Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
This rule detects outbound network connections from internal hosts to specific IP addresses associated with known AlexHost infrastructure identified as command-and-control (C2) servers for the Bandook Remote Access Trojan (RAT), which is utilized by the threat actor Dark Caracal.
Detects outbound Telnet traffic initiating with a specific magic byte sequence ('|FF FB|') characteristic of the Fire Ant malware's command-and-control communication.
Detects the specific C2 handshake pattern associated with HVNC (Hidden Virtual Network Computing) remote access trojans. The rule monitors for a unique sequence of markers, specifically CLIENT_ID, COMPUTER, IDENTIFIER_CHANNEL, and a version string, indicating a malware-specific communication protocol.
Detects the specific C2 handshake pattern associated with HVNC (Hidden Virtual Network Computing) remote access trojans. The rule monitors for a unique sequence of markers, specifically CLIENT_ID, COMPUTER, IDENTIFIER_CHANNEL, and a version string, indicating a malware-specific communication protocol.
Detects high-frequency login attempts using the Dahua Easy4IP protocol. The rule flags multiple login opcode requests (identified by specific byte patterns 0xFF followed by 0x00A0) originating from the same source within a 60-second window, which is indicative of an automated brute-force or credential-stuffing attack targeting vulnerable IoT devices.
Detects incoming TCP and UDP traffic containing the 'sxcdewqaz!@#' magic string. This pattern is characteristic of a packet-triggered backdoor (often referred to as 'Fire Ant'), which uses custom packet payloads to activate malicious functionality on a listening host.
Detects high-frequency TCP SYN connection attempts originating from an internal device, which is indicative of a port scanning behavior typically used for network service discovery.
Detects the use of the FTP 'STOR' command to transmit a file with the '.pcap' extension to an external network. This behavior is indicative of potential data exfiltration where captured network traffic is being uploaded to an attacker-controlled server.
This rule detects unauthenticated TCP connection attempts targeting ports 43210 and 43211, which are associated with the Nexus 9000 S1HAL service. These attempts are indicative of potential exploitation activity related to CVE-2026-20212.
Detects network-based command signaling shared by the Fire Ant/REPTILE-derivative backdoor and its reverse-tunneling implant capability. Identifies the 'magic string' activation sequence and matching 'kill marker' termination sequence over TCP and UDP — indicative of packet-triggered backdoor activation, port-knocking style C2, or reverse-tunnel establishment via raw socket communication.
Detects network traffic within the internal network that matches the initial handshake phase of a SOCKS proxy connection. This is a common indicator of an attacker using an internal system to proxy command and control (C2) traffic or pivot within the network using tools like HTRAN, ZXProxy, or custom implementations.
Detects anomalous, high-frequency inbound TCP connection attempts to port 102 (S7comm), which is used by Siemens S7 PLCs. This behavior is indicative of automated network scanning or reconnaissance targeting industrial control system (ICS) infrastructure.
Detects incoming S7comm/ISO-TSAP connection attempts directed at Siemens Programmable Logic Controllers (PLCs) originating from an external network. This behavior is indicative of unauthorized access or reconnaissance attempts against Industrial Control System (ICS) assets.
Detects FTP STOR commands associated with the transfer of files with a .pcap extension, which may indicate the exfiltration of captured network traffic from a network device or server.
Detects repeated attempts to establish S7comm connections to a Programmable Logic Controller (PLC) on port 102. This behavior is indicative of network reconnaissance or scanning targeting Industrial Control Systems (ICS).
Detects persistent outbound TCP connections to external infrastructure, which is indicative of a potential backconnect proxy or C2 communication tunnel. The rule uses a threshold to filter out transient connections.
Detects outbound network connections from internal hosts to known IP addresses associated with Dark Caracal's GoCaracal malware command and control infrastructure.
Detects legacy RFB security-type 2 (VNC password) authentication negotiation against macOS Screen Sharing from external sources, indicating legacy-VNC administration or abuse of the CVE-2026-43760 legacy-auth path that retains root file-copy authority.
Detects the CVE-2026-65400 pre-auth bypass exploitation of macOS Screen Sharing via an oversized RFB SRP (security-type 36) authentication frame length field, correlated with the connection subsequently reaching an authenticated state.
Detects outbound network traffic from internal hosts to known command-and-control (C2) server IP addresses associated with C2Looper malware on port 8888.
Detects outbound connections to the known Rust supply-chain C2 infrastructure, plus a lower-confidence rule for the broader Hostwinds range on port 9089.
Page 14 of 42