Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
503 detections
Filters
Last updated
All Time
Detection languages
497
4
1
1
Contributors
179
113
95
78
14
Categories
426
334
222
151
83
Platforms
458
23
15
14
13
Products / Services
466
447
32
10
5
MITRE Techniques
275
174
66
60
58
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
204
121
90
51
8
Detects outbound HTTP POST requests directed towards Internet Computer Protocol (ICP) canister gateways (e.g., icp0.io, ic0.app) containing specific API path patterns (/api/v2/canister/) used for executing queries or calls. The rule specifically flags traffic lacking common browser-like User-Agent strings, which is a common indicator of automated command-and-control beacons using these services as proxy infrastructure.
This rule detects outbound TLS traffic to the Solana mainnet beta RPC API endpoint (api.mainnet-beta.solana.com). Attackers may abuse legitimate public blockchain infrastructure as a command-and-control channel to bypass traditional network defenses or obfuscate communication.
Detects network beaconing activity associated with AMOS Stealer command-and-control communication. The rule identifies HTTP POST requests to the '/api/t' path with a JSON content type over port 8133, using a threshold to identify sustained communication patterns.
Detects DNS queries and TLS SNI traffic directed towards known domain names associated with the Sauron Loader command-and-control infrastructure. This rule identifies outbound communication attempts using hardcoded beaconing domains.
Detects outbound network traffic from internal hosts to known domains associated with the Sauron Loader malware family. These alerts monitor for TLS connections where the Server Name Indication (SNI) matches domains identified as part of the malware's C2 infrastructure.
Detects periodic outbound HTTP POST requests consistent with C2 beaconing behavior associated with the Latrodectus malware. The rule identifies multiple POST requests occurring within a 10-minute window, a pattern often used by Latrodectus for command-and-control heartbeats.
Detects outbound TCP traffic originating from internal hosts to known command and control infrastructure associated with the SilkParasite campaign and the SpiceRAT malware family.
Detects Remote Desktop Protocol (RDP) traffic occurring over non-standard high ports (64350, 64330, 65535, 65111, 61256), which is indicative of SilkParasite C2 activity or potentially malicious lateral movement attempting to bypass standard port monitoring.
Detects network activity associated with the SilkParasite actor's NodeEdgeRAT malware, including DNS queries, TLS SNI, HTTP Host headers, and direct IP connections to the identified command-and-control infrastructure 'hoster-kg.com'.
Detects network traffic and DNS queries associated with the SilkParasite command-and-control (C2) infrastructure. This rule monitors for established RDP-over-TLS connections using non-standard, high-numbered ports and identifies associated DNS lookups for known C2 hostnames.
Detects command-and-control (C2) communication patterns associated with the Graphalgo framework, which utilizes the Arbitrum Sepolia blockchain for dead-drop resolution and task orchestration. The rules monitor for specific JSON-RPC method calls ('eth_call', 'setCPubKey') and repeated polling of contract functions ('serviceData') characteristic of this threat actor's network behavior.
Detects network traffic to GitHub API endpoints that matches patterns indicative of RUSTYSHADE malware communicating with a private repository for command and control. The rule specifically looks for access to repository content paths related to commands, results, heartbeats, screenshots, or information files, coupled with the inclusion of an Authorization token in the HTTP header.
This rule detects network traffic indicative of the SCKIT MemTensor worm establishing a command-and-control (C2) beacon. The detection identifies TLS connections where the Server Name Indication (SNI) matches a specific pattern of a 12-character hexadecimal string followed by .skyleen.fr.
This rule detects network traffic indicative of the SCKIT MemTensor worm establishing a command-and-control (C2) beacon. The detection identifies TLS connections where the Server Name Indication (SNI) matches a specific pattern of a 12-character hexadecimal string followed by .skyleen.fr.
This rule detects network traffic indicative of the SCKIT MemTensor worm establishing a command-and-control (C2) beacon. The detection identifies TLS connections where the Server Name Indication (SNI) matches a specific pattern of a 12-character hexadecimal string followed by .skyleen.fr.
Detects the handshake process of the frpc (Fast Reverse Proxy Client), which is associated with the RatHat malware family, attempting to register a reverse tunnel for command and control purposes.
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying C2 communication patterns such as heartbeat beacons and agent tasking requests occurring over non-standard port 8133.
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying C2 communication patterns such as heartbeat beacons and agent tasking requests occurring over non-standard port 8133.
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying C2 communication patterns such as heartbeat beacons and agent tasking requests occurring over non-standard port 8133.
This rule detects internal hosts initiating outbound SSH connections to known public tunneling services (e.g., pinggy.io). Attackers frequently use these services to bypass network firewalls and create persistent reverse SSH tunnels for remote command-and-control access. The detection logic focuses on the identification of SSH protocol traffic headers combined with specific domain targeting or repetitive connection behavior.
Detects outbound network traffic (TLS and HTTP) destined for the Telegram Bot API (api.telegram.org). This pattern is often used by malicious actors for Command and Control (C2) communication, bot notifications, or data exfiltration, leveraging the legitimate Telegram infrastructure to hide malicious activity.
Page 9 of 24