Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
This rule monitors for known string patterns associated with the initialization and command execution of the Metasploit Meterpreter reverse TCP payload. By inspecting network traffic for characteristic C2 handshake and command strings, it identifies active Meterpreter sessions.
This rule detects network traffic indicative of the RisePro malware communicating with its Command and Control (C2) infrastructure. It specifically looks for the 'clientsendfile' string within the payload, which acts as a keepalive signal or heartbeat for the RisePro implant.
Detects network traffic associated with the RisePro malware family, specifically identifying the use of 'serversendfile' commands, which indicates data exfiltration or file transfer activity via a command-and-control channel.
Detects network communication associated with the CARBONATO Hermes Agent, including direct C2 beaconing to a hardcoded IP on port 8989 and TLS connections to Vercel-hosted proxy infrastructure identifying as 'carbonato-proxy'.
Detects network communication to a known malicious IP address (45.32.253.166) associated with the PIVOTPIPE RAT using Cobalt Strike C2 beaconing patterns. The rule identifies TCP connections, HTTP GET requests for beacon check-ins, and HTTP POST requests for task responses.
Detects attempts to exploit CVE-2021-33045, an authentication bypass vulnerability in certain Dahua camera firmware. The attack involves sending a crafted login request containing 'global.login', 'clientType', and 'Loopback' parameters, which allows an attacker to bypass authentication mechanisms.
Detects network activity indicating interaction with known Adversary-in-the-Middle (AiTM) phishing infrastructure. This includes direct outbound connections to specific suspicious IP addresses and the identification of proxied Microsoft 365 OAuth authorization flows redirected to non-Microsoft hosts.
Detects outbound TCP traffic originating from the internal network destined for a known RMRLX RAT command and control (C2) server on port 4561. This signature identifies the client-side 'hello' beaconing behavior characteristic of this specific malware.
This rule detects attempts to exploit CVE-2021-33044 in Dahua devices, specifically targeting the NetKeyboard clientType during the global.login RPC request. This vulnerability allows an unauthenticated remote attacker to bypass authentication mechanisms.
This rule monitors for outbound TCP and HTTP traffic to a known malicious infrastructure hosting a fake or compromised 'Corp MDM' (Mobile Device Management) admin panel, which serves as a Command and Control (C2) channel for spyware.
This rule detects attempts to exploit the authentication bypass vulnerability in Dahua firmware (CVE-2021-33045) via the JSON-RPC interface. The attacker attempts to manipulate the 'loginType' and 'ipAddr' fields, specifically using 'Loopback' as the login type and '127.0.0.1' as the IP address to bypass security controls.
Detects network communication associated with the SectopRAT/ArechClient2 remote access trojan, specifically identifying its characteristic length-prefixed, AES-encrypted command-and-control handshake on non-standard ports. The rule matches traffic containing a specific length-prefixed packet structure starting with null bytes, typically seen during C2 check-in.
Detects a specific 4-byte handshake pattern ("\x11\x22\x33\x44") within the initial data of a TCP stream, identifying the C2 communication handshake of the SparroWocky backdoor associated with the FamousSparrow threat actor.
Detects network activity associated with the GHAPPIER implant beaconing to a hardcoded command and control (C2) server. The rule monitors for established TCP connections on port 15152 that contain specific JSON status indicators and the string 'ghappier' in the payload, which are characteristic of this malware's communication protocol.
Detects a specific network handshake pattern characterized by the string 'REVERSE_PROXY|' within the first 16 bytes of an established TCP connection, consistent with the x47.c Fast-Flux botnet command and control (C2) communication protocol.
Detects network traffic consistent with the x47.c bot performing a SOCKS5 reverse-proxy handshake to a command-and-control (C2) server. The rule triggers on the specific 'REVERSE_PROXY|' string signature within established outbound TCP connections.
Detects large and sustained outbound TCP data transfers to external networks, which may indicate mass data exfiltration. The rule monitors established sessions and uses a threshold to identify unusual outbound traffic volume over an extended period.
Detects potential reconnaissance activities targeting Redis services on port 6379, specifically looking for unauthenticated 'PING' commands and subsequent responses indicating either authentication requirements or an open, unauthenticated instance.
Detects network traffic attempting to exploit CVE-2021-33044, an authentication bypass vulnerability in Dahua NetKeyboard devices, by identifying specific login request strings used in the exploit chain.
Detects outbound TCP traffic originating from internal hosts to known command and control infrastructure associated with the SilkParasite campaign and the SpiceRAT malware family.
Detects repeated authentication login attempts (opcode 0xA0) against Dahua Easy4IP devices over TCP port 37777, indicative of a brute-force or credential stuffing attack.
Page 4 of 42