Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
This rule monitors network traffic to detect a specific 'Client Hello' beaconing behavior associated with the RMRLX Remote Access Trojan (RAT), identifying potential command-and-control communication directed at a known malicious IP address over TCP port 4561.
Detects repeated authentication attempts over PPTP (port 1723) or L2TP (port 1701) protocols originating from an external network, indicative of potential brute-force activity against remote access services.
This rule monitors for outbound TCP traffic from internal hosts to a specific IP address (212.34.141.103) on port 4521, which is associated with C2 beaconing behavior, potentially involving the abuse of MSBuild.exe as a LOLBin.
Detects suspicious FTP command and control traffic originating from internal hosts to known compromised servers in Taiwan. The rules monitor for specific FTP commands such as STOR (to upload archive4.zip), RETR (to download archive1.zip), and initial authentication (USER command) associated with C2 communication.
This rule detects rapid, repetitive TCP connection attempts to port 445 (SMB) originating from a single source within a 30-second window. Such activity is indicative of automated network scanning and enumeration, often used for discovery of vulnerable SMB shares or lateral movement preparation.
This rule detects two suspicious indicators related to SloppyRAT activity: an outbound network connection using the legacy Finger protocol (TCP port 79), which can be abused by binaries like 'finger.exe' for payload staging, and DNS queries resolving to the known SloppyRAT staging domain 'finger.linked4x.com'.
Detects outbound network activity on TCP port 79 (finger) initiated by a client to the domain 'finger.linked4x.com'. This behavior is associated with the SloppyRAT 'ClickFix' campaign, where attackers use social engineering to trick users into executing commands, leading to payload staging and tool retrieval.
Detects established network connections to a known Kimsuky-associated infrastructure (107.172.249.140) on port 443. The rule filters out standard TLS handshakes by inspecting initial packet content, targeting non-standard or custom-protocol traffic, and limits alerts to once per hour per source host to reduce noise.
Detects high-frequency outbound TCP connection attempts from a WSO2 API Gateway or Traffic Manager host to multiple sensitive internal management and administrative ports (22, 445, 3389, 5985, 5986). This behavior is indicative of a compromised gateway being used for lateral movement across the network.
This rule detects periodic network beaconing patterns consistent with BabylonRAT malware. It flags established TCP connections to external networks that occur at a frequency exceeding 5 connections within a 300-second window, which may indicate a C2 check-in mechanism. Due to the heuristic nature of this detection, it is recommended to tune the threshold and correlate with payload analysis or entropy inspection to reduce noise.
This rule detects periodic network beaconing patterns consistent with BabylonRAT malware. It flags established TCP connections to external networks that occur at a frequency exceeding 5 connections within a 300-second window, which may indicate a C2 check-in mechanism. Due to the heuristic nature of this detection, it is recommended to tune the threshold and correlate with payload analysis or entropy inspection to reduce noise.
Detects network activity associated with the DarkMe RAT, including DNS lookups for its known C2 domain 'thatawful.boutique' and outbound TCP connections to a hardcoded non-standard port (7712) at a known malicious C2 IP address.
Detects outbound TCP traffic from the internal network to external destinations that match characteristics of Gorilla RAT registration beacons. This includes established sessions with small packet sizes (<64 bytes) and frequent, repeated attempts as defined by the threshold.
Detects anomalous MS_T120 channel binding and MCS handshake patterns characteristic of the BlueKeep (CVE-2019-0708) remote code execution vulnerability in Microsoft RDP services.
Detection rules identifying malformed RDP MCS Connect Initial PDUs and unusual service crashes following RDP connection attempts, both indicative of exploitation attempts against the CVE-2019-0708 (BlueKeep) vulnerability.
Detection rules identifying malformed RDP MCS Connect Initial PDUs and unusual service crashes following RDP connection attempts, both indicative of exploitation attempts against the CVE-2019-0708 (BlueKeep) vulnerability.
Detects specific command strings ('proxy_open', 'proxy_data', 'proxy_close') associated with the Koktevrat Android RAT's tunneling functionality. The rule monitors outbound TCP traffic to identify the initiation, data transfer, and termination phases of a proxy connection, leveraging Suricata flowbits to track the state of the C2 tunnel.
Detects repeated authentication attempts over PPTP (port 1723) or L2TP (port 1701) protocols originating from an external network, indicative of potential brute-force activity against remote access services.
Detects high-frequency TCP SYN packet bursts targeting port 37777 (commonly used by Dahua surveillance devices). The detection triggers when more than 50 SYN packets from a single source are observed within a 10-second window, suggesting automated reconnaissance or vulnerability scanning activity.
Detection rules identifying suspicious communication patterns associated with Dahua P2P Cloud Relay devices, including WSSE authentication attempts and device probing to known cloud relay endpoints. These patterns are consistent with reconnaissance and exploitation activity against IoT devices within the context of Operation CameraSwarm.
Detects network communication with infrastructure associated with the Transparent Tribe threat group (APT36), including C2 traffic to a known malicious IP and DNS resolution for the sharema128.net domain, which are indicative of CrimsonRAT or Doxc malware activity.
Page 8 of 42