Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,773
6,705
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects the use of the FTP 'STOR' command to transmit a file with the '.pcap' extension to an external network. This behavior is indicative of potential data exfiltration where captured network traffic is being uploaded to an attacker-controlled server.
This rule detects unauthenticated TCP connection attempts targeting ports 43210 and 43211, which are associated with the Nexus 9000 S1HAL service. These attempts are indicative of potential exploitation activity related to CVE-2026-20212.
Detects network requests originating from the Netch gateway tool or similar environments, attempting to fetch auto-configuration profiles for Shadowsocks from the external domain 'www.sheng886.top' using the '/api/v1/internal/shadowsocks/auto-config' endpoint. The rule specifically matches the Go-http-client user agent, which is common in automated scripts and Go-based proxy tools.
Detects an HTTP POST request targeting the host 'tt.yeyoujs.com' at the URI path '/api/agent/enroll', containing a specific Python aiohttp User-Agent string. This pattern is characteristic of a C2 agent attempting to register or enroll with an external command-and-control server.
This rule detects inbound HTTP GET requests to a specific IP address (103.86.86.244) requesting a file named 'deploy.ps1'. This behavior is characteristic of adversaries using PowerShell one-liners (cradles) like 'irm' (Invoke-RestMethod) or 'iex' (Invoke-Expression) to fetch and execute malicious scripts directly from a remote C2 infrastructure.
Detects DNS queries and TLS SNI traffic originating from internal hosts directed towards a specific set of domains associated with passkey/MFA/SSO-themed vishing lures. These domains are identified as potential components of phishing campaigns designed to deceive users into disclosing authentication credentials.
Detects network activity related to the Toy Ghouls 'matrix-bird-agent' backdoor. The rule identifies communication with the domain 'meet.element.tw' via TLS SNI and HTTP host headers, as well as specific Matrix API event types (m.bird.status, m.bird.metrics, m.bird.cmd_response) and references to 'panel-bot' within the HTTP request body, indicating potential command-and-control behavior.
Detects periodic TLS network beacons to external destinations on port 443, characteristic of the BridgeAgent malware. The rule identifies suspicious outbound connections that exhibit consistent, repetitive behavior patterns, potentially indicating C2 communication. It is recommended to correlate this network activity with EDR alerts focusing on masquerading processes, specifically instances where binaries like gnome-shell are running as root and persisted via service mechanisms like zabbix_agent.service.
Detects network-based command signaling shared by the Fire Ant/REPTILE-derivative backdoor and its reverse-tunneling implant capability. Identifies the 'magic string' activation sequence and matching 'kill marker' termination sequence over TCP and UDP — indicative of packet-triggered backdoor activation, port-knocking style C2, or reverse-tunnel establishment via raw socket communication.
Detects network traffic within the internal network that matches the initial handshake phase of a SOCKS proxy connection. This is a common indicator of an attacker using an internal system to proxy command and control (C2) traffic or pivot within the network using tools like HTRAN, ZXProxy, or custom implementations.
Detects unauthenticated attempts to invoke Grafana API tools via the Model Context Protocol (MCP) by utilizing spoofed Mcp-Session-Id headers while bypassing bearer token authentication requirements. This primarily targets unauthorized access to API functionality on Grafana instances configured with bearer-token authentication (v1.1.0+).
Detects outbound network traffic associated with StyleSmuggler C2 infrastructure. The rule identifies established TLS connections to a known malicious IP address (99.84.67.186) and monitors for WebSocket-over-TLS traffic using the suspicious SNI 'windwsecurity.run'.
This rule detects an unauthenticated exploitation attempt against Magento GraphQL endpoints, specifically targeting the 'styles' parameter. The attack pattern involves sending a malformed request to the /graphql endpoint with an 'X-TRACE-' header, which is indicative of the StyleSmuggler vulnerability exploit.
Detects anomalous, high-frequency inbound TCP connection attempts to port 102 (S7comm), which is used by Siemens S7 PLCs. This behavior is indicative of automated network scanning or reconnaissance targeting industrial control system (ICS) infrastructure.
This rule detects command and control (C2) communication patterns utilized by the GoCaracal malware family, specifically its fallback mechanism which leverages Ethereum blockchain RPC calls (eth_getStorageAt) to interact with known malicious smart contracts or wallet addresses.
Detects incoming S7comm/ISO-TSAP connection attempts directed at Siemens Programmable Logic Controllers (PLCs) originating from an external network. This behavior is indicative of unauthorized access or reconnaissance attempts against Industrial Control System (ICS) assets.
Detects network activity (DNS queries, TLS SNI, and HTTP Host headers) directed towards domains ending in the .vu Top-Level Domain (TLD). This is associated with NovaCookies phishing infrastructure which utilizes these TLDs for malicious redirection or staging.
Detects anomalous OAuth redirection chains initiated from login.microsoftonline.com or accounts.google.com that target infrastructure identified as malicious .vu domains. This pattern is indicative of a consent-phishing campaign attempting to redirect users to malicious infrastructure.
Detects FTP STOR commands associated with the transfer of files with a .pcap extension, which may indicate the exfiltration of captured network traffic from a network device or server.
Detects periodic outbound TLS connections over port 443 exhibiting beaconing behavior (5+ established connections with a non-empty SNI from a source host within 300 seconds), consistent with BridgeAgent malware C2 heartbeat/reverse-shell maintenance. Correlate with EDR detections of a process masquerading as /usr/bin/gnome-shell running as root and persisted via a fraudulent zabbix_agent.service.
This rule monitors for HTTP traffic directed at .vu TLD domains, which contain the specific Cloudflare 'Just a moment' browser-check page. This pattern is characteristic of the NovaCookies Phishing-as-a-Service (PhaaS) platform, which uses such gates to prevent automated analysis and security scanners from accessing the final phishing page.
Page 90 of 124