Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,773
6,705
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
IoT botnet malware family used for DDoS and proxy infrastructure
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Lumma NetworkIOC
YARA
Infostealer-as-a-service targeting browser credentials and crypto wallets
Form-grabbing and credential stealing malware-as-a-service
Ransomware group exploiting edge devices and managed file transfer software
Loader malware delivering follow-on ransomware payloads
Commodity .NET keylogger and remote access trojan
Clipboard hijacking malware for cryptocurrency address substitution
Commodity .NET keylogger and remote access trojan
Open-source derived remote access trojan with plugin architecture
Commodity .NET keylogger and remote access trojan
Clipboard hijacking malware for cryptocurrency address substitution
Commodity .NET keylogger and remote access trojan
Detects outbound HTTP PUT requests to 'filen.io', which has been associated with command-and-control (C2) communication for the PRISMEX malware used by the threat actor APT28 (also known as Pawn Storm/Fancy Bear).
Detects DNS queries for the domain 'screenai.online', which is associated with the Phoenix Backdoor used by the MuddyWater (also known as Seedworm or MERCURY) threat group for command-and-control (C2) communication.
Detects a specific network handshake pattern (05 01 00) associated with the SystemBC malware acting as a SOCKS5 proxy. This pattern is characteristic of the initial communication phase used by SystemBC to establish C2 connectivity, often utilized by ransomware affiliates.
Detects outbound HTTP POST requests containing keywords indicative of credential and data theft associated with VBV Stealer malware, specifically looking for fields related to passwords, cookies, or wallets in the request body.
This rule detects outbound TCP traffic from internal network hosts to known Tor relay ports (9001, 9030), which is a common communication pattern for the NBLock ransomware strain to establish a command and control channel through the Tor network.
Detects outbound network traffic to the ScreenConnect service specifically targeting the /Relay/ path, which is commonly abused by ransomware operators (e.g., Interlock, RansomHub) for establishing unauthorized remote access and command-and-control channels.
Detects outbound SOCKS5 negotiation patterns commonly used by the Salt Typhoon threat group's STOWAWAY tool. The rule triggers on TCP traffic initiating a SOCKS5 handshake (represented by the sequence |05 01 00|) to non-standard ports, excluding common proxy ports (1080, 3128, 8080, 8443, 9050). This behavior is indicative of a multi-hop SOCKS5 relay or command-and-control connection.
Page 116 of 124