Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
338 detections
Filters
Last updated
All Time
Detection languages
120
98
40
28
21
Contributors
66
66
65
53
13
Categories
148
107
105
82
53
Platforms
254
113
56
29
5
Products / Services
10,665
9,758
6,693
4,421
3,749
338
MITRE Techniques
158
96
45
41
35
CVEs
3
3
2
2
2
IDS Classtypes
17
3
3
2
2
IDS Protocols
18
4
3
2
2
Detects privileged Active Directory enumeration seen on the wire by Corelight, filtered to source hosts that don't appear in the Cortex endpoint inventory. It reads ldap_search records from corelight_zeek_raw, tiers them by the LDAP filter (CRITICAL for credential-attribute and DCSync hunting, HIGH for Tier Zero, Kerberoast, delegation, and UAC-bitmask targeting, MEDIUM for broad group, computer, and GPO enumeration), then joins the source address against endpoints and keeps only the queries whose id_orig_h has no matching managed agent
This rule monitors Kerberos TGS (Ticket-Granting Service) requests for suspicious patterns indicative of Kerberoasting, specifically looking for the use of weak encryption algorithms (RC4 or DES) and high volumes of service ticket requests for unique Service Principal Names (SPNs). It groups activity by source host and time window, flagging activity that involves DES encryption or a significant number of unique SPN requests. Great for detecting kerberoasting activity from unmanaged or rogue devices
Detects DNS queries to mangorbit.com and its subdomains, C2 infrastructure associated with the Open VSX Evil Twin extensions campaign
Detects SSH traffic originating from designated edge appliances (e.g., firewalls, NAS devices) directed towards internal network destinations. This pattern is often indicative of network pivoting, lateral movement, or unauthorized remote access from exposed or compromised perimeter assets.
This rule detects potentially unauthorized or suspicious WebSocket connections established over TCP port 1313. It specifically looks for Socket.IO traffic utilizing the 'EIO=4' protocol version and 'websocket' transport, while explicitly checking for the absence of Authorization headers and Sec-WebSocket-Protocol headers. The pattern matching on the raw payload suggests identification of initial handshake or messaging sequences (e.g., '0{' or '40') indicative of unauthenticated interaction with a WebSocket service.
Detects evidence of exploitation attempts related to the hypothetical CVE-2026-55200 vulnerability. The rule monitors for known exploit file names, command-line arguments, and specific network patterns targeting SSH ports (22, 2222) that indicate potential LibSSH2 exploitation.
Detects anomalous outbound network traffic from Firefox processes indicative of CVE-2025-15661 exploitation. The rule monitors for communication with a specific non-standard port (8765) associated with a SmartWindow PoC server, or requests containing suspicious URI query parameters ('u0', 'u1', 'u2', 'source=history') frequently used for exfiltrating private browsing tabs and history via the '/leak' endpoint.
This rule detects network communication (DNS, connection, or traffic) with known infrastructure and specific URI paths associated with the SpectralViper threat actor. It enriches these findings by identifying if the communication originated from processes commonly associated with SpectralViper, such as OneDrive Sync services or specific Intel audio service files.
This rule monitors DNS query traffic for unusually long, encoded subdomain labels (50 characters or more). Such patterns are indicative of data exfiltration or command-and-control (C2) communication using DNS tunneling tools like iodine or dnscat2, which encapsulate non-DNS protocols within the DNS query structure to evade network inspection.
Detects Python processes spawned by development tools (VSCode, Cursor) or Node.js that are engaged in suspicious activities, specifically communicating with the Telegram Bot API or uploading large amounts of data, often accompanied by file staging (ZIP archive creation). This behavior is characteristic of the InvisibleFerret information stealer.
This rule identifies potential BRICKSTORM command and control (C2) activity by detecting sustained beaconing patterns to known public DNS-over-HTTPS (DoH) providers (8.8.8.8, 1.1.1.1) over port 443. It buckets network connections into 10-minute windows and flags source devices exhibiting frequent, repetitive traffic patterns, enriched with asset context to prioritize alerts from edge appliances such as firewalls, NAS devices, or storage sync services.
Detects the presence and execution of RustDesk remote access software by monitoring process names, command-line arguments, specific destination network ports, and DNS queries associated with the application. This rule identifies potential unauthorized remote access attempts or the use of non-approved remote support tools.
Detects anomalous HTTP upgrade requests (h2c, websocket) targeting potentially vulnerable web infrastructure (e.g., nghttpx). The rule correlates abnormal 'Upgrade' header usage, suspicious request paths (/poisoned, /upgrade), and subsequent 400 error codes, which are indicative of HTTP request smuggling attempts aimed at desynchronizing frontend and backend request queues.
Campaign converting compromised FortiGate firewalls into credential stealers
Detects suspicious processes commonly associated with malicious activity establishing outbound network connections to Azure Web Apps domains. The rule aggregates connections to identify potential beaconing behavior by monitoring connection frequency and duration, flagging activity initiated by binaries frequently used for living-off-the-land attacks such as powershell.exe, rundll32.exe, and others.
This rule detects high-volume or repeated outbound connections to Mega cloud storage domains (mega.nz, mega.co.nz, etc.) by processes that are not identified as standard web browsers. Such activity may indicate data exfiltration, automated file staging, or unauthorized use of cloud storage services.
Detects network proxy activity associated with the 'Polymarket Trap' supply chain attack, where developers are lured into cloning a fake arbitrage bot repository or fetching malicious npm packages from the wshu.net domain. The rule monitors for access to known malicious repositories (Trum3it/polymarket-arbitrage-bot) and malicious dependencies (clob-client-math).
This rule detects network communication with known malicious command-and-control (C2) infrastructure identified by specific domains and IP addresses. The detection logic calculates a confidence score based on the presence of identified malicious C2 domains or IPs, specific suspicious cookies (zd_cs_pm, euconsent-v2), and known C2 URI paths.
Detects network communication associated with BeepRAT malware, specifically targeting hardcoded TCP connections to destination port 18848 and ICMP packets containing the string 'BEEP', which are used for C2 communication and keepalive signals.
This rule identifies suspicious outbound network beaconing by analyzing flow statistics for consistency in interval and payload size. It flags processes that demonstrate periodic communication (heartbeats) to external endpoints on non-standard ports. The detection logic calculates a 'beacon_score' based on the consistency of the communication interval, small average payload sizes, low variance in payload sizes, and the number of connections. Additional weighting is applied to connections made by typically non-network processes (e.g., svchost, explorer, wscript) or those connecting to ports associated with known malware like SystemBC.
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Page 4 of 17