Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,150 detections
Filters
Last updated
All Time
Detection languages
683
377
340
230
173
Contributors
630
378
354
143
119
Categories
839
831
746
391
348
Platforms
1,583
586
494
263
118
Products / Services
10,660
9,755
6,689
4,418
3,748
2,150
MITRE Techniques
655
561
381
335
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
Detects anomalous network traffic patterns indicative of two distinct techniques: P2P injection into Microsoft 365 Copilot search queries and Server-Side Request Forgery (SSRF) leveraging Bing's image search functionality for data exfiltration.
Detects network requests to Google image search containing an 'imgurl' parameter, which can be used by an attacker to exfiltrate data by forcing an external service to crawl a controlled URL containing sensitive information.
Identifies outbound C2 connections to domains generated by MLTBackdoor DGA.
This rule monitors network traffic for suspicious patterns indicating exploitation of LocalStack environments. It detects three primary malicious activities: Velocity Template Language (VTL) injection targeting reflection methods (e.g., ProcessBuilder) for RCE; unauthorized manipulation of API Gateway resources (e.g., creating or modifying deployments) accompanied by IAM scope bypass techniques; and direct execution of RCE-style API triggers against known LocalStack port 4566.
Detects outbound network connections to a known Djinn Stealer C2 IP address (96.126.130.126) on port 58942, utilizing the specific User-Agent 'telemetry-client/1.0' and 'application/octet-stream' content type. This behavior is indicative of data exfiltration of encrypted/compressed archives.
Detects outbound network connections to TCP port 4001, which is the hardcoded default C2 port for SystemBC (Coroxy) malware. The rule identifies suspicious proxy tunnel establishment from Windows workstations, often used by threat actors like Wizard Spider and FIN7 for pre-deployment staging.
Detects network activity associated with Djinn Stealer malware, identifying either direct connections to a known command-and-control (C2) server or HTTP exfiltration attempts using a characteristic User-Agent string and binary content type.
Detects network traffic associated with the EvilTokens phishing kit's 'killed' gate check mechanism. The kit GETs /api/device/gate/<PAGE_ID> with the ngrok-skip-browser-warning header. When the backend returns a killed flag, the phishing page wipes the DOM and renders a fake 'Page Not Found - Microsoft' error to evade analysis or block specific victims.
This rule detects potential cleartext leakage of usernames and passwords over FTP (port 21) by identifying HTTP requests containing common credential-related keywords in the URL, while explicitly excluding HTTPS traffic. This could indicate sensitive information being transmitted insecurely.
This rule detects unauthorized configuration of GRE tunnels on Cisco IOS-XE network devices, potentially indicating persistent command and control (C2) channel establishment via TCL injection or illicit configuration changes involving known attacker infrastructure (62.171.185.97). It correlates network traffic to the attacker IP with process-level activity involving suspicious configuration files, scripts, or device-specific command-line arguments.
Detects unusually large FTP responses containing 'LIST' or 'NLST' commands, potentially indicating an attempt to exploit the Squidbleed vulnerability or similar data exfiltration over FTP. The rule specifically looks for network events on port 21 (FTP) where the action type is 'NetworkSignatureInspected' and the RemoteUrl contains either 'LIST' or 'NLST' with a string length greater than 4000 characters.
Detects host-level evidence of DRAYN malware activity by correlating outbound network connections using a specific websocket-sharp User-Agent to a known command-and-control (C2) IP address with the execution of PowerShell commands performing system UUID fingerprinting (Win32_ComputerSystem).
Detects malicious network connections initiated by wscript.exe or cscript.exe, or file creation events involving known LCRYX malware payloads in the C:\Windows\ directory. It also includes network-level detection using DNS and firewall/proxy logs for known LCRYX malicious domains and IP addresses.
Detects unauthenticated network connections to the Peyara Remote Mouse service on TCP port 1313. This service is known to allow remote control of the host, and such unauthenticated Socket.IO connections are often leveraged by attackers to inject synthetic keyboard events, such as triggering the Windows Start menu.
Detects network traffic associated with DcRAT malware, specifically monitoring outbound connections on port 2671 to external non-private IP addresses, or directly to known malicious infrastructure (223.26.63.40). The rule also identifies potential beaconing behavior by analyzing connection intervals and standard deviation, and flags activity originating from specific autonomous system ranges (AS152194) linked to the threat actor's infrastructure.
Detects outbound network connections to specific cloud storage providers (Wasabi, Tebi, I3Storage) which are commonly leveraged by adversaries for data exfiltration.
Detects network traffic to Cloudflare-hosted services (trycloudflare.com, workers.dev) potentially indicative of C2 communication, especially when initiated by common scripting or proxy processes like powershell.exe, wscript.exe, cscript.exe, mshta.exe, or cloudflared.exe.
This rule detects outbound network connections to common tunneling and proxy services (Cloudflare Tunnel, Cloudflare Workers, and Microsoft Dev Tunnels). These services are frequently abused by threat actors, such as the Gamaredon Group (ACTINIUM), to establish command-and-control (C2) channels and tunnel traffic to evade network-based detection systems.
Detects potential Browser-in-the-Middle (BitM) phishing activity by identifying a client browser that fetches the 'rrweb' session-recording library followed by a WebSocket connection to a different origin within 5 minutes. This sequence is indicative of an attacker-controlled browser streaming the victim's DOM and interaction events to a phishing infrastructure.
Detects web traffic containing specific randomized CSS filter properties on top-level elements, frequently seen in Bluekit PhaaS toolkits. These properties are used to alter the visual hash of the rendered page, complicating automated screenshot or pixel-based analysis by security vendors. This technique is often combined with suspicious URL patterns indicative of credential harvesting sites.
Detects browser-based WebRTC STUN traffic initiated from phishing landing pages used by the Bluekit PhaaS platform. The rule identifies suspicious STUN requests originating from browsers that exhibit a WebRTC IP mismatch when compared to the active HTTPS session IP, a technique used by attackers to de-anonymize security researchers and bypass automated analysis sandboxes.
Page 63 of 103