Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
84 detections
Filters
Last updated
All Time
Detection languages
36
24
10
8
2
Contributors
15
14
11
9
7
Categories
40
22
21
11
7
Platforms
58
13
12
5
4
Products / Services
19
16
9
9
6
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
1
IDS Classtypes
8
1
1
IDS Protocols
6
2
1
Detects the use of native Windows binaries 'netsh.exe' to establish port proxies or 'pktmon.exe' for network packet monitoring/filtering by processes that are not signed by Microsoft. This behavior is indicative of network tunneling or C2 communication techniques used by actors such as Volt Typhoon to maintain persistence and establish network pivots.
Detects the use of the 'netsh interface portproxy' command to set up a port forwarding rule where the connection address is outside of common private IP ranges. This behavior is frequently associated with attackers establishing persistent network pivots or internal proxies to redirect C2 traffic.
Detects the use of the 'netsh interface portproxy' command to set up a port forwarding rule where the connection address is outside of common private IP ranges. This behavior is frequently associated with attackers establishing persistent network pivots or internal proxies to redirect C2 traffic.
Detects unauthorized modifications to Nginx configuration files by processes other than the Nginx service itself, known package managers, or common configuration management tools. This behavior is indicative of potential malicious activity, such as the injection of proxy directives (e.g., fastcgi_pass, proxy_pass) as observed in the Velvet Ant Operation Highland, used to pivot traffic into protected or air-gapped network segments.
Hunting rule for Atomic Red Team T1090.001 test "Connection Proxy" (Proxy: Internal Proxy). Correlate with additional signals before alerting.
Hunting rule for Atomic Red Team T1090.001 test "Connection Proxy" (Proxy: Internal Proxy). Correlate with additional signals before alerting.
Detects the use of native Windows binaries 'netsh.exe' to establish port proxies or 'pktmon.exe' for network packet monitoring/filtering by processes that are not signed by Microsoft. This behavior is indicative of network tunneling or C2 communication techniques used by actors such as Volt Typhoon to maintain persistence and establish network pivots.
Detects Microsoft Teams processes (teams.exe or ms-teams.exe) making multiple network connections to domains or IP addresses that are not part of the expected Microsoft Teams infrastructure. This rule specifically looks for connections to non-Microsoft domains (excluding .microsoft.com, .office.com, .office365.com, .skype.com, .azure.com, .cdn.office.net) and non-private IP addresses, indicating potential C2 activity by the Backdoor.Turn malware.
Detects the execution of the Squid proxy application with command line arguments that may indicate its use for malicious proxying or tunneling activities. This includes arguments related to safe ports, connection types (CONNECT, PORT, PASV), specific port numbers (21), and outgoing address configurations.
Detects the SOCKS5 proxy server module multiplexing connections to support internal network pivoting. This rule specifically looks for network connections originating from 'setup.exe' to internal IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12) with a high connection count (over 50) to indicate potential SOCKS5 proxy activity.
Detects a custom proxy process listening for forwarding instructions and creating a second outbound connection to a supplied host and service. This rule specifically looks for network events where the process image name contains 'chainworm', 'svc', or 'proxy' (case-insensitive) and the command line arguments indicate forwarding or connection establishment activities like 'forward', 'next hop', 'bind', 'listen', 'reconnect', or 'TcpClient'.
Detects internal proxy connections used to relay C2 traffic through network
Detects python binding shell instances attempting to listen on ports 8000, 8001, or 8002 to act as a local proxy node.
Detects connections to default C2 ports used by Metasploit and common RAT frameworks
This rule detects internal network traffic to port 3128, which is commonly used by Squid proxy servers. The rule is specifically looking for a high volume of such connections (10 connections within 60 seconds from the same source IP) within the home network, suggesting the use of a Squid proxy for internal command and control (C2) routing. The 'flow:to_server,established' indicates that the rule triggers on established connections from a client within the home network to a server within the home network on port 3128.
This rule detects potential command and control (C2) activity where an internal HTTP proxy port (8080) is used as a relay. Specifically, it looks for HTTP CONNECT requests, which are commonly used for tunneling through proxies, directed to port 8080 within the home network. A threshold of 10 such requests within 60 seconds from a single source IP triggers the alert, indicating suspicious proxy usage for C2 communication.
This rule detects the use of an internal proxy server to route C2 (Command and Control) traffic. Specifically, it looks for HTTP CONNECT requests within the internal network ($HOME_NET to $HOME_NET) that are established and occur at a high frequency (10 times in 60 seconds from the same source). This pattern is indicative of a system inside the network attempting to tunnel C2 communications through an internal proxy.
Detects the execution of the Bitvise SSH client, which OilRig uses for SSH tunneling and persistent access.
Detects svchost hosting RDP termsvcs communicating with the loopback address
Detects living-off-the-land (LotL) activity associated with Volt Typhoon, specifically the use of 'netsh.exe' to configure port forwarding (portproxy), which is used for lateral movement and C2 tunneling.
Detects network requests to specific URI endpoints associated with the DOMOAuth2_ and IRAOAuth2.0 malicious NuGet packages. These packages exfiltrate ASP.NET Identity data to a local C2 proxy. The rule specifically looks for traffic to these URIs on localhost via port 7152.
Page 2 of 4