager module.
This rule detects potentially unauthorized network communication with AI platforms (OpenAI, Anthropic, Gemini) or Telegram from hosts executing suspicious processes or tools, such as 'frpc' (Fast Reverse Proxy), 'liblocal-service.so', or processes interacting with Android Debug Bridge (adb) utilities. This behavior often suggests the use of automated tools, remote tunneling, or interaction with AI models for post-exploitation tasks, such as code generation for malicious scripts or C2 activity.
Page 25 of 124