Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,146 detections
Filters
Last updated
All Time
Detection languages
679
377
340
230
173
Contributors
630
378
354
143
119
Categories
835
831
746
387
348
Platforms
1,580
584
492
263
118
Products / Services
10,652
9,755
6,688
4,418
3,745
2,146
MITRE Techniques
655
561
377
331
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
Detects network outbound connections to known CDN domains over port 8084. This activity is often associated with the use of specific C2 frameworks (e.g., SNOWLIGHT or VSHELL) that leverage legitimate cloud infrastructure to blend malicious traffic within common CDN communication patterns.
Detects network traffic associated with TrymeLocker malware, specifically targeting Telegram API communications containing hardcoded identifiers and geolocation lookups via ipinfo.io.
This rule detects potential command and control (C2) activity associated with the SNOWLIGHT framework by identifying outbound WebSocket connections over HTTP to a specific known C2 IP (38.60.253.35) and port (8084). It correlates network flow logs (CommonSecurityLog) containing specific HTTP URL parameters (a=w64, t=ws_, p=8084) with EDR process network events (DeviceNetworkEvents) where the Windows Update Service process (wusvc.exe) is the initiator, indicating potential process masquerading or injection.
Detects a specific DNS-over-TCP exploitation sequence used to trigger a Use-After-Free (UAF) vulnerability in the c-ares library. The rule monitors for a series of DNS responses from a resolver containing a FORMERR (RCODE=2) response without an OPT RR, followed immediately by a TCP Reset (RST) packet. This pattern is characteristic of the exploitation attempt against applications utilizing c-ares, such as Node.js, curl, gRPC, Envoy, and Wireshark.
Detects a specific DNS-over-TCP exploitation sequence used to trigger a Use-After-Free (UAF) vulnerability in the c-ares library. The rule monitors for a series of DNS responses from a resolver containing a FORMERR (RCODE=2) response without an OPT RR, followed immediately by a TCP Reset (RST) packet. This pattern is characteristic of the exploitation attempt against applications utilizing c-ares, such as Node.js, curl, gRPC, Envoy, and Wireshark.
This rule monitors web request URLs and associated messages for common SQL injection characters and sequences, such as quotes and semicolons. It specifically targets requests involving the 'apiuser' account to identify potential attempts to manipulate or exploit backend database queries.
Detects outbound network connections from internal hosts to domains associated with the Polymarket Trap / Miasma infostealer campaign, including dedicated servers (stitch-production.org, log-taker.store) and vercel.app serverless endpoints used for credential exfiltration.
Detects one web session posting username, password, and MFA or one-time-code form fields through the same intermediary host. This behavior is indicative of an Adversary-in-the-Middle (AiTM) attack, where an attacker intercepts and relays authentication requests, including multi-factor authentication (MFA) codes, to gain unauthorized access.
Detects HTTP POST requests directed at PHP script endpoints with randomized 16-32 character hexadecimal filenames, which is a known C2 communication pattern used by the StealC infostealer.
This rule detects network activity associated with the StealC information stealer, specifically focusing on HTTP POST requests made to known command-and-control (C2) domains. It identifies characteristic URL patterns, such as randomly generated 16-character PHP files or specific index.php structures, which are used for bot registration and communication. The detection includes patterns indicative of RC4-encrypted payloads and behavior mimicking Amadey bot status checks.
This rule detects a high frequency of successful network connections from a single device to multiple unique destination IP addresses within a one-hour window. The targeted ports (445, 139, 3389, 22, 21) are commonly used for remote administrative access, file transfers, and remote shell services, which are frequently leveraged by adversaries for lateral movement. The threshold of 3 unique targets in an hour may indicate automated scanning or credential brute-forcing activity across the network.
This rule detects two distinct but related network-based adversary-in-the-middle (AiTM) techniques. The first part identifies ARP spoofing by looking for the same IP address being claimed by multiple MAC addresses within a short time frame, which can indicate an attacker is attempting to intercept local network traffic. The second part detects TLS certificate pinning failures, which can occur when an attacker attempts to perform a man-in-the-middle attack by presenting an untrusted or modified TLS certificate to a client that expects a specific certificate (pinning). This is often indicative of an attempt to intercept or decrypt encrypted network communications.
Detects repeated restarts of vLLM pods (due to OOMKilled, CrashLoopBackOff, or other failure reasons) that are correlated with a burst of multimodal requests. This pattern can indicate a denial-of-service attack, resource exhaustion, or exploitation of vulnerabilities (such as CVE-2026-22778) targeting the vLLM service, potentially leading to service instability or compromise.
This rule detects command and control (C2) communication patterns associated with the Millenium RAT malware. It identifies suspicious traffic to 'api.telegram.org' utilizing the 'getUpdates' method initiated by processes that do not identify as standard web browsers, as well as traffic directed to the known proxy relay domain '75877.mcdir.me'.
Detects network activity associated with the DcRAT trojan as identified in Operation DragonReturn. This includes outbound network connections to hardcoded C2 port 2671, connections to known malicious IP addresses, and DNS resolutions of identified attacker-controlled C2 domains.
Detects anomalous network traffic patterns communicating with the Telegram Bot API (api.telegram.org) from non-official Telegram processes. The rule identifies potential command and control (C2) activity by analyzing request frequency, specific API method usage (e.g., getUpdates, sendMessage), and beaconing-like behavior.
Detects network traffic using the Generic Routing Encapsulation (GRE) protocol originating from or destined to external (non-private) IP addresses. GRE is often used for tunneling and can be abused to bypass network security controls.
Detects anomalous network traffic patterns indicative of two distinct techniques: P2P injection into Microsoft 365 Copilot search queries and Server-Side Request Forgery (SSRF) leveraging Bing's image search functionality for data exfiltration.
Detects network requests to Google image search containing an 'imgurl' parameter, which can be used by an attacker to exfiltrate data by forcing an external service to crawl a controlled URL containing sensitive information.
Identifies outbound C2 connections to domains generated by MLTBackdoor DGA.
This rule monitors network traffic for suspicious patterns indicating exploitation of LocalStack environments. It detects three primary malicious activities: Velocity Template Language (VTL) injection targeting reflection methods (e.g., ProcessBuilder) for RCE; unauthorized manipulation of API Gateway resources (e.g., creating or modifying deployments) accompanied by IAM scope bypass techniques; and direct execution of RCE-style API triggers against known LocalStack port 4566.
Page 62 of 103