Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects HTTP beaconing and command-and-control (C2) communication patterns consistent with the 'Corp_MDM' Android spyware, specifically heartbeat check-ins, command polling, and result reporting to a known malicious C2 IP address.
This rule detects attempts to exploit the authentication bypass vulnerability in Dahua firmware (CVE-2021-33045) via the JSON-RPC interface. The attacker attempts to manipulate the 'loginType' and 'ipAddr' fields, specifically using 'Loopback' as the login type and '127.0.0.1' as the IP address to bypass security controls.
Detects network communication associated with the SectopRAT/ArechClient2 remote access trojan, specifically identifying its characteristic length-prefixed, AES-encrypted command-and-control handshake on non-standard ports. The rule matches traffic containing a specific length-prefixed packet structure starting with null bytes, typically seen during C2 check-in.
Detects network activity related to the SectopRAT malware downloading a secondary module named 'WbElevation.dll' from a known command and control (C2) server. This module is typically associated with browser credential theft functionality.
Detects network activity related to the SectopRAT malware downloading a secondary module named 'WbElevation.dll' from a known command and control (C2) server. This module is typically associated with browser credential theft functionality.
Detects anomalous C2 traffic associated with SectopRAT that leverages JSON-RPC 'eth_call' methods on 'binance.org'. The detection monitors for a specific POST request pattern followed by a response containing 'START' and 'FINISH' markers within the result field, indicating command-and-control communication disguised as blockchain interactions.
Detects anomalous C2 traffic associated with SectopRAT that leverages JSON-RPC 'eth_call' methods on 'binance.org'. The detection monitors for a specific POST request pattern followed by a response containing 'START' and 'FINISH' markers within the result field, indicating command-and-control communication disguised as blockchain interactions.
Detects anomalous C2 traffic associated with SectopRAT that leverages JSON-RPC 'eth_call' methods on 'binance.org'. The detection monitors for a specific POST request pattern followed by a response containing 'START' and 'FINISH' markers within the result field, indicating command-and-control communication disguised as blockchain interactions.
This rule detects network communication (DNS queries and TLS connections) to known actor-controlled Slack workspace subdomains, as well as the presence of a specific hardcoded public key in Slack API traffic, suggesting the use of Slack as a Command and Control (C2) channel.
Detects HTTP GET requests to external services 'trycloudflare.com' or 'workers.dev' that return a file content starting with the 'MZ' and 'PE' header signatures within the first 256 bytes, indicating a Windows executable payload download often associated with AvisLoader activity.
Detects HTTP GET requests to external services 'trycloudflare.com' or 'workers.dev' that return a file content starting with the 'MZ' and 'PE' header signatures within the first 256 bytes, indicating a Windows executable payload download often associated with AvisLoader activity.
Detects a sequence of Tox P2P protocol packets consisting of a Cookie Request, Cookie Response, and Crypto Handshake within a single network flow. This pattern is indicative of the Tox P2P protocol, which is sometimes abused by malware (e.g., AvisLoader) for command-and-control (C2) communications to evade traditional network inspection.
Detects unauthenticated or unauthorized access attempts to critical Oracle PeopleSoft PeopleTools endpoints (such as PSIGW, PSC, or PORTAL). These detections trigger when suspicious requests are made to these sensitive paths without expected authentication headers or session tokens, potentially indicating an exploitation attempt as described in CVE-2026-35273.
Detects HTTP PUT requests that follow a specific pattern associated with MacSync Stealer's exfiltration mechanism. The rule identifies multipart data transmission by looking for specific URI parameters ('upload_id', 'chunk_index', 'total_chunks') used to piece together stolen ZIP files over an established HTTP connection.
Detects an unauthenticated remote code execution (RCE) attempt against Langflow via the /api/v1/validate/code endpoint. The rule monitors for POST requests containing code execution patterns such as eval, exec, os.system, or subprocess, indicating an attacker attempting to leverage the vulnerability to execute arbitrary commands.
This rule monitors for network traffic directed to 'gitnow.dev' using TLS SNI or HTTP headers consistent with WebSocket upgrades. This domain is associated with 'ClickFix' social engineering campaigns where attackers instruct users to copy and paste malicious code into a terminal to establish a reverse-tunnel C2 connection.
Detects HTTP traffic originating from curl user agents attempting to communicate with known MacSync Stealer command-and-control URI patterns, specifically targeting GET check-in requests and POST payload exfiltration requests.
Detects anomalous DNS queries with high-entropy or encoded labels that exceed 40 characters in size, potentially indicating DNS tunneling used for Command and Control (C2) communication.
Detects a specific 4-byte handshake pattern ("\x11\x22\x33\x44") within the initial data of a TCP stream, identifying the C2 communication handshake of the SparroWocky backdoor associated with the FamousSparrow threat actor.
Detects network activity associated with NetSupport Manager remote access software, specifically targeting DNS lookups, TLS SNI connections, and direct TCP beaconing to a known-malicious infrastructure IP. This rule is designed to identify unauthorized use of legitimate remote support tools for command and control purposes.
This rule detects network traffic indicative of the SCKIT MemTensor worm establishing a command-and-control (C2) beacon. The detection identifies TLS connections where the Server Name Indication (SNI) matches a specific pattern of a 12-character hexadecimal string followed by .skyleen.fr.
Page 33 of 124