Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
503 detections
Filters
Last updated
All Time
Detection languages
497
4
1
1
Contributors
179
113
95
78
14
Categories
426
334
222
151
83
Platforms
458
23
15
14
13
Products / Services
466
447
32
10
5
MITRE Techniques
275
174
66
60
58
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
204
121
90
51
8
Detects DOUBLECUP's session polling/telemetry beacon to /session/reg, /session/check, and /session/signal with a sid= query parameter, requiring at least 5 requests within 15 seconds to match the malware's 1.2-3 second polling cadence.
Detects high-volume DNS TXT/A queries from a single internal host to a domain containing "microsoft" or "telemetry" keywords, indicative of DeviceManager RAT DNS tunneling C2 channel abuse designed to mimic legitimate Microsoft telemetry traffic.
STAC4749 Golang Implant TLS Certificate with Hardcoded CA Issuer (loop-CA/connectify-CA/james-bond-CA)
Detects HTTP GET requests with an Upgrade: websocket header directed at known UNC6692 Edgecution/SNOWBELT malware command-and-control infrastructure hosted on CloudFront subdomains via the /ws URI path. This indicates active WebSocket-based communication between an infected host and the threat actor's C2 server.
Detects a suspicious proxy authentication negotiation pattern involving multiple HTTP 407 challenges followed by a WebSocket upgrade and the establishment of a SOCKS5 tunnel, indicative of the BridgeHead adversary toolset.
Detects outbound HTTPS traffic to api.telegram.org originating from non-standard or unsigned processes. This rule is designed to identify potential data exfiltration by malware (such as stealers or trojans) using the Telegram Bot API as a C2 or exfiltration channel. It relies on a companion rule to establish flowbits for legitimate client traffic.
STAC4749 sc5.exe reverse SOCKS proxy C2 domain query (legio.name)
This rule monitors outbound TLS traffic for Server Name Indication (SNI) fields matching known C2 or phishing domains associated with the JadeProx activity. This indicates a potential connection from an internal host to malicious infrastructure.
STAC4749 DNS Query to Known C2 Domain or Cloudflare Workers.dev C2 Subdomain
Detects HTTP traffic patterns characteristic of suo5 and Neo-reGeorg web shell tunnels. These tools facilitate bidirectional communication through JSP endpoints (e.g., /jmx/suo5.jsp, /common/themes/top_css.jsp) by utilizing hardcoded proxy identifiers in HTTP headers. This behavior is indicative of a compromised web server acting as a pivot point for command-and-control operations.
Detects outbound HTTP POST requests directed to Discord webhooks containing specific indicators associated with the TOKYOCORE ransomware, specifically identifying a unique User-Agent and a hardcoded exfiltration/C2 string in the request body.
This rule detects potential command and control (C2) beaconing activity associated with the AdaptixC2 framework. It identifies HTTP requests containing a specific 'X-Beacon-Id' header combined with known C2 URI patterns and a specific User-Agent string commonly observed in AdaptixC2 traffic.
SOCKS5 client no-auth handshake request to external host
Detects an HTTP GET request to the Microsoft Graph API (/v1.0/users/*/calendarView) containing a specific hardcoded far-future date (2050-05-13) in the startDateTime parameter. This pattern is indicative of a command-and-control (C2) mechanism leveraging a legitimate cloud service to maintain persistent communication channels.
Detects specific WebSocket JSON-formatted C2 agent registration and profiling traffic associated with the TAG-195/TinyEgg campaign. The rules look for specific registration markers (agent_register, request_register) and host profiling data (hostname, username, OS, domain, isAdmin status) characteristic of this threat actor's C2 communication.
This rule detects network traffic patterns characteristic of the 'ChonkyChicken' malware using a 'proxy_request' method within a JSON payload, suggesting the initiation of command-and-control (C2) communication or traffic relaying through the infected host.
Detects a specific DNS AAAA record response containing a hardcoded sentinel value (2001:4998:44:3507::8000) associated with the CAV3RN framework, which signals a failed configuration recovery process.
Detects outbound HTTP POST requests to a Polygon blockchain JSON-RPC endpoint containing the eth_call method and a specific hardcoded smart contract address and function selector associated with the TELEPUZ malware command-and-control communication.
Detects established TLS connections to known malicious infrastructure associated with PureRAT and DlrtyGames RAT. The rules identify suspicious patterns such as connections without a Server Name Indication (SNI) and specific JA3 hashes indicative of malware beacons.
Detects outbound HTTP requests to a specific Telegram channel (chanadarkpart) commonly associated with the TELEPUZ malware (used by SCMBANKER), indicating a potential command-and-control (C2) dead-drop resolver communication attempt.
Possible EtherHiding - outbound eth_call JSON-RPC request to blockchain RPC endpoint
Page 19 of 24