Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
503 detections
Filters
Last updated
All Time
Detection languages
497
4
1
1
Contributors
179
113
95
78
14
Categories
426
334
222
151
83
Platforms
458
23
15
14
13
Products / Services
466
447
32
10
5
MITRE Techniques
275
174
66
60
58
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
204
121
90
51
8
Detects outbound TLS-encrypted network traffic directed towards known SilkParasite infrastructure using non-standard high ports commonly associated with RDP-over-TLS (NLA). The rule identifies potential Command and Control (C2) activity by flagging connections to suspicious IP/port combinations typical of this adversary cluster.
Detects network activity associated with the SilkParasite C2 infrastructure (used by SpiceRAT and NodeEdgeRAT malware). The rule monitors for specific impersonated TLS certificates, known malicious IP addresses, and unique JA4X TLS fingerprints associated with these threat actors.
Detects network activity associated with the Rapuncel malware, including raw TCP exfiltration of files via POST requests to /upload, connections to known malicious C2 infrastructure, and repeated exfiltration retry patterns.
This rule monitors network traffic to detect a specific 'Client Hello' beaconing behavior associated with the RMRLX Remote Access Trojan (RAT), identifying potential command-and-control communication directed at a known malicious IP address over TCP port 4561.
Detects network activity associated with the QUICAgent backdoor, including QUIC C2 traffic using a self-signed 'RAT System' certificate, direct connections to a known C2 IP address (104.64.211.22), and DNS queries for the hardcoded C2 domain 'register.mediumser.com'.
This rule detects outbound TLS connections to suspicious domain names characteristic of the Koktevrat malware's DGA. The rule identifies SNI strings that match a specific regex pattern (8-16 alphanumeric characters followed by .icu or .cfd TLDs), which is indicative of automated C2 communication.
This rule detects network traffic directed at the Telegram Bot API (api.telegram.org) where the request URI indicates a bot action ('/bot' followed by 'sendMessage') and the HTTP request body contains the keyword 'VIEW'. This pattern is commonly associated with C2 beacons using Telegram as an intermediary service to send status or command results from compromised hosts.
Detects suspicious FTP command and control traffic originating from internal hosts to known compromised servers in Taiwan. The rules monitor for specific FTP commands such as STOR (to upload archive4.zip), RETR (to download archive1.zip), and initial authentication (USER command) associated with C2 communication.
Detects network activity associated with the SloppyRAT malware, specifically tracking the polling mechanism for reverse SOCKS proxy tasks and subsequent acknowledgment of these tasks via HTTP requests.
Detects network traffic indicative of an adversary using the Ethereum blockchain as a dead-drop C2 channel. The rules identify specific JSON-RPC methods (eth_getTransactionByHash, eth_call) typically associated with querying blockchain data for C2 instructions, as well as non-browser processes initiating these requests to external endpoints.
Detects outbound HTTP POST requests to known public Ethereum RPC gateways (Alchemy and Infura) containing embedded, hardcoded API keys or references to specific contract addresses associated with the 'indexed-btree' malware campaign. This pattern indicates a compromised host leveraging legitimate Web3 infrastructure for Command and Control (C2) communication.
Detects specific command strings ('proxy_open', 'proxy_data', 'proxy_close') associated with the Koktevrat Android RAT's tunneling functionality. The rule monitors outbound TCP traffic to identify the initiation, data transfer, and termination phases of a proxy connection, leveraging Suricata flowbits to track the state of the C2 tunnel.
Detects anomalous TLS traffic characterized by an empty Server Name Indication (SNI) field in the TLS handshake, combined with a high frequency of such connections. This behavior is indicative of certain proxy protocols like Xray VLESS with REALITY, which are often used to evade Deep Packet Inspection (DPI) and traffic shaping policies by disguising C2 or tunneling traffic as legitimate-looking TLS connections.
Detects anomalous TLS traffic characterized by an empty Server Name Indication (SNI) field in the TLS handshake, combined with a high frequency of such connections. This behavior is indicative of certain proxy protocols like Xray VLESS with REALITY, which are often used to evade Deep Packet Inspection (DPI) and traffic shaping policies by disguising C2 or tunneling traffic as legitimate-looking TLS connections.
Detects outbound RDP-over-TLS traffic directed toward known SilkParasite C2 IP addresses on specific high-numbered ports, or generic RDP-over-TLS patterns on those same non-standard ports, which suggests tunneling or unauthorized remote access.
Detects periodic beaconing and C2 communication patterns associated with the RapidRust Golang RAT, attributed to the APT36 (Transparent Tribe) threat group. The rule monitors for specific DNS queries to typosquatted domains, TLS SNI mismatches, and specific HTTP API polling activities commonly used by this malware for C2 tasking.
This rule detects network traffic patterns associated with the RatHat malware, specifically the use of 'frpc' (Fast Reverse Proxy Client) to establish a persistent reverse proxy tunnel. The rule monitors for established outbound connections containing the specific byte sequence characteristic of this tool, which is often used by adversaries to facilitate Command and Control (C2) communication.
Detects network activity (DNS lookups, TLS SNI, and HTTP Host headers) associated with proxy infrastructure (iproyal.com and lightningproxies.net) known to be used by the HEAVYGRAM/CHOSEN BRICK threat actors to mask Telegram-based command and control traffic.
Detects the specific TCP handshake pattern characteristic of the Fast Reverse Proxy (FRP) client (frpc) initiating a connection to a command-and-control server. The rule inspects established traffic for specific metadata strings ('privilege_key', 'run_id', 'pool_count') within the initial handshake payload.
Detects the specific TCP handshake pattern characteristic of the Fast Reverse Proxy (FRP) client (frpc) initiating a connection to a command-and-control server. The rule inspects established traffic for specific metadata strings ('privilege_key', 'run_id', 'pool_count') within the initial handshake payload.
Detects HTTP beaconing activity associated with the Kimsuky threat group (Stella_Gary), specifically identifying requests to the /unicorn/ path. This pattern is characteristic of their C2 communication mechanism, which masquerades as legitimate browsing.
Page 11 of 24