Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,146 detections
Filters
Last updated
All Time
Detection languages
679
377
340
230
173
Contributors
630
378
354
143
119
Categories
835
831
746
387
348
Platforms
1,580
584
492
263
118
Products / Services
10,680
9,761
6,694
4,418
3,744
2,146
MITRE Techniques
655
561
377
331
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
Detects network traffic matching patterns used by the Chrysalis backdoor for C2 communications. The malware was observed using the domain 'api.skycloudcenter.com' and mimicking DeepSeek AI API URL paths to evade detection.
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google AuraInspector Salesforce Aura Audit. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: an HTTP POST to a Salesforce /aura endpoint that includes specific Aura method strings. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat- intelligence/auditing-salesforce-aura-data-exposure) to document where the indicator came from and to support incident notes and reporting.
Detects network connections to Hugging Face to download a large Large Language Model (LLM) module, a technique used by the SURXRAT Android RAT to induce network lag and degrade device performance.
This rule set detects various activities associated with the Dohdoor malware campaign (UAT-10027). It includes detection for known malware hashes, suspicious network communication patterns such as DNS over HTTPS (DoH) to Cloudflare with specific user agents, staging URL patterns, and odd-cased infrastructure domains. Additionally, it identifies endpoint activities like curl downloading batch/command files and DLL sideloading attempts using specific DLL names and LOLBins executed from common public writeable directories. The intent is to provide strong leads for investigation into potential Dohdoor infections.
Identifies network connections to known command and control (C2) and dropper distribution infrastructure associated with the EncystPHP web shell campaign.
Detects network connections from the Claude Code CLI ('claude' or 'claude.exe') to a destination other than the official 'api.anthropic.com' endpoint. This indicates that the 'ANTHROPIC_BASE_URL' environment variable has likely been overridden by a malicious '.claude/settings.json' configuration file in an attempt to intercept and exfiltrate API keys, as described in CVE-2026-21852.
This rule detects activity associated with a specific threat actor targeting FortiGate devices. It identifies network connections to known threat actor infrastructure IPs, attempts to access FortiGate management ports (443, 8443, 10443, 4443) over TCP, and successful administrative or VPN authentications from the threat actor's IPs in Fortinet/FortiGate logs. Additionally, it looks for DCSync-style directory replication access (event ID 4662) in Windows Security logs, indicating potential Active Directory compromise.
This rule detects activity related to the EmEditor watering hole attack, specifically looking for PowerShell execution making requests to known malicious lookalike domains and network connections to the associated infrastructure. A match suggests a potential download of malicious code during what appeared to be a legitimate install or update. Investigation should focus on identifying the host, user, source of activity, and legitimacy of the install source, followed by evidence preservation, credential reset, and a search for follow-up malicious activity.
This rule detects suspicious network connections to known threat actor infrastructure associated with FortiGate exploitation, successful administrative or VPN logins to FortiGate devices from these IPs, and DCSync-style directory replication access (EventCode 4662) on Windows systems. The rule is composed of three distinct parts targeting different aspects of the attack chain.
Detects non-browser processes making outbound connections to specific Google Sheets API endpoints used by the GRIDTIDE backdoor for command and control. This activity is indicative of the malware using legitimate cloud services to disguise its C2 traffic.
This rule detects activity associated with UNC6201 exploiting Dell RecoverPoint VM (CVE-2026-22769), which involves the SLAYSTYLE/BRICKSTORM/GRIMBOLT malware. It identifies attempts to deploy WAR files via Tomcat Manager, suspicious WAR file uploads or modifications in Tomcat directories on Linux appliances, modifications to a persistence script named 'convert_hosts.sh', network communication with a GRIMBOLT C2 endpoint (149.248.11.71), and specific file hashes linked to the threat actor.
This rule detects a potential quishing (QR code phishing) attack followed by a suspicious successful sign-in to Entra ID (formerly Azure AD). It correlates URL click events or device network events containing deep link indicators (like 'tg://login', 'wa.me/settings/linked_devices', 'signal://', 'line://') or '.apk' file downloads with a successful Entra ID sign-in by the same user within a 30-minute window. This behavior suggests a user may have scanned a malicious QR code, clicked a phishing link, or downloaded a malicious application, leading to a successful but potentially compromised authentication.
This rule detects activity associated with the DYNOWIPER malware, identified by specific SHA256 hashes on endpoint telemetry or by network connections to known command and control (C2) IP addresses. The rule is split into two parts: one for endpoint detection based on file hashes and another for network/authentication logs based on IP addresses.
This rule detects activity related to the DKnife gateway AitM (Adversary-in-the-Middle) threat, as detailed in Talos Intelligence reporting. It identifies specific binary names (dknife.bin, sslmm.bin, postapi.bin, rules.bin, sshapi.bin, inotify.bin, curlapi.bin) associated with the threat, either as process names or file names. Additionally, it looks for configuration artifacts (rules.conf, sslmm.cfg, url.cfg) used by the proxy/redirect logic, either as file names or within process command lines. Finally, the rule identifies exfiltration or tagging markers (dkimsi=, 460110672021628, PASSWORD) observed in logs or artifacts, which are indicative of DKnife's reporting mechanisms.
This rule detects two related activities that could indicate the use of AI webchat services as a covert C2 proxy via WebView2. The first part identifies network connections to specific AI webchat domains (grok.com, copilot.microsoft.com) via proxy or web logs. The second part identifies the creation of the 'msedgewebview2.exe' process by unusual parent processes, excluding common browsers and Microsoft Office applications. This combination aims to catch scenarios where WebView2, often used by AI webchat applications, is leveraged for malicious command and control.
Detects access to file sharing and exfiltration services reported in the Unit 42 Muddled Libra operational playbook, including S3 Browser and multiple upload services.
This rule detects activity associated with the RenEngine campaign, which utilizes HijackLoader to deliver Lumma Stealer and ACR Stealer. It identifies malicious activity through three main methods: 1) Endpoint detection of known MD5 hashes associated with the malware, 2) Network traffic (proxy/DNS/netflow) to distribution sites used by the campaign, and 3) Network traffic (proxy/DNS/netflow) to known Lumma Stealer C2 domains.
Detects downloads of the Huorong themed archive name reported in a ValleyRAT delivery chain.
Detects processes associated with Dohdoor malware making network connections to Cloudflare's DNS-over-HTTPS service for C2 domain resolution.
This rule detects various indicators associated with the Booking.com phishing campaign targeting hotels and customers. It identifies suspicious web requests to non-Booking.com domains containing 'op_token' and 'complaint' or 'reservation' keywords, especially when combined with punycode, 'booklng' typos, or management-related subdomains. It also looks for partner kit patterns involving 'sign-in/?tpo_token=' and 'booklng' in URLs. Additionally, it identifies suspicious emails from newly generated Gmail accounts with specific subjects ('Automatic reply', 'Availability', 'Reservation') containing 'op_token' in the subject or body.
This rule detects potential exploitation attempts against Grandstream GXP1600 series IP phones related to CVE-2026-2329. It specifically looks for HTTP requests to the '/cgi-bin/api.values.get' endpoint where the 'request' parameter in the URI query string has a length greater than or equal to 65 characters, which could indicate an attempt to trigger a buffer overflow or similar vulnerability.
Page 83 of 103