Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
163
113
109
24
15
Contributors
109
73
61
49
26
Categories
167
139
127
91
71
Platforms
232
129
75
30
23
Products / Services
108
101
88
53
39
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
6
2
1
1
1
IDS Classtypes
60
46
5
1
1
IDS Protocols
43
30
21
7
6
Detects the creation of specific named pipes often associated with Cobalt Strike and similar C2 frameworks used for peer-to-peer (P2P) lateral movement. The detection looks for anomalous pipe names created by processes other than standard Windows system processes (svchost, services, lsass), which is a common indicator of beacon communication relaying.
Detects PIVOTPIPE malware beaconing activity indicative of peer-to-peer (P2P) lateral movement between internal hosts. The rule monitors for sustained established TCP traffic with specific small packet size characteristics, suggesting command-and-control heartbeats or tunneled traffic within the internal network.
Detects the execution of processes with 'revsocks' in the file name. Revsocks is a known proxy tool often utilized by threat actors for establishing reverse SOCKS proxies, facilitating command and control communication, and bypassing network segmentation.
This rule monitors for outbound network connections to a list of known malicious IP addresses identified as part of the GhostCode command-and-control (C2) infrastructure. It uses DeviceNetworkEvents data to flag activity originating from endpoints and highlights a specific IP address used during the Intune/MDM enrollment process for further investigation.
Detects the handshake process of the frpc (Fast Reverse Proxy Client), which is associated with the RatHat malware family, attempting to register a reverse tunnel for command and control purposes.
This rule detects internal hosts initiating outbound SSH connections to known public tunneling services (e.g., pinggy.io). Attackers frequently use these services to bypass network firewalls and create persistent reverse SSH tunnels for remote command-and-control access. The detection logic focuses on the identification of SSH protocol traffic headers combined with specific domain targeting or repetitive connection behavior.
Detects network activity associated with the 'RatHat' Android malware, specifically identifying attempts to retrieve tunnel configuration, deployment confirmation, and the initial reverse tunnel handshake using the fatedier/frp (Fast Reverse Proxy) tool.
This rule set detects multi-stage network patterns indicative of AiTM phishing campaigns. It identifies common redirection techniques, including lookalike domains hosting Microsoft OAuth authorize URLs, DNS resolution of Google ad-tech infrastructure followed by novel domains, malicious use of Google Meet and Google Ads click-tracking endpoints as phishing hops, and references to AWS S3-hosted intermediate landing pages.
Detects sustained outbound TCP communication patterns indicative of Xray-core proxy or tunneling activity. The rule monitors for high-frequency established TCP sessions originating from the internal network, which is a common behavior for tools used to maintain persistent network tunnels or proxy command-and-control traffic.
Detects high-frequency, automated API requests to commercial Large Language Model (LLM) endpoints from a single source IP. The rule identifies suspicious activity characterized by a rapid rotation of multiple API tokens, often indicative of an intermediary proxy or middleware service attempting to bypass provider-specific usage limits, billing controls, or safety guardrails.
Detects the specific TCP handshake pattern characteristic of the Fast Reverse Proxy (FRP) client (frpc) initiating a connection to a command-and-control server. The rule inspects established traffic for specific metadata strings ('privilege_key', 'run_id', 'pool_count') within the initial handshake payload.
Detects network handshake patterns associated with the Fast Reverse Proxy (FRP) client, specifically identifying outbound traffic containing identifiers used in common FRP reverse tunnel configurations. This behavior is indicative of unauthorized remote access tools or tunneling software establishing a connection to an external command-and-control server.
Detects the specific TCP handshake pattern characteristic of the Fast Reverse Proxy (FRP) client (frpc) initiating a connection to a command-and-control server. The rule inspects established traffic for specific metadata strings ('privilege_key', 'run_id', 'pool_count') within the initial handshake payload.
This rule detects suspicious usage of certutil.exe for file downloading or the execution of the Chisel proxy tool, specifically targeting connections or authentication towards the suspicious IP address 69.48.228.86. This behavior is indicative of C2 communication or ingress tool transfer.
Detects network activity associated with the QUICAgent backdoor, including QUIC C2 traffic using a self-signed 'RAT System' certificate, direct connections to a known C2 IP address (104.64.211.22), and DNS queries for the hardcoded C2 domain 'register.mediumser.com'.
This rule detects suspicious usage of certutil.exe for file downloading or the execution of the Chisel proxy tool, specifically targeting connections or authentication towards the suspicious IP address 69.48.228.86. This behavior is indicative of C2 communication or ingress tool transfer.
Detects the use of nodejs.exe to initiate external network tunnels to known tunneling services like pinggy.io or generic tunnels using common tunnel configuration flags.
This rule detects suspicious outbound HTTP GET requests to a known domain (noah-ssh.com.cn) targeted by the SilverFox malware relay dispatcher. It specifically monitors for requests to '/api.php' containing a 13-digit numeric timestamp parameter, which is a characteristic pattern of its C2 communication.
This rule detects suspicious usage of certutil.exe for file downloading or the execution of the Chisel proxy tool, specifically targeting connections or authentication towards the suspicious IP address 69.48.228.86. This behavior is indicative of C2 communication or ingress tool transfer.
Detects specific command strings ('proxy_open', 'proxy_data', 'proxy_close') associated with the Koktevrat Android RAT's tunneling functionality. The rule monitors outbound TCP traffic to identify the initiation, data transfer, and termination phases of a proxy connection, leveraging Suricata flowbits to track the state of the C2 tunnel.
Detects network activity associated with the GhostCode phishing kit, specifically communication with its geolocation harvester API, DNS lookups for the FlashProxy.io residential proxy service used for geolocation evasion, and identification of the proxy_ip in HTTP responses.
Page 4 of 22