Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
503 detections
Filters
Last updated
All Time
Detection languages
497
4
1
1
Contributors
179
113
95
78
14
Categories
426
334
222
151
83
Platforms
458
23
15
14
13
Products / Services
466
447
32
10
5
MITRE Techniques
275
174
66
60
58
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
204
121
90
51
8
This rule detects potential command and control (C2) beaconing activity by monitoring for high-frequency POST requests to OpenAI and Google Generative Language chat completion API endpoints. The rule triggers when a source host makes 5 or more requests within a 60-second window, which may indicate automated polling for commands or exfiltrated data transfer using legitimate LLM infrastructure.
Detects network traffic directed towards known public DNS over HTTPS (DoH) resolvers, such as Cloudflare, Google, and Quad9. Adversaries often abuse DoH to tunnel Command and Control (C2) communication, effectively blending in with legitimate web traffic to evade traditional DNS monitoring.
This rule detects outbound network traffic originating from internal assets attempting to establish an SSH connection to a known malicious C2 infrastructure (190.211.124.187). This behavior is indicative of the CARBONATO malware utilizing a reverse SSH tunnel for command-and-control communication.
Detects network traffic destined for api.telegram.org that follows the specific URL structure pattern associated with the CARBONATO Hermes Agent bot command-and-control channel.
Detects unauthorized exfiltration of sensitive information, such as camera credentials or location data, directed to the Telegram Bot API as part of the 'Operation CameraSwarm' campaign.
This rule detects potentially malicious Command and Control (C2) traffic utilizing DNS over HTTPS (DoH) to interact with public resolvers like Cloudflare, Google, and Quad9. It identifies both high-frequency, repeated direct-to-resolver TLS sessions and specific HTTP requests to these resolvers that resolve domains associated with known C2 infrastructure, such as the ClickFix campaign.
Detects outbound HTTP requests to api.github.com targeting the 'contents' API with patterns indicative of RUSTYSHADE malware command-and-control (C2) communication, including file extensions and filenames typical of its tasking mechanisms.
Detects the specific TCP handshake pattern characteristic of the Fast Reverse Proxy (FRP) client (frpc) initiating a connection to a command-and-control server. The rule inspects established traffic for specific metadata strings ('privilege_key', 'run_id', 'pool_count') within the initial handshake payload.
Detects network traffic associated with the BotHelper RAT communicating with its C2 domain 'easyllms.xyz'. The rule monitors for TLS SNI connections to this domain and specific HTTP API paths (/api/v1/ping, /api/v1/connect, etc.) indicative of command-and-control heartbeats and task execution.
Detects HTTP traffic originating from internal hosts to external destinations on port 8989, specifically targeting '/chat/completions' URI patterns. This activity is indicative of the CARBONATO/Hermes Agent leveraging LLM gateway infrastructure as a command-and-control (C2) channel.
Detects HTTP beaconing patterns and TLS SNI traffic associated with the Sauron Loader malware. The rules identify specific URI structures (including versioned resources and various configuration/profile endpoints), specific URL parameters used for session management, and characteristic User-Agent strings. Additionally, it monitors for connections to known command-and-control infrastructure via TLS SNI filtering.
Detects NeedyMantis' initial C2 beacon: an HTTP GET to /library/zip/ on port 443, anchored to the URI root, carrying a client-originated 'Set-Cookie:' header (clients normally send 'Cookie:', never 'Set-Cookie:' -- this direction reversal is the core anomaly and is near-impossible for legitimate traffic) alongside an explicit 'Upgrade: websocket' header. Matching the literal header text (not just header-name presence) and anchoring the URI removes generic WebSocket apps and any unrelated path containing '/library/zip/' as a substring.
Detects specific markers in UDP traffic on ports 3478, 5349, and 443 that are associated with the DragonForce malware's TRN1 C2 beaconing protocol. The rules identify session initiation, task polling, task acknowledgment, and result uploading behaviors.
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
Detects network activity associated with the DragonForce backdoor, specifically the use of MQTT for command and control. The rules monitor for unique 16-character client IDs used during registration on non-standard ports, subsequent command retrieval structures containing 'cmdnum', and DNS queries for the hardcoded broker 'broker.emqx.io'.
Detects network activity associated with the DragonForce backdoor, specifically the use of MQTT for command and control. The rules monitor for unique 16-character client IDs used during registration on non-standard ports, subsequent command retrieval structures containing 'cmdnum', and DNS queries for the hardcoded broker 'broker.emqx.io'.
Detects high-frequency requests to Hugging Face dataset repository commit and discussion endpoints, which may indicate the use of the platform as a dead drop resolver or for C2 polling.
Detects automated HTTP GET requests directed at government or council calendar endpoints (specifically targeting mgCalendarMonthView or GetMeetings parameters) using a common generic User-Agent. This behavior is indicative of an automated scripted client potentially using public infrastructure as a Command and Control (C2) relay.
Detects network requests to specific GitHub, Blogspot, and Telegram endpoints, which are known to be used by the 'VPN-for-X' extension to fetch proxy configuration files. This behavior is indicative of C2 channel configuration retrieval.
Page 3 of 24