Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
503 detections
Filters
Last updated
All Time
Detection languages
497
4
1
1
Contributors
179
113
95
78
14
Categories
426
334
222
151
83
Platforms
458
23
15
14
13
Products / Services
466
447
32
10
5
MITRE Techniques
275
174
66
60
58
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
204
121
90
51
8
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
Detects the handshake process for Blackwood/Chisel reverse SOCKS5 or TCP-over-HTTP tunneling to a known malicious Iranian-hosted C2 IP address. The detection matches specific HTTP headers used by the Chisel tool during its initialization phase.
Detects the handshake process for Blackwood/Chisel reverse SOCKS5 or TCP-over-HTTP tunneling to a known malicious Iranian-hosted C2 IP address. The detection matches specific HTTP headers used by the Chisel tool during its initialization phase.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Detects a network connection handshake indicating the use of Chisel, a fast TCP/UDP tunnel over HTTP, specifically identifying potential command-and-control beaconing activity.
Detects a network connection handshake indicating the use of Chisel, a fast TCP/UDP tunnel over HTTP, specifically identifying potential command-and-control beaconing activity.
Detects a network connection handshake indicating the use of Chisel, a fast TCP/UDP tunnel over HTTP, specifically identifying potential command-and-control beaconing activity.
Detects network activity related to the 'Blinder Tunnel' C2 infrastructure. The rules identify a Chisel tunnel client initiating a WebSocket handshake (identifiable by the 'chisel-v3-channel' header) to external infrastructure and a DNS lookup for a specific domain (soroshpasargad.com) identified as a relay nameserver used by the threat actor CL-STA-1178.
This rule detects outbound network connections directed at a known IP address associated with Akira ransomware infrastructure. The rule specifically monitors for communication with 64.227.4.134, which has been identified as a C2 node utilizing GOST tunnels. This behavior is indicative of established C2 connectivity by Akira ransomware actors.
This rule detects outbound network connections directed at a known IP address associated with Akira ransomware infrastructure. The rule specifically monitors for communication with 64.227.4.134, which has been identified as a C2 node utilizing GOST tunnels. This behavior is indicative of established C2 connectivity by Akira ransomware actors.
Detects outbound HTTP requests to a known C2 domain (letsdiskuss.com) and a specific URI path, characteristic of the 'Lorem Ipsum' malware loader's dead-drop resolver lookup.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Detects TLS connections to a specific, potentially adversary-controlled ScreenConnect relay infrastructure endpoint. Adversaries frequently abuse legitimate remote access tools like ScreenConnect for command and control purposes.
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
This rule detects outbound network connections directed at a known IP address associated with Akira ransomware infrastructure. The rule specifically monitors for communication with 64.227.4.134, which has been identified as a C2 node utilizing GOST tunnels. This behavior is indicative of established C2 connectivity by Akira ransomware actors.
Detects TLS connections to a specific, potentially adversary-controlled ScreenConnect relay infrastructure endpoint. Adversaries frequently abuse legitimate remote access tools like ScreenConnect for command and control purposes.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Detects TLS connections to a specific, potentially adversary-controlled ScreenConnect relay infrastructure endpoint. Adversaries frequently abuse legitimate remote access tools like ScreenConnect for command and control purposes.
Detects network traffic matching the default HTTP check-in pattern of Mythic C2 agents. This rule monitors for POST requests using a specific hardcoded User-Agent string and Content-Type header commonly used in default Mythic agent configurations, indicating a potential active command-and-control session.
Detects specific markers in UDP traffic on ports 3478, 5349, and 443 that are associated with the DragonForce malware's TRN1 C2 beaconing protocol. The rules identify session initiation, task polling, task acknowledgment, and result uploading behaviors.
Detects TLS connections to a specific, potentially adversary-controlled ScreenConnect relay infrastructure endpoint. Adversaries frequently abuse legitimate remote access tools like ScreenConnect for command and control purposes.
Page 1 of 24