Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
163
113
109
24
15
Contributors
109
73
61
49
26
Categories
167
139
127
91
71
Platforms
232
129
75
30
23
Products / Services
108
101
88
53
39
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
6
2
1
1
1
IDS Classtypes
60
46
5
1
1
IDS Protocols
43
30
21
7
6
This rule detects network traffic patterns associated with the RatHat malware, specifically the use of 'frpc' (Fast Reverse Proxy Client) to establish a persistent reverse proxy tunnel. The rule monitors for established outbound connections containing the specific byte sequence characteristic of this tool, which is often used by adversaries to facilitate Command and Control (C2) communication.
Detects network activity (DNS lookups, TLS SNI, and HTTP Host headers) associated with proxy infrastructure (iproyal.com and lightningproxies.net) known to be used by the HEAVYGRAM/CHOSEN BRICK threat actors to mask Telegram-based command and control traffic.
Detects the specific TCP handshake pattern characteristic of the Fast Reverse Proxy (FRP) client (frpc) initiating a connection to a command-and-control server. The rule inspects established traffic for specific metadata strings ('privilege_key', 'run_id', 'pool_count') within the initial handshake payload.
Detects the specific TCP handshake pattern characteristic of the Fast Reverse Proxy (FRP) client (frpc) initiating a connection to a command-and-control server. The rule inspects established traffic for specific metadata strings ('privilege_key', 'run_id', 'pool_count') within the initial handshake payload.
This rule monitors for outbound network connections to a list of known malicious IP addresses identified as part of the GhostCode command-and-control (C2) infrastructure. It uses DeviceNetworkEvents data to flag activity originating from endpoints and highlights a specific IP address used during the Intune/MDM enrollment process for further investigation.
This rule detects HTTP requests directed at Microsoft Exchange Outlook Web Access (OWA) that contain suspicious 'fakePath' and 'fakePageName' parameters in the URI. These parameters are indicators of the 'GhostContainer' malware attempting to establish a socket forwarding proxy through the web server to facilitate command and control communications.
This rule detects established outbound network connections to 'devtunnels.ms', which is a legitimate service often abused by adversaries to tunnel RDP traffic and bypass network security controls or firewall restrictions. This behavior is indicative of unauthorized remote access setup.
This rule detects the execution of processes associated with CLI proxy routers (such as CLIProxyAPI or router-for-me) that establish network connections to multiple AI provider APIs (e.g., Anthropic, OpenAI, Google Gemini) within a short window. This pattern is indicative of efforts to bypass rate-limiting or allowlisting mechanisms commonly used by corporate environments to control and audit AI service interactions.
This rule detects the execution of processes associated with CLI proxy routers (such as CLIProxyAPI or router-for-me) that establish network connections to multiple AI provider APIs (e.g., Anthropic, OpenAI, Google Gemini) within a short window. This pattern is indicative of efforts to bypass rate-limiting or allowlisting mechanisms commonly used by corporate environments to control and audit AI service interactions.
This rule detects the execution of processes associated with CLI proxy routers (such as CLIProxyAPI or router-for-me) that establish network connections to multiple AI provider APIs (e.g., Anthropic, OpenAI, Google Gemini) within a short window. This pattern is indicative of efforts to bypass rate-limiting or allowlisting mechanisms commonly used by corporate environments to control and audit AI service interactions.
Detects execution of the 'socat' utility with command-line arguments indicating the establishment of a network listener. Socat is a multipurpose relay tool that can be abused by adversaries for pivoting, proxying traffic, or creating reverse shells by establishing listener ports.
This rule detects suspicious usage of certutil.exe for file downloading or the execution of the Chisel proxy tool, specifically targeting connections or authentication towards the suspicious IP address 69.48.228.86. This behavior is indicative of C2 communication or ingress tool transfer.
Detects the execution of Python interpreters with command-line arguments referencing files commonly used for proxy configurations, such as 'verify3.py', 'proxy_tester', or various '.txt' files located within a '/root/proxy/' directory. This pattern is indicative of potential proxy testing, configuration, or usage of custom proxy-based command-and-control tools.
Detects the execution of Python interpreters with command-line arguments referencing files commonly used for proxy configurations, such as 'verify3.py', 'proxy_tester', or various '.txt' files located within a '/root/proxy/' directory. This pattern is indicative of potential proxy testing, configuration, or usage of custom proxy-based command-and-control tools.
Detects the execution of Python interpreters with command-line arguments referencing files commonly used for proxy configurations, such as 'verify3.py', 'proxy_tester', or various '.txt' files located within a '/root/proxy/' directory. This pattern is indicative of potential proxy testing, configuration, or usage of custom proxy-based command-and-control tools.
Detects the initialization of an FRP (Fast Reverse Proxy) protocol connection, characterized by a specific 3-byte null sequence followed by the 'frp' string marker in the packet header. This pattern is often associated with the RatHat malware using FRP to establish covert reverse tunnels for command-and-control communication.
Detects network traffic containing configuration parameters associated with RatHat Android malware (FrpsAddr, FrpsPort, FrpsToken), indicating an attempt to establish a reverse tunnel to a Command and Control server for remote access or proxying.
This rule detects HTTP requests directed at Microsoft Exchange Outlook Web Access (OWA) that contain suspicious 'fakePath' and 'fakePageName' parameters in the URI. These parameters are indicators of the 'GhostContainer' malware attempting to establish a socket forwarding proxy through the web server to facilitate command and control communications.
Detects the use of netsh.exe to establish a port proxy, specifically conditioned on the execution context of the Impacket atexec tool (indicated by specific naming patterns and parent processes). This activity often follows the lateral movement or execution of a remote service by a tool like Impacket.
Detects established SSH network connections originating from the internal network to external destinations on ports other than the standard port 22. This behavior is often associated with unauthorized SSH tunneling or command-and-control (C2) communication intended to bypass standard firewall egress filtering.
Detects network activity (DNS lookups, TLS SNI, and HTTP Host headers) associated with proxy infrastructure (iproyal.com and lightningproxies.net) known to be used by the HEAVYGRAM/CHOSEN BRICK threat actors to mask Telegram-based command and control traffic.
Page 5 of 22