Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,208 detections
Filters
Last updated
All Time
Detection languages
2,407
1,435
704
406
354
Contributors
1,092
1,080
584
392
348
Categories
2,143
1,818
1,759
1,290
889
Platforms
4,235
1,450
895
574
181
Products / Services
1,567
855
774
655
512
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
Detects a network connection initiated from a process located in the "C:\Users\Public" folder.
Attacker are known to drop their malicious payloads and malware in this directory as its writable by everyone.
Use this rule to hunt for potential suspicious or uncommon activity in your environement.
Attacker are known to drop their malicious payloads and malware in this directory as its writable by everyone.
Use this rule to hunt for potential suspicious or uncommon activity in your environement.
Detects execution of processes with image paths starting with WebDAV shares (\\), which might indicate malicious file execution from remote web shares.
Execution of processes from WebDAV shares can be a sign of lateral movement or exploitation attempts, especially if the process is not a known legitimate application.
Exploitation Attempt of vulnerabilities like CVE-2025-33053 also involves executing processes from WebDAV paths.
Execution of processes from WebDAV shares can be a sign of lateral movement or exploitation attempts, especially if the process is not a known legitimate application.
Exploitation Attempt of vulnerabilities like CVE-2025-33053 also involves executing processes from WebDAV paths.
Detects execution of curl.exe with custom useragent options
'Finds PowerShell execution events that could involve a download'
'This hunting query looks for hosts that have attempted to interact with the Discord CDN. This activity is not normally invoked from the command line and could indicate C2, exfiltration, or malware delivery activity.'
'Looks for Base64-encoded commands associated with the Nishang reverse TCP shell.
Ref: https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1'
Ref: https://github.com/samratashok/nishang/blob/master/Shells/Invoke-PowerShellTcp.ps1'
Detects the usage of one of three Microsoft office applications (Word, Excel, PowerPoint) to download arbitrary files
Detects code execution via the Windows Update client (wuauclt)
Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors
Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.
Detects an executable that isn't dropbox but communicates with the Dropbox API
Detects outbound network connection initiated by Microsoft Dialer.
The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer.
This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"
The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer.
This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"
Detects a "winlogon.exe" process that initiate network communications with public IP addresses
Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.
Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports.
Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.
Detects a network connection initiated by the certutil.exe utility.
Attackers can abuse the utility in order to download malware or additional payloads.
Attackers can abuse the utility in order to download malware or additional payloads.
Detects DNS queries to an ".onion" address related to Tor routing networks
Detects DNS requests to Cloudflared tunnels domains.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners.
These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc.
Such DNS activity can indicate potential delivery or command-and-control communication attempts.
These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc.
Such DNS activity can indicate potential delivery or command-and-control communication attempts.
Page 256 of 296