Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
503 detections
Filters
Last updated
All Time
Detection languages
497
4
1
1
Contributors
179
113
95
78
14
Categories
426
334
222
151
83
Platforms
458
23
15
14
13
Products / Services
466
447
32
10
5
MITRE Techniques
275
174
66
60
58
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
204
121
90
51
8
Detects periodic heartbeat beaconing activity to the domain 'tt.yeyoujs.com' over both encrypted TLS (SNI observation on port 9443) and DNS queries. This pattern is indicative of a command-and-control (C2) channel establishing or maintaining persistence.
This rule detects network traffic (DNS, TLS, HTTP, and TCP) originating from internal assets to known infrastructure associated with the QTFY proxy botnet/C2 framework. It identifies communication with specific C2 domains, proxy management systems, and associated malicious IP ranges.
Detects network activity (DNS lookups, TLS SNI, and HTTP Host headers) associated with proxy infrastructure (iproyal.com and lightningproxies.net) known to be used by the HEAVYGRAM/CHOSEN BRICK threat actors to mask Telegram-based command and control traffic.
Detects network activity (DNS lookups, TLS SNI, and HTTP Host headers) associated with proxy infrastructure (iproyal.com and lightningproxies.net) known to be used by the HEAVYGRAM/CHOSEN BRICK threat actors to mask Telegram-based command and control traffic.
Detects HTTP POST requests to gapidriver.com/api/rest.php containing stager-specific status messages like 'build started', 'launch error', or 'all builds loaded', indicating NeedleStealer malware command-and-control activity.
Detects HTTP POST requests to gapidriver.com/api/rest.php containing stager-specific status messages like 'build started', 'launch error', or 'all builds loaded', indicating NeedleStealer malware command-and-control activity.
Detects Odyssey Stealer malware communicating with a known C2 infrastructure using TLS and performing data exfiltration via HTTP requests to raw-IP destinations using disguised file names such as analytics.gif, pixel.png, and content.js.
Detects network traffic between internal hosts and a known malicious IP address on port 5556, characteristic of Go_RAT (hVNC) command and control communication. This rule monitors for established TCP connections to identify potential C2 beaconing or active remote management sessions by the GapiUpdate campaign.
Detects network traffic between internal hosts and a known malicious IP address on port 5556, characteristic of Go_RAT (hVNC) command and control communication. This rule monitors for established TCP connections to identify potential C2 beaconing or active remote management sessions by the GapiUpdate campaign.
Detects network traffic between internal hosts and a known malicious IP address on port 5556, characteristic of Go_RAT (hVNC) command and control communication. This rule monitors for established TCP connections to identify potential C2 beaconing or active remote management sessions by the GapiUpdate campaign.
Detects established raw-TCP C2 communication sessions associated with the GapiUpdate Go-based RAT, identifying both known malicious infrastructure and behavioral anomalies characteristic of long-lived, encrypted C2 persistence.
Detects established raw-TCP C2 communication sessions associated with the GapiUpdate Go-based RAT, identifying both known malicious infrastructure and behavioral anomalies characteristic of long-lived, encrypted C2 persistence.
Detects DNS queries for 'd.clash-verge-upgrade.com', a domain identified as a Command and Control (C2) fallback transport mechanism for the ProRAM malware.
Detects an HTTP POST request targeting the host 'tt.yeyoujs.com' at the URI path '/api/agent/enroll', containing a specific Python aiohttp User-Agent string. This pattern is characteristic of a C2 agent attempting to register or enroll with an external command-and-control server.
This rule detects command-and-control (C2) communication patterns associated with the 'soraki-proxy.workers.dev' domain, a Cloudflare Workers-hosted proxy service. Additionally, it identifies potential malicious mTLS implants by flagging non-standard TLS handshakes that use self-signed or auto-generated certificates missing standard organization (O) fields in the subject DN.
Detects DNS queries for 'd.clash-verge-upgrade.com', a domain identified as a Command and Control (C2) fallback transport mechanism for the ProRAM malware.
Detects DNS A record lookups for the domain 'mail.uaiubifas.top', which is associated with GRAYRABBIT C2 activity linked to UNC3569. This domain is known to be used for command and control communications.
Detects DNS A record lookups for the domain 'mail.uaiubifas.top', which is associated with GRAYRABBIT C2 activity linked to UNC3569. This domain is known to be used for command and control communications.
Detects DNS A record lookups for the domain 'mail.uaiubifas.top', which is associated with GRAYRABBIT C2 activity linked to UNC3569. This domain is known to be used for command and control communications.
Detects established outbound network connections on TCP port 853 (DNS-over-TLS) to known C2 infrastructure associated with the RedTail malware. The rule monitors for both connection attempts to anomalous resolvers and specific TLS handshake patterns characteristic of RedTail C2 activity.
Detects established outbound network connections on TCP port 853 (DNS-over-TLS) to known C2 infrastructure associated with the RedTail malware. The rule monitors for both connection attempts to anomalous resolvers and specific TLS handshake patterns characteristic of RedTail C2 activity.
Page 15 of 24