Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,143 detections
Filters
Last updated
All Time
Detection languages
3,220
1,086
504
478
470
Contributors
1,824
1,607
871
505
300
Categories
2,972
2,473
1,061
1,025
907
Platforms
39,771
7,143
6,517
3,850
3,602
Products / Services
1,324
1,069
971
657
488
MITRE Techniques
2,231
1,317
1,313
874
871
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
This rule detects DNS queries for reverse lookups, specifically those ending with '.in-addr.arpa' or '.ip6.arpa'. While legitimate, frequent or unusual reverse DNS queries from a specific device or process could indicate reconnaissance activities or attempts to map internal network infrastructure by an attacker.
Detects anomalous lateral movement or network pivoting activity originating from an internet-facing Nginx server. The detection identifies an incoming HTTP POST request from an external IP address followed immediately by an outbound network connection from that same Nginx server to an internal RFC1918 host on the FastCGI port (9000). This behavior is consistent with the 'Velvet Ant' operation's technique of abusing proxy_pass configurations to relay traffic into isolated internal network segments via FastCGI request-chaining.
This rule detects potential beaconing or re-registration activity associated with the JDY/KV-botnet by monitoring network connections to known Tor control/relay ports (9001 and 9050). The detection identifies endpoints making high-volume, multi-destination connections to external IPs over these specific ports, a pattern indicative of botnet nodes attempting to re-establish C2 communication after infrastructure disruption or actively recruiting new nodes.
Detects outbound network connections to common Tor relay and exit ports (9001, 9050) initiated by processes other than authorized Tor clients. This activity is often associated with threat actors, including Volt Typhoon, using Tor to obfuscate command-and-control (C2) traffic.
Detects instances where the fcgiwrap or spawn-fcgi processes, commonly used for Nginx FastCGI handling, are observed spawning system utility binaries (such as uptime, id, ps, who, or hostname) from unconventional locations like /tmp, /var/tmp, /dev/shm, or /home. This behavior is associated with the Velvet Ant threat group for lateral movement and reconnaissance within segmented networks.
Detects the execution of GS-Netcat or GSSocket, known tools used by the Velvet Ant threat group to establish encrypted C2 tunnels and SOCKS proxies on Linux systems. The rule identifies suspicious command-line patterns, including secret keys (-s), listener configurations (-l -p), and shell redirection (-e), particularly when executed from volatile directories like /tmp/ or /dev/shm/.
Detects network connection attempts directed toward RFC 1918 private IP address spaces (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and localhost (127.0.0.0/8) that do not involve common Windows file sharing ports (TCP/445 and TCP/139). This behavior may indicate lateral movement, internal reconnaissance, or the use of non-standard protocols for internal communication.
Detects evidence of successful cache poisoning exploitation in Next.js applications by identifying specific marker files ('VULNERABILITY_CONFIRMED.marker' and 'evidence.json') created in conjunction with active 'next start' or 'next build' processes. This pattern aligns with Proof of Concept (PoC) code targeting object argument collisions.
Detects multiple failed SSH authentication attempts against a server from a single source within a short timeframe, which is indicative of a brute force password attack.
Detects instances where a Python interpreter (python.exe or python3.exe) initiates an interactive command-line shell (cmd.exe, powershell.exe, bash.exe, or sh.exe). The detection logic further narrows this behavior by looking for common reverse shell indicators such as socket connections or command execution arguments within the process command line.
Detects a high volume of successful network connections to multiple unique cloud storage services (Dropbox, Box.com, OneDrive) from a single device and user account within an hour. This could indicate data exfiltration or unauthorized access to cloud storage.
Detects shell or interpreter processes spawned as children of 'autogenstudio', potentially indicating command injection via WebSocket or other application-level vulnerabilities (e.g., CWE-78).
This rule detects potential ransomware activity by identifying processes that perform a high volume of file write, create, or rename operations across a large number of unique file paths within a short timeframe. It also includes a heuristic check for filenames containing 'inc' or 'lynx', often associated with specific ransomware variants.
Detects a highly relevant Antivirus alert that reports APT malware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports an exploitation framework.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports ransomware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects execution of the SSH binary with command-line arguments indicative of port forwarding, specifically remote port forwarding (-R) or use of specific ports and IP addresses often associated with unauthorized proxying or command and control tunnels.
This rule detects HTTP POST requests to the MyBB admin panel (admin/index.php) that attempt to create or modify a user account with membership in the Administrator group (gid=4). The detection requires the presence of an administrator session cookie (adminsid), indicating an attempt by a lower-privileged administrative account to escalate privileges by assigning administrative roles to users.
This rule monitors Cisco SD-WAN environments for indicators of post-exploitation, including unauthorized SSH lateral movement, abuse of administrative tools (vshell, confd_cli), suspicious tenant list modifications related to CVE-2026-20245, privilege escalation to backdoor accounts, system file tampering (/etc/passwd, /etc/shadow), and anti-forensic activities such as log and history deletion.
Page 167 of 341