Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
503 detections
Filters
Last updated
All Time
Detection languages
497
4
1
1
Contributors
179
113
95
78
14
Categories
426
334
222
151
83
Platforms
458
23
15
14
13
Products / Services
466
447
32
10
5
MITRE Techniques
275
174
66
60
58
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
204
121
90
51
8
Detects high-frequency DNS query patterns characterized by long, potentially encoded, subdomain labels (exceeding 40 characters) that are indicative of DNS-based command and control (C2) beaconing activity.
Detects network traffic consistent with the Metasploit Meterpreter reverse HTTPS payload, specifically looking for the default 'CN=metasploit' certificate subject name used by the framework in SSL/TLS handshakes, or connections targeting default Meterpreter ports like 4444.
This rule detects potential command and control (C2) activity related to the Qakbot malware. It specifically monitors for established outbound TLS traffic over non-standard ports (ports other than 443) where the Server Name Indication (SNI) field contains a numeric IPv4 address instead of a domain name, which is a characteristic behavior of Qakbot C2 infrastructure.
Detects TLS/SSL traffic patterns characteristic of Metasploit Meterpreter reverse HTTPS command-and-control communication, specifically targeting the use of default, self-signed certificates with a subject line containing a bare wildcard (CN=*) in the common name field, a common artifact of unconfigured Metasploit payloads.
This rule detects network traffic originating from internal hosts to external destinations consistent with default Cobalt Strike HTTP Beacon communication patterns. It specifically looks for GET requests containing URI paths commonly associated with default Cobalt Strike profiles (ca, submit.php, updates.rss) combined with a specific, hardcoded User-Agent string associated with Cobalt Strike's default configuration.
This rule detects outbound network connections from the internal network to external hosts on specific ports (2404, 37393) that are known to be used by the Remcos Remote Access Trojan (RAT) for command and control (C2) communications. The rule is designed to identify established TCP connections to the server.
Detects outbound HTTP requests exhibiting a User-Agent string hardcoded to mimic Firefox 20.0 (Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0), which is characteristic of the Adaptix C2 framework. This pattern is commonly used by adversaries for command-and-control communication.
This rule detects network communication associated with the 'easy-day-js Mastra npm Supply Chain' compromise. The first alert identifies C2 exfiltration attempts over TLS to a specific IP address (23.254.164.123) on port 443. The second alert identifies a stage-2 payload download from another specific IP address (23.254.164.92) on port 8000, specifically looking for the URI '/update/49890878'. These indicators are linked to the 'protocal.cjs' and 'setup.cjs' malware, respectively, and are part of a supply chain attack.
Detects unusually large HTTP POST requests which may indicate data exfiltration activity over web protocols. The rule specifically looks for HTTP POST methods and is designed for Suricata, a network intrusion detection system.
Detects unusually large HTTP POST requests which may indicate data exfiltration activity over web protocols. The rule specifically looks for HTTP POST methods and is designed for Suricata, a network intrusion detection system.
This rule detects unusually long DNS queries (40 characters or more) which can be indicative of DNS tunneling. DNS tunneling is a technique used by adversaries for command and control (C2) communication or data exfiltration, where data is encoded within DNS queries and responses to bypass network security controls.
his query hunts for Beagle malware indicators by correlating suspicious file artifacts (NOVupdate.exe, avk.dll, Claude.msi), process command-line executions, and potential network callbacks. It unifies multiple telemetry sources to surface persistence, DLL sideloading, and C2 activity aligned with MITRE ATT&CK techniques.
This rule detects large HTTP POST requests originating from the internal network ($HOME_NET) to any external destination. It specifically looks for HTTP POST methods and a data size greater than 10,000 bytes. A detection filter is applied to track by source IP, triggering an alert if 20 such large POST requests are observed within a 60-second window. This behavior is indicative of potential data exfiltration over command and control (C2) channels, as large amounts of data are being sent out of the network.
This rule detects common chromium browser processes establishing outbound network connections to known C2 domains associated with malicious 'ChatGPTStealer' infostealer extension. Detections by this rule indicates a high likelihood that a malicious chromium infostealer extension is currently or had been installed on an endpoint.
This rule detects common chromium browser processes establishing outbound network connections to known C2 domains associated with malicious 'ChatGPTStealer' infostealer extension. Detections by this rule indicates a high likelihood that a malicious chromium infostealer extension is currently or had been installed on an endpoint.
Try tio find out phishing domain based on mail history
This rule detects Command and Control (C2) communication associated with the Mythic C2 framework utilizing Server Message Block (SMB) for peer-to-peer (P2P) beaconing. It specifically looks for SMB_COM_WRITE_ANDX commands with a data size greater than 360 bytes, containing a specific null byte pattern at offset 86, and a PCRE match for a GUID-like string, which are indicators of Mythic C2 SMB P2P beacon traffic.
This rule detects network traffic indicative of Kraken Ransomware activity, specifically looking for connections to Cloudflared tunnels. It identifies TLS SNI (Server Name Indication) containing '.trycloudflare.com', which is a domain used by Cloudflare for its tunnel services. This behavior is often leveraged by adversaries for command and control or data exfiltration, as it can help bypass traditional firewall rules and obscure the true destination of the traffic.
This rule detects HTTP traffic originating from a client within the home network to an external Cloudflare tunneling service (specifically, domains ending in '.trycloudflare.com') where the User-Agent header indicates 'Microsoft-WebDAV-MiniRedir'. This combination suggests potential command and control activity or data exfiltration using WebDAV over a Cloudflare tunnel, often employed by adversaries to bypass network restrictions and obscure their infrastructure.
This rule detects the 'Get-ScheduledTask' PowerShell cmdlet within the HTTP response body, specifically when the HTTP status code is 200. This could indicate an attacker enumerating scheduled tasks on a compromised system via a web-based command and control channel or data exfiltration.
Page 24 of 24