Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
301 detections
Filters
Last updated
All Time
Detection languages
119
80
68
11
9
Contributors
87
39
27
26
22
Categories
136
107
105
84
44
Platforms
133
127
29
28
16
Products / Services
113
105
39
30
24
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
CVEs
2
2
2
1
1
IDS Classtypes
78
36
3
1
1
IDS Protocols
74
30
11
2
This rule detects command-and-control (C2) communication patterns associated with the 'soraki-proxy.workers.dev' domain, a Cloudflare Workers-hosted proxy service. Additionally, it identifies potential malicious mTLS implants by flagging non-standard TLS handshakes that use self-signed or auto-generated certificates missing standard organization (O) fields in the subject DN.
This rule detects command-and-control (C2) communication patterns associated with the 'soraki-proxy.workers.dev' domain, a Cloudflare Workers-hosted proxy service. Additionally, it identifies potential malicious mTLS implants by flagging non-standard TLS handshakes that use self-signed or auto-generated certificates missing standard organization (O) fields in the subject DN.
Detects network activity associated with the KREMLIN browser extension communicating with a known command and control domain (luizestrelhashapr.online). The rule monitors DNS queries, TLS SNI connections, and HTTP WebSocket upgrade requests to identify potential C2 communication.
Detects network activity associated with the KREMLIN browser extension communicating with a known command and control domain (luizestrelhashapr.online). The rule monitors DNS queries, TLS SNI connections, and HTTP WebSocket upgrade requests to identify potential C2 communication.
Detects an HTTP POST request targeting the host 'tt.yeyoujs.com' at the URI path '/api/agent/enroll', containing a specific Python aiohttp User-Agent string. This pattern is characteristic of a C2 agent attempting to register or enroll with an external command-and-control server.
Detects an HTTP POST request targeting the host 'tt.yeyoujs.com' at the URI path '/api/agent/enroll', containing a specific Python aiohttp User-Agent string. This pattern is characteristic of a C2 agent attempting to register or enroll with an external command-and-control server.
Detects network activity associated with the Mantax/Otax Android malware family, specifically identifying C2 communication to the domain apimantax.otax.fun via TLS SNI and HTTP host headers, as well as potential dynamic C2 configuration retrieval via GitHub using the OkHttp client.
Detects network activity associated with the Mantax/Otax Android malware family, specifically identifying C2 communication to the domain apimantax.otax.fun via TLS SNI and HTTP host headers, as well as potential dynamic C2 configuration retrieval via GitHub using the OkHttp client.
This rule detects command-and-control (C2) communication patterns associated with the 'soraki-proxy.workers.dev' domain, a Cloudflare Workers-hosted proxy service. Additionally, it identifies potential malicious mTLS implants by flagging non-standard TLS handshakes that use self-signed or auto-generated certificates missing standard organization (O) fields in the subject DN.
Detects an HTTP POST request targeting the host 'tt.yeyoujs.com' at the URI path '/api/agent/enroll', containing a specific Python aiohttp User-Agent string. This pattern is characteristic of a C2 agent attempting to register or enroll with an external command-and-control server.
Detects developer tooling processes such as Node.js, npm, and yarn—or processes spawned by code editors like VS Code and Cursor—establishing network connections to specific blockchain API endpoints (Tron, Binance Smart Chain, Aptos). This behavior is associated with the DEV#POPPER RAT, which utilizes these blockchain transaction channels to stage encrypted payloads and retrieve configuration keys.
Detects network traffic associated with the BengalSEO campaign, specifically the retrieval of a rogue Matomo analytics script from 'stats.us3.org' and the presence of a specific Google Tag Manager ID (G-5Y9CZZF6WJ) in file traffic. This behavior is indicative of a supply chain or SEO poisoning attack aiming to track or redirect users.
Detects network traffic consistent with the ClickFix macOS loader, specifically identifying POST requests containing 'event=pasted' and a 'BuildID' header, which are indicative of a beaconing or telemetry heartbeat.
Detects network activity associated with the NovaCookies phishing campaign, specifically identifying HTTP redirects, TLS SNI connections, or HTTP host headers pointing to infrastructure utilizing .vu top-level domains.
This rule detects activities associated with the C2Looper v2 backdoor, which achieves persistence and code execution by sideloading a malicious wtsapi32.dll into the OneDrive process. It also identifies subsequent beaconing behavior where the compromised OneDrive process communicates with GitHub-hosted infrastructure to exchange command and control state files (cmd.json, result.json, beacon.json) instead of using traditional dedicated C2 servers.
Detects a victim's WhatsApp Web session being abused to automatically propagate ClickFix lure links to contacts, correlated with recent infection indicators.
Detects HTTP requests to the JWR phishing framework's REST-based alternate C2 API surface, covering beaconing, exfiltration POSTs, CVV capture, instruction polling/acknowledgment, and device/IP fingerprint sync across five distinct endpoints.
Detects Shai-Hulud / ChainDrop activity by correlating known malicious hashes, npm/Node/Bun execution, payload artifacts, IDE persistence, credential discovery, cloud metadata access, GitHub exfiltration, C2 domains, Ethereum RPC activity, staging files, persistence artifacts, and known IOC IP connections.
KQL Query
Detects outbound network connections initiated by a process identifying itself as 'HeadlessChrome' within the User-Agent string. This behavior is indicative of a headless browser being misused as a proxy for Command and Control (C2) communication, as observed in msaRAT infections.
Detects C2Looper v2 retrieving GitHub-hosted C2 tasking files (cmd.json, result.json, beacon.json) via raw.githubusercontent.com or api.github.com, requiring repeated requests to reduce false positives from incidental single fetches.
Page 6 of 15