Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,937 detections
Filters
Last updated
All Time
Detection languages
1,930
3
2
1
1
Contributors
592
477
360
250
124
Categories
995
927
834
546
538
Platforms
1,753
214
81
54
41
Products / Services
1,868
1,144
65
51
17
MITRE Techniques
564
412
305
201
175
CVEs
4
4
4
2
2
IDS Classtypes
1,937
503
461
381
236
IDS Protocols
1,098
362
201
171
37
This rule monitors outgoing HTTP traffic for a specific numeric URI path pattern ( /49890878) which is characteristic of beaconing behavior to a command-and-control (C2) server. Such static, non-descriptive URI paths are frequently used by malware to maintain consistent connectivity to an adversary-controlled infrastructure.
This rule detects suspicious network connections to GitHub and Postimg where specific assets are retrieved by a non-browser User Agent. This behavior is associated with the TWINLOOT campaign, where a Python-based implant retrieves fake loading-screen assets as part of a C2 communication sequence, utilizing legitimate image and video hosting services as dead-drop resolvers.
Detects outbound network traffic from internal hosts to known command-and-control (C2) server IP addresses associated with C2Looper malware on port 8888.
Detects outbound connections to the known Rust supply-chain C2 infrastructure, plus a lower-confidence rule for the broader Hostwinds range on port 9089.
This rule detects the outbound transmission of the Remote Framebuffer (RFB) protocol handshake, which is used by Virtual Network Computing (VNC) software. This is often indicative of unauthorized remote access tools or screen sharing being initiated from a host within the protected network to an external destination.
Detects a malformed/high-entropy repeated-label DNS query pattern used by ACRStealer as a connectivity canary check prior to establishing C2.
Detects an egress transfer of 100-120KB to known ACRStealer C2 IPs (45.155.68.45, 104.21.70.245) immediately followed within 60 seconds by an ingress transfer of 4-8MB, matching the campaign's post-collection exfiltration-then-payload-ingress pattern.
Detects network activity associated with the PureLogs Stealer, specifically connections to identified infrastructure hosting payloads on Pixeldrain and attempts to retrieve steganographic payloads via specific API endpoints.
Detects HTTP POST tasking check-ins to /version/check.php using the backdoor's hardcoded, obsolete Chrome 78.0.3904.108 user-agent string.
Detects the JWR phishing kit's WebSocket upgrade request to its hardcoded C2 path pattern combined with a JWRCVV-format session token, identifying the framework's persistent live-operator channel.
Detects outbound HTTP POST requests to a URI path '/api/beacon' containing a specific JSON structure ('id', 'user', 'host', 'pid'), which is characteristic of the C2Looper beaconing behavior.
Detects ACRStealer C2 data-transfer bursts (outbound credential-data exfiltration >100KB, inbound follow-on payload >1MB) correlated with prior credential-sweep and process-injection-stage flowbits, rather than raw transfer size alone.
Detects outbound network traffic from internal hosts to known malicious IP addresses associated with AdaptixC2 infrastructure. This rule identifies both general TCP connections and HTTP beaconing activity to these C2 servers, which are used for command and control purposes.
Detects outbound TCP traffic to known PurpleDelta-associated infrastructure IP addresses on common remote-access/web ports (80, 443, 3389), indicating potential communication with North Korean IT-worker facilitator infrastructure. Scope is limited to static IP indicators from Appendix A; does not cover Astrill VPN egress ranges or shell-company recruitment domains (minicursor[.]com), which would require separate signatures.
Detects DNS queries for suspicious subdomains on known Mirage2FA phishing kit domains ('cheacker.store' and 'volatilesour.store'). The rule identifies queries where the subdomain is Base64-encoded and decodes into an email-like format, which is a technique used by this phishing kit to track or validate victim-specific session tokens or email addresses.
This rule detects outbound TLS connections from the local network to an external destination where the server provides a self-signed certificate. Self-signed certificates are often used by malware for command-and-control (C2) communication or by data exfiltration tools to establish encrypted channels while avoiding the need for legitimate, verifiable PKI infrastructure.
Detects JWR's real-time keystroke/card exfiltration by matching the hardcoded WebSocket C2 path token together with an instructionAck message containing instruction_id and cvv_id fields.
Detects HTTP requests to the JWR phishing framework's REST-based alternate C2 API surface, covering beaconing, exfiltration POSTs, CVV capture, instruction polling/acknowledgment, and device/IP fingerprint sync across five distinct endpoints.
Detects the fake Adobe Flash update download from microsoft-flash[.]com/download/Adobeinstall.exe, served only after Jewelbug's 'flash' module validates the victim's targeted domain, account status, and OS.
Detects a DNS query for diagrtrack.com, a typosquat of Windows DiagTrack registered to serve as this backdoor's C2 infrastructure (dormant since early 2021).
Detects HTTP GET requests to known Mirage2FA phishing infrastructure domains and specific URI patterns associated with the retrieval of JavaScript loaders. This rule monitors for specific URL paths ('/xls/') and naming conventions (e.g., 'a1p2i.js') characteristic of the Mirage2FA phishing kit, which is used to harvest 2FA tokens.
Page 47 of 93