Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
696 detections
Filters
Last updated
All Time
Detection languages
332
134
106
55
25
Contributors
115
100
66
62
55
Categories
136
129
107
104
84
Platforms
324
178
85
83
80
Products / Services
134
112
104
52
47
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
696
CVEs
2
2
2
2
1
IDS Classtypes
48
29
11
7
6
IDS Protocols
66
20
11
6
3
This rule detects potential DNS hijacking or redirection by comparing the returned IP address from a DNS query against a known list of authoritative IP addresses for specific domains. If an internal DNS resolver returns an IP address that does not match the authoritative record, it flags the event as a potential DNS response mismatch. It includes risk scoring based on the number of distinct affected hosts.
Detects network connections to a specific suspicious IP address (94.156.181.89) or to domains associated with Cloudflare Tunnel (.trycloudflare.com). This could indicate command and control activity, data exfiltration, or other malicious network communication.
This rule detects the creation of Azure DNS zones by callers who have no prior history of writing to DNS zones within a specified lookback period. This behavior can indicate an attempt at DNS zone takeover, as observed in campaigns like 'Borrowed Trust' or 'link99', where adversaries might create orphaned DNS zones to redirect traffic or host malicious content.
This rule detects processes making a high volume of successful network connections (3 or more within an hour) to domains containing 'codeartifact' or 'artifactory'. This behavior could indicate an attempt to download tools, libraries, or other artifacts, potentially as part of an ingress tool transfer or supply chain attack.
Detects inbound emails relayed through GoDaddy secureserver.net infrastructure where SPF and DMARC authentication pass but DKIM is absent, and the X-SECURESERVER-ACCT header is present. This pattern is consistent with the Scotiabank TOAD callback phishing campaign using compromised legitimate domains to bypass email authentication controls.
Detects node.exe spawning powershell.exe as a child process, consistent with malicious npm postinstall lifecycle hooks used by the PostCSS typosquatting campaign (postcss-minify-selector-parser / postcss-minify-selector). The attack chain decrypts an AES-256-GCM blob at runtime and executes a PowerShell downloader stage.
Detects the execution of processes with command line arguments containing terms related to quantum-resistant or post-quantum cryptography (e.g., lattice, isogeny, multivariate, hash). This is intended to identify the usage of specific cryptographic libraries or tools that may be relevant for advanced adversaries researching post-quantum decryption techniques or securing their own communications against future quantum-enabled decryption.
This rule monitors for the presence of a specific malicious browser extension (by identifier) on the file system and simultaneously tracks outbound network connections to a known typosquatted domain ('perplexity-ai.online'). It alerts on the potential presence of an adversary-controlled browser plugin or user navigation to a malicious domain often used in phishing or credential harvesting campaigns.
This rule detects potential command-and-control (C2) activity or data exfiltration by monitoring for first-time DNS resolution of known typosquatted domains targeting 'Perplexity AI', followed by persistent outbound network connections from common web browsers to the same domain family.
Detects endpoint connections directly to Kali365 PhaaS panel domains, which are associated with phishing-as-a-service operations. This rule identifies network activity to specific domains used by the Kali365 platform, indicating potential compromise or interaction with phishing infrastructure.
Detects access to botnet command and control panels
Detects use of free hosting services for staging malicious content
Detects network connections to the typosquatted domain 'perplexity-ai.online', associated with a malicious browser extension used for data exfiltration. Additionally, it detects the creation or modification of 'background.js' files within common web browser extension directories, which is a common persistence mechanism for malicious extensions.
This rule detects the presence of known Android Remote Access Trojan (RAT) APK files on Windows endpoints, or the use of Android Debug Bridge (adb.exe) to install such APKs. It monitors file creation/modification events for specific malicious filenames and process execution patterns involving 'adb install' commands, as well as suspicious script interpreters creating APK files in user-writable directories.
Detects the use of PowerShell to initiate web requests to Storj-hosted URLs (link.storjshare.io or .storj.io), utilizing either the WebClient class or the Invoke-WebRequest cmdlet. This behavior is associated with the REF8372 OXLOADER malvertising campaign, where PowerShell scripts are used to download malicious payloads.
Detects vLLM establishing outbound network connections to fetch external media files (e.g., .mov, .mp4, .jp2) from non-private IP addresses. This activity may indicate exploitation of CVE-2026-22778, allowing for remote code execution by fetching malicious content.
This rule monitors the creation of new Azure Function Apps and identifies those that receive external, non-private network requests within 48 hours of their creation. This pattern may indicate the deployment of malicious or unauthorized serverless infrastructure for command-and-control, proxying, or automated tasks.
Detects node.exe spawning powershell.exe as a child process, consistent with malicious npm postinstall lifecycle hooks used by the PostCSS typosquatting campaign (postcss-minify-selector-parser / postcss-minify-selector). The attack chain decrypts an AES-256-GCM blob at runtime and executes a PowerShell downloader stage.
Detects SMTP connections originating from the persistent Gamaredon operator subnet (194.58.66.0/24) on port 25.
Detects the execution of processes with command line arguments containing terms related to quantum-resistant or post-quantum cryptography (e.g., lattice, isogeny, multivariate, hash). This is intended to identify the usage of specific cryptographic libraries or tools that may be relevant for advanced adversaries researching post-quantum decryption techniques or securing their own communications against future quantum-enabled decryption.
Detects successful outbound network connections to common botnet-associated remote ports (6667, 6697, 8006, 27374, 27375). The rule aggregates these connections by device to identify endpoints communicating with multiple distinct remote IP addresses, a behavior often indicative of botnet participation or command and control activity.
Page 8 of 34