Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,670
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects attempts to exploit a buffer overflow vulnerability (CVE-2026-7273) in Zyxel GS1900 series switches. The rule monitors for oversized POST requests directed at CGI scripts on the device's web management interface.
Detects DNS queries with abnormally long subdomains matching patterns frequently used by Cobalt Strike DNS Beacons for command-and-control communications. The rule identifies hexadecimal or base32 encoded strings within subdomains that exceed 40 characters in length and occur frequently within a short time window.
Detects HTTP POST requests characteristic of TrickBot C2 beaconing. The rule identifies specific URI structures, Content-Type headers set to 'application/octet-stream', and unique request body behaviors that are indicative of TrickBot communication patterns.
This rule monitors for known string patterns associated with the initialization and command execution of the Metasploit Meterpreter reverse TCP payload. By inspecting network traffic for characteristic C2 handshake and command strings, it identifies active Meterpreter sessions.
Detects an Active Directory Certificate Services (AD CS) Certificate Enrollment Service (CES) SOAP request that includes a 'CertificateTemplate' item in the 'AdditionalContext' body, potentially indicating a directed attempt to request a specific certificate template during enrollment.
Detects outbound HTTP GET requests where the user agent is set to 'WebClient' and the URI ends in '.ps1'. This behavior is characteristic of PowerShell download cradles, which are often used by adversaries to fetch and execute remote malicious scripts directly into memory.
Detects anomalous HTTP POST requests to a suspected C2 endpoint ('/beacon/pre-register') on a typosquatted domain ('thecovnresation') characterized by an application/octet-stream content type, which is indicative of encrypted C2 beacon registration activity.
Detects incoming TLS traffic from an external network where the TLS server certificate's Subject Common Name (CN) field matches 'AsyncRAT Server'. This pattern is a known indicator of a beaconing session initiated by AsyncRAT remote access trojan servers.
This rule detects network traffic patterns associated with the Lumma Stealer malware performing endpoint fingerprinting. It monitors for GET requests to the URI path '/api/set_agent' which contains a 32-character hexadecimal string, characteristic of the malware's C2 communication.
This rule detects network traffic indicative of the RisePro malware communicating with its Command and Control (C2) infrastructure. It specifically looks for the 'clientsendfile' string within the payload, which acts as a keepalive signal or heartbeat for the RisePro implant.
Detects network traffic associated with the RisePro malware family, specifically identifying the use of 'serversendfile' commands, which indicates data exfiltration or file transfer activity via a command-and-control channel.
This rule detects outgoing HTTP POST requests to discord.com API webhooks, specifically containing patterns characteristic of XWorm malware, such as exfiltrating machine information identified by Username and IP fields.
This rule detects potential command-and-control (C2) communication associated with the Pikabot malware. The detection looks for outbound HTTP POST requests to external networks that lack a 'Content-Type' header and contain a non-empty, specifically sized request body, which are behavioral indicators consistent with Pikabot beaconing activity.
Detects HTTP GET requests originating from internal hosts to external destinations where the User-Agent string contains 'AutoIt'. This behavior is indicative of the DarkGate malware downloading additional payloads or components using AutoIt scripting capabilities.
Detects outbound HTTP POST requests to a specific URL pattern (/board/fckeditor/userfiles/editor/board.php) associated with the Chinotto backdoor used by the APT37 threat group. The rule monitors for a specific Chrome user agent and a 'token=' cookie value, indicating a potential C2 check-in.
Detects network activity associated with the Psychedelic Stealer malware, including C2 check-ins, API-based tasking, and communication with known C2 infrastructure using specific URI patterns and headers like 'X-API-Key'.
Detects HTTP traffic patterns associated with the Psychedelic Stealer malware command and control (C2) agent. The rule matches specific URI paths used for pinging, configuration retrieval, and tasking, while verifying the presence of the required 'X-API-Key' header, indicating established C2 communication.
Detects HTTP traffic patterns associated with the Psychedelic Stealer malware command and control (C2) agent. The rule matches specific URI paths used for pinging, configuration retrieval, and tasking, while verifying the presence of the required 'X-API-Key' header, indicating established C2 communication.
Detects network traffic attempting to connect to common public DNS-over-HTTPS (DoH) providers (Cloudflare, Google, Quad9) via TLS SNI or HTTP headers. This activity is often associated with malware or malicious agents attempting to bypass traditional DNS monitoring for command and control (C2) communication.
Detects outbound HTTP POST requests associated with the Psychedelic Stealer malware, which attempts to exfiltrate data from web browser-based cryptocurrency wallet extensions by targeting specific API endpoints and wallet extension IDs.
Detects malicious interactions with an unauthenticated Docker daemon API, specifically identifying the creation of privileged containers with host bind mounts, the deployment of containers with specific naming conventions for network reconnaissance (netns-probe/net-setup), subsequent container start events, and the use of the Docker exec API to perform host namespace escapes via nsenter.
Page 28 of 124