Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
163
113
109
24
15
Contributors
109
73
61
49
26
Categories
167
139
127
91
71
Platforms
232
129
75
30
23
Products / Services
108
101
88
53
39
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
6
2
1
1
1
IDS Classtypes
60
46
5
1
1
IDS Protocols
43
30
21
7
6
This rule detects network traffic (DNS, TLS, HTTP, and TCP) originating from internal assets to known infrastructure associated with the QTFY proxy botnet/C2 framework. It identifies communication with specific C2 domains, proxy management systems, and associated malicious IP ranges.
Detects network activity (DNS lookups, TLS SNI, and HTTP Host headers) associated with proxy infrastructure (iproyal.com and lightningproxies.net) known to be used by the HEAVYGRAM/CHOSEN BRICK threat actors to mask Telegram-based command and control traffic.
Detects network activity (DNS lookups, TLS SNI, and HTTP Host headers) associated with proxy infrastructure (iproyal.com and lightningproxies.net) known to be used by the HEAVYGRAM/CHOSEN BRICK threat actors to mask Telegram-based command and control traffic.
Detects high-frequency, repeated access to a specific fraud-tracking or canary token link by sources utilizing rotating VPNs or proxies over an extended period. This behavior is indicative of automated probing or credential validation attempts associated with the Phantom Deal campaign.
Detects high-frequency, repeated access to a specific fraud-tracking or canary token link by sources utilizing rotating VPNs or proxies over an extended period. This behavior is indicative of automated probing or credential validation attempts associated with the Phantom Deal campaign.
Detects network-based exploitation attempts against Dahua Easy4IP P2P relay infrastructure, including reconnaissance probes, unauthorized relay usage, and credential theft attempts via WSSE authentication.
This rule detects command-and-control (C2) communication patterns associated with the 'soraki-proxy.workers.dev' domain, a Cloudflare Workers-hosted proxy service. Additionally, it identifies potential malicious mTLS implants by flagging non-standard TLS handshakes that use self-signed or auto-generated certificates missing standard organization (O) fields in the subject DN.
Detects network connections from Windows hosts to known IP addresses and domain names associated with the exploitation infrastructure used in CVE-2026-18577, targeting N-able N-central servers.
Detects post-exploitation persistence artifacts on Windows endpoints consistent with abuse of CVE-2026-18577.
KQL Query from file: Cloudflared Persistence & svchost.exe Masquerading Post-N-central CVE-2026-18577
This rule detects network traffic (DNS, TLS, HTTP, and TCP) originating from internal assets to known infrastructure associated with the QTFY proxy botnet/C2 framework. It identifies communication with specific C2 domains, proxy management systems, and associated malicious IP ranges.
This rule detects network connections and DNS queries associated with the QTFY proxy infrastructure, including specific domains, known proxy management system IPs, and suspicious IP ranges. This behavior is indicative of command and control (C2) activity utilizing proxy services to obfuscate traffic.
This rule detects network connections and DNS queries associated with the QTFY proxy infrastructure, including specific domains, known proxy management system IPs, and suspicious IP ranges. This behavior is indicative of command and control (C2) activity utilizing proxy services to obfuscate traffic.
This rule detects network connections and DNS queries associated with the QTFY proxy infrastructure, including specific domains, known proxy management system IPs, and suspicious IP ranges. This behavior is indicative of command and control (C2) activity utilizing proxy services to obfuscate traffic.
Detects network requests originating from the Netch gateway tool or similar environments, attempting to fetch auto-configuration profiles for Shadowsocks from the external domain 'www.sheng886.top' using the '/api/v1/internal/shadowsocks/auto-config' endpoint. The rule specifically matches the Go-http-client user agent, which is common in automated scripts and Go-based proxy tools.
Detects the use of a specific magic string ('sxcdewqaz!@#') commonly associated with the Fire Ant implant to trigger or activate reverse-tunneling capabilities over TCP ports 443, 541, 8443, and 10443.
Detects network requests originating from the Netch gateway tool or similar environments, attempting to fetch auto-configuration profiles for Shadowsocks from the external domain 'www.sheng886.top' using the '/api/v1/internal/shadowsocks/auto-config' endpoint. The rule specifically matches the Go-http-client user agent, which is common in automated scripts and Go-based proxy tools.
Detects high-frequency, repeated access to a specific fraud-tracking or canary token link by sources utilizing rotating VPNs or proxies over an extended period. This behavior is indicative of automated probing or credential validation attempts associated with the Phantom Deal campaign.
Detects HTTP 301 redirection responses from a hardcoded IP address to an external domain associated with ProRAM command-and-control infrastructure.
This rule detects potentially malicious network activity involving Dahua PTCP protocol packets that specifically request a loopback bind (127.0.0.1) using an inverted-STUN style mechanism. This behavior is indicative of an adversary attempting to bypass network segmentation or perform local service proxying/tunneling to maintain command and control or enable unauthorized access to internal services on the target device.
Detects the use of VPN clients, tunneling tools (like Tor, ngrok, plink, and SSH port forwarding), and network proxy configurations on endpoints. The rule monitors for known VPN process execution, network connections to VPN provider domains, unauthorized tunnel protocol activity, and Windows registry-based proxy modifications.
Page 8 of 22