Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
Detects network packets targeting the Dahua SDK service (port 37777) that match the signature of a crafted login request, specifically checking for the 0xFF/0x00 magic header and the 0x00/0xA0 opcode. This pattern is commonly associated with unauthorized authentication attempts, including brute-force attacks or exploitation of known authentication bypass vulnerabilities in Dahua devices.
Detects malicious activities associated with the SilkParasite campaign targeting Redis servers. The rules identify the initiation of a 'SLAVEOF' command to a rogue replication host, subsequent handshake (PSYNC/REPLCONF) with an external attacker-controlled node, and the modification of server configuration ('CONFIG SET dbfilename') to potentially facilitate unauthorized file persistence or data exfiltration through the Redis replication mechanism.
Detects the handshake process of the frpc (Fast Reverse Proxy Client), which is associated with the RatHat malware family, attempting to register a reverse tunnel for command and control purposes.
This rule detects persistence mechanisms involving the 'JartePortable' application by monitoring Registry Run keys. It flags when a Registry key is created or modified to include a startup entry for 'Jarte.exe' located in 'C:\Users\Public\JartePortable\'. The detection specifically looks for a suspicious registry value data pattern.
This rule monitors outbound network traffic for the inclusion of a Windows-style hostname pattern (e.g., 'DESKTOP-XXXXXX'), which is often used by stealer malware or RATs to identify victim machines during C2 communication. It explicitly excludes Microsoft licensing traffic to reduce false positives.
This rule detects internal hosts initiating outbound SSH connections to known public tunneling services (e.g., pinggy.io). Attackers frequently use these services to bypass network firewalls and create persistent reverse SSH tunnels for remote command-and-control access. The detection logic focuses on the identification of SSH protocol traffic headers combined with specific domain targeting or repetitive connection behavior.
Detects high-frequency, unauthenticated Redis PING/AUTH attempts indicative of a reconnaissance scan against the Redis service. This activity typically represents an adversary performing mass fingerprinting or attempting to identify unsecured Redis instances.
Detects attempts to execute arbitrary JavaScript code on a MongoDB server using the deprecated eval command or patterns consistent with sandbox escape techniques (probing for process, load, and require functions).
Detects attempts to bypass the Redis Lua scripting environment sandbox by injecting 'require' and 'dofile' commands within an 'EVAL' request. These commands are typically used to load external modules or files, which, if successful, could allow an attacker to achieve arbitrary code execution on the server hosting the Redis instance.
Detects outbound network traffic from internal hosts to a known Cobalt Strike-compatible C2 server at 45.32.253.166 on port 8088. This activity is indicative of a compromised host establishing a command-and-control connection.
Detects internal SMB traffic indicative of P2P beaconing using the IPC$ named pipe, which is often a sign of lateral movement or command-and-control communication between compromised hosts.
Detects sustained outbound TCP communication patterns indicative of Xray-core proxy or tunneling activity. The rule monitors for high-frequency established TCP sessions originating from the internal network, which is a common behavior for tools used to maintain persistent network tunnels or proxy command-and-control traffic.
Detects anomalous MS_T120 channel binding and MCS handshake patterns characteristic of the BlueKeep (CVE-2019-0708) remote code execution vulnerability in Microsoft RDP services.
This rule monitors for outbound TCP and HTTP traffic to a known malicious infrastructure hosting a fake or compromised 'Corp MDM' (Mobile Device Management) admin panel, which serves as a Command and Control (C2) channel for spyware.
Detects outbound network traffic matching known SectopRAT C2 patterns. The rule monitors for established TCP connections to a specific malicious IP address with a payload size exceeding 300 bytes, consistent with the exfiltration of AES-encrypted JSON credential or wallet data. It includes threshold logic to limit alerts to once per source IP every 60 seconds.
Detects outbound network traffic matching known SectopRAT C2 patterns. The rule monitors for established TCP connections to a specific malicious IP address with a payload size exceeding 300 bytes, consistent with the exfiltration of AES-encrypted JSON credential or wallet data. It includes threshold logic to limit alerts to once per source IP every 60 seconds.
Detects outbound network traffic matching known SectopRAT C2 patterns. The rule monitors for established TCP connections to a specific malicious IP address with a payload size exceeding 300 bytes, consistent with the exfiltration of AES-encrypted JSON credential or wallet data. It includes threshold logic to limit alerts to once per source IP every 60 seconds.
Detects outbound network traffic matching known SectopRAT C2 patterns. The rule monitors for established TCP connections to a specific malicious IP address with a payload size exceeding 300 bytes, consistent with the exfiltration of AES-encrypted JSON credential or wallet data. It includes threshold logic to limit alerts to once per source IP every 60 seconds.
Detects network communication associated with the SectopRAT/ArechClient2 remote access trojan, specifically identifying its characteristic length-prefixed, AES-encrypted command-and-control handshake on non-standard ports. The rule matches traffic containing a specific length-prefixed packet structure starting with null bytes, typically seen during C2 check-in.
Detects network communication associated with the SectopRAT/ArechClient2 remote access trojan, specifically identifying its characteristic length-prefixed, AES-encrypted command-and-control handshake on non-standard ports. The rule matches traffic containing a specific length-prefixed packet structure starting with null bytes, typically seen during C2 check-in.
Detects network communication associated with the SectopRAT/ArechClient2 remote access trojan, specifically identifying its characteristic length-prefixed, AES-encrypted command-and-control handshake on non-standard ports. The rule matches traffic containing a specific length-prefixed packet structure starting with null bytes, typically seen during C2 check-in.
Page 6 of 42