Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,773
6,705
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
This rule detects attempts to perform directory traversal attacks by monitoring incoming HTTP requests for repetitive directory navigation sequences (e.g., ../, .., %2F, %5C). Such sequences are often used to bypass security controls and access unauthorized files or directories on the web server.
Detects DNS traffic patterns indicative of the Iodine DNS tunneling tool, specifically identifying version handshake queries or base32 encoded payloads commonly associated with the tool's C2 communication.
This rule detects potential command and control (C2) activity related to the Qakbot malware. It specifically monitors for established outbound TLS traffic over non-standard ports (ports other than 443) where the Server Name Indication (SNI) field contains a numeric IPv4 address instead of a domain name, which is a characteristic behavior of Qakbot C2 infrastructure.
Detects TLS/SSL traffic patterns characteristic of Metasploit Meterpreter reverse HTTPS command-and-control communication, specifically targeting the use of default, self-signed certificates with a subject line containing a bare wildcard (CN=*) in the common name field, a common artifact of unconfigured Metasploit payloads.
Detects inbound HTTP requests containing common Cross-Site Scripting (XSS) patterns, such as the <script> HTML tag or the 'javascript:' URI scheme, which are indicative of attempts to execute arbitrary client-side code.
This rule detects repeated path traversal sequences (../ or ..%2F) in the HTTP URI. This behavior is indicative of an attacker attempting to escape the intended web directory to access sensitive files or configuration files on the underlying filesystem.
Detects outbound HTTP POST requests characterized by a specific URL pattern consisting of two segments of 4-16 alphanumeric characters, typically observed in Emotet C2 traffic. The rule specifically matches requests with a Content-Type header set to application/octet-stream, which is indicative of malicious binary payload transfer or communication.
This rule detects network traffic originating from internal hosts to external destinations consistent with default Cobalt Strike HTTP Beacon communication patterns. It specifically looks for GET requests containing URI paths commonly associated with default Cobalt Strike profiles (ca, submit.php, updates.rss) combined with a specific, hardcoded User-Agent string associated with Cobalt Strike's default configuration.
This rule monitors incoming DNS traffic for A record responses containing RFC1918 private IP addresses (10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16). This behavior is characteristic of DNS rebinding attacks, where a malicious web service resolves to a victim's internal network address to bypass browser same-origin policies.
Detects the transmission of the 'UserInitMprLogonScript' registry value name over SMB traffic in plaintext. This registry key is commonly used by adversaries to establish persistence by executing a logon script whenever a user logs in.
Detects attempts to disable the Windows Firewall using the netsh command-line utility or PowerShell cmdlets, as well as registry modifications related to firewall profiles. Adversaries often perform this action to impair host-based security controls and facilitate unauthorized inbound or outbound network traffic.
This rule detects suspicious HTTP request bodies containing the 'LD_PRELOAD' environment variable assignment, targeting common temporary or writable directories. This behavior is indicative of an attempt to perform dynamic linker hijacking on a Linux system to inject malicious shared libraries into target processes.
This rule detects the use of the 'msiexec.exe' utility to fetch and potentially execute an '.msi' installer package directly from a remote source via HTTP. This behavior is a known technique for bypassing application control by abusing a signed system binary to download and install malicious packages.
Detects DNS queries for 14-character alphanumeric .org domains characteristic of Bumblebee malware's Domain Generation Algorithm (DGA).
Detects outbound HTTP requests exhibiting a User-Agent string hardcoded to mimic Firefox 20.0 (Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0), which is characteristic of the Adaptix C2 framework. This pattern is commonly used by adversaries for command-and-control communication.
This rule detects outbound TLS connections to identified C2 infrastructure associated with the UAC-0226 threat actor and the GIFTEDCROOK malware, specifically by monitoring the certificate subject name 'NextGen Fusion'.
This rule monitors DNS queries for potential exfiltration or C2 communication channels. It flags DNS queries that exceed 100 characters in length or contain labels with at least 30 alphanumeric characters, excluding activity from common web browsers.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
This rule set detects various stages of activity related to the 'OpenClaw' malware family and associated campaigns. It includes detection for OpenClaw process execution, exposure of a specific administrative port, execution of shell commands via curl (ClawHavoc delivery), outbound webhook exfiltration, and infostealer access to OpenClaw configuration files.
This rule detects various stages of an attack chain, starting from an Apache ActiveMQ exploit (CVE-2023-46604) leading to LockBit-style ransomware. It identifies process creation anomalies (java.exe spawning certutil.exe for downloads), network connections to known Metasploit C2 infrastructure, the presence of specific ransomware file hashes, and attempts to clear Windows event logs, all indicative of the described attack scenario.
Page 120 of 124