Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects CVE-2026-3055 Citrix NetScaler out-of-bounds memory-read exploitation via a GET request eliciting an oversized HTTP response body containing a leaked NSC_AAAC session cookie.
Detects command-line execution associated with WhatsApp API contact synchronization, specifically looking for 'WPP.contact.getAllContacts' or 'WPP.contact.list' commands. This pattern may indicate automated or unauthorized scraping of contact lists via a messaging interface.
Detects network communication associated with the TOKYOCORE malware C2 infrastructure. The rule monitors for specific API endpoints (/api/victim/(log|data|command|archive)) combined with known malicious User-Agent strings (RansomAgent or fsociety/1.0), as well as suspicious multipart form data uploads that may indicate data staging or exfiltration.
CaptiveCrunch ChocoShell disguised C2 URI pattern to known Storm-2945 C2 IP (/t/event, /t/pixel.gif, polyfill payload)
Detects Edgecution/SNOW malware suite components across the kill chain via known SHA256 file hashes (phishing HTML, AutoHotkey stager, Edgecution ZIP archive, extension background.js, Python native host backdoor) and combinations of embedded code/path strings associated with SNOWGLAZE/SNOWBASIN; requires multiple distinctive strings together to reduce false positives
Detects outbound HTTPS traffic to api.telegram.org originating from non-standard or unsigned processes. This rule is designed to identify potential data exfiltration by malware (such as stealers or trojans) using the Telegram Bot API as a C2 or exfiltration channel. It relies on a companion rule to establish flowbits for legitimate client traffic.
Anomalously large outbound transfers over the WebRTC DataChannel from a Chrome/Edge process launched with --headless and --remote-debugging-port flags (no visible window), indicating exfiltration rather than routine interactive or automation-only browser use.
Detects the malicious GitHub Actions workflow that exfiltrates PyPI/Codecov CI secrets to the attacker's known webhook.site endpoint.
Tier 5 catch-all: flags files exhibiting a broad spread of TOKYOCORE-related strings across identity, C2, ransom-note/branding, destructive, file-operation, data-theft, and persistence clusters, regardless of which specific cluster dominates
Detects anomalous activity in Microsoft 365 calendar events where potential C2 data is exfiltrated or synchronized. This is identified by the creation or modification of calendar events containing suspicious file names (e.g., File0.txt, File1.txt) or specific command-and-control markers within the event subject.
Detects the HTTP POST exfiltration pattern used by the mrmustard stealer to send harvested credentials/host data to its C2 endpoint at metrics.femboy.energy/v1/collect.
Anomalously large outbound transfers over the WebRTC DataChannel from a Chrome/Edge process launched with --headless and --remote-debugging-port flags (no visible window), indicating exfiltration rather than routine interactive or automation-only browser use.
Detects network connections originating from browser processes to domains associated with ModHeader-related C2 activity, specifically 'stanfordstudies.com' and 'extensions-hub.com'. This pattern is indicative of malicious browser extensions exfiltrating data or reaching out to command and control infrastructure.
Detects established TLS connections to known malicious infrastructure associated with PureRAT and DlrtyGames RAT. The rules identify suspicious patterns such as connections without a Server Name Indication (SNI) and specific JA3 hashes indicative of malware beacons.
Detects the execution of the MinIO Client (mc.exe) on Windows with command-line arguments indicating the interaction with external or arbitrary bucket and endpoint locations. This behavior is indicative of an attacker staging or exfiltrating data to an external S3-compatible cloud storage provider.
Detects the execution of the McUploader component associated with the GigaWiper malware, which is used for file staging and exfiltration.
Detects the execution of the MinIO Client (mc.exe) on Windows with command-line arguments indicating the interaction with external or arbitrary bucket and endpoint locations. This behavior is indicative of an attacker staging or exfiltrating data to an external S3-compatible cloud storage provider.
This rule monitors and aggregates external network connections originating from a specific host. It specifically highlights connections to external domains or IPs that have a low frequency (1-10 connections), which may indicate beaconing activity, command and control (C2) communication, or low-and-slow data exfiltration attempts.
Detects the execution of the McUploader component associated with the GigaWiper malware, which is used for file staging and exfiltration.
Detects anomalous activity in Microsoft 365 calendar events where potential C2 data is exfiltrated or synchronized. This is identified by the creation or modification of calendar events containing suspicious file names (e.g., File0.txt, File1.txt) or specific command-and-control markers within the event subject.
Detects anomalous access to Outlook calendar attachments via the Microsoft Graph API, specifically targeting a file named 'file0.txt'. This activity may indicate a technique where attackers use calendar events as a covert channel for data exfiltration or delivery of malicious payloads.
Page 42 of 124