Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
696 detections
Filters
Last updated
All Time
Detection languages
332
134
106
55
25
Contributors
115
100
66
62
55
Categories
136
129
107
104
84
Platforms
324
178
85
83
80
Products / Services
134
112
104
52
47
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
696
CVEs
2
2
2
2
1
IDS Classtypes
48
29
11
7
6
IDS Protocols
66
20
11
6
3
This rule detects successful or failed logon attempts originating from IP addresses identified by threat intelligence as associated with botnets, command and control (C2) infrastructure, or proxies. The rule specifically looks for 'LogOn' or 'FailedLogOn' activity types where the source IP's threat intelligence indicator type is 'Botnet', 'C2', or 'Proxy', and where activity insights are available.
This rule detects URLs that contain common redirection or link parameters (u=, url=, redirect=, r=, link=, target=, dest=) where the value of the parameter is a long, alphanumeric string that appears to be an encoded domain. This pattern can indicate attempts to obfuscate the true destination of a link, often seen in phishing campaigns or malicious redirection attempts. The rule specifically looks for encoded parameters containing common top-level domains like .com, .net, or .org.
Detects the presence of known exploit harness files or the execution of Python scripts and binaries associated with libssh2 publickey subsystem heap overflow and arbitrary free exploits (including proof-of-concept code and reproduction harnesses).
Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution
Detects network requests originating from common package manager User-Agents (e.g., pip, npm, cargo) targeted at external domains that do not match known legitimate repositories. This behavior is indicative of potential command and control (C2) activity or malicious package staging using lookalike or arbitrary domains to bypass standard package registry traffic patterns.
Detects the presence of the malicious Chromium extension 'Search for perplexity ai' (ID flkebkiofojicogddingbdmcmkpbplcd) on disk. This extension hijacks browser default search settings to redirect queries through the typosquatted domain perplexity-ai[.]online.
Detects DNS queries for domains that mimic software package naming conventions (e.g., [name]-utils, [name]-api, [name]-client) that do not resolve to known legitimate registry domains. This behavior is indicative of potential dependency confusion attacks or malicious package installation attempts, where an attacker registers a domain designed to lure developers into downloading malicious code.
This rule detects potential beaconing or re-registration activity associated with the JDY/KV-botnet by monitoring network connections to known Tor control/relay ports (9001 and 9050). The detection identifies endpoints making high-volume, multi-destination connections to external IPs over these specific ports, a pattern indicative of botnet nodes attempting to re-establish C2 communication after infrastructure disruption or actively recruiting new nodes.
Detects the creation or modification of opportunistic locks (oplocks) involving Wermgr.exe copies located within Volume Shadow Copies or temporary directories using specifically crafted file streams (:WDFOO). This activity is a known technique used to perform Time-of-Check Time-of-Use (TOCTOU) race condition attacks to suspend security software or hold open race windows to evade detection by Windows Defender.
Detects the execution of QEMU binary processes with command-line arguments targeting database or virtual disk files (e.g., .qcow2, .db) or matching known malicious file hashes. This behavior is indicative of unauthorized use of virtualization tools to execute payloads, conduct forensics, or manipulate virtual disk images in an environment.
Detects potentially malicious Android applications installed via non-standard sources that exhibit suspicious characteristics such as masquerading as system/security updates, requesting device administrator privileges, or clustering highly sensitive permissions like location, contacts, call logs, and audio recording.
Detects high-volume outbound network scanning activity from a single internal source device. The rule identifies anomalous behavior characterized by rapid connection attempts to a large number of distinct destination IPs and ports, consistent with scanning patterns observed in botnets like JDY, which often target edge network infrastructure (Cisco, Ubiquiti, Draytek).
Detects CI/CD package manager traffic (e.g., pip, npm) attempting to connect to domains that mimic legitimate PyPI or npm registry domains. This behavior is indicative of a dependency confusion or supply chain attack where an adversary uses typosquatted or phantom-squatted domains to intercept or redirect package requests.
Detects HTTP requests where the referrer is a major LLM service (e.g., ChatGPT, Claude) but the destination host uses keywords indicative of phantom squatting (e.g., parcel, delivery, login) suggesting an attempt to use LLM-generated content or platforms to facilitate malicious redirects or phishing.
This rule detects DNS queries for domains that mimic legitimate package registry domains (such as PyPI, npm, etc.) using common typosquatting or lookalike patterns often exploited for dependency confusion or supply chain attacks. It identifies when systems reach out to domains attempting to impersonate trusted package management services.
Detects node.exe processes or file operations involving suspicious strings like 'piterpan', 'pmtrader', or 'DEFAULT_USERNAME_TAG', which are associated with malicious activity or unauthorized staging of scripts within the node environment.
Detects instances where the OpenVPN Connect process spawns unexpected child processes. This behavior is consistent with the exploitation of OpenVPN ACE (Access Control Exploitation) vulnerabilities, where a malicious OpenVPN server pushes an 'echo' directive that decodes to a command and executes upon disconnection, bypassing client-side script execution restrictions.
Detects the execution of processes or command lines containing strings associated with known malicious tools or malware, specifically: BlueHammer, RedSun, UnDefend, and Bluekit.
This rule detects the presence and execution of files associated with the proof-of-concept (PoC) exploit for CVE-2026-55200, a remote code execution vulnerability in libssh2. The rule monitors for specific exploit binary names and directory structures commonly used by security researchers or attackers to test or exploit this vulnerability.
This rule detects DNS queries originating from the internal network towards the domain 'direct-download.giize.com', which has been associated with the unauthorized distribution of the ScreenConnect remote access tool. This activity is indicative of an attempt to download potentially malicious or unauthorized remote administration software.
Detects the creation or modification of a file named 'maisum.dat', which has been associated with malicious activity and malware behavior.
Page 4 of 34