Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
88 detections
Filters
Last updated
All Time
Detection languages
46
20
16
4
2
Contributors
27
17
10
9
8
Categories
47
44
32
31
12
Platforms
50
40
10
6
3
Products / Services
41
38
13
13
6
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
IDS Classtypes
27
16
2
1
IDS Protocols
34
7
5
Detects outbound network traffic attempting to interact with a specific Polygon smart contract address using eth_call. This behavior is indicative of the EtherHiding technique, where adversaries leverage blockchain infrastructure as a dead-drop resolver for command-and-control (C2) operations to bypass traditional network defenses.
Detects network traffic associated with NarwhalRAT malware utilizing the pCloud API as a command-and-control (C2) channel or dead-drop resolver. The rule monitors both HTTP requests containing specific folder identifiers and authentication parameters, as well as TLS SNI indicating connections to api.pcloud.com.
This rule detects malicious network traffic generated by the ClearFake malware, which uses a specific JSON-RPC 'eth_call' request to the Binance Smart Chain (BSC) testnet to retrieve C2 instructions from a designated dead-drop smart contract. This method allows the adversary to maintain persistent command and control communication by leveraging blockchain technology.
Detects network indicators associated with the ClearFake campaign, including connections to known dead-drop resolvers (bsc-testnet-rpc.publicnode.com), use of Cloudflare Workers as C2 infrastructure, and the delivery of malicious fake browser-update/CAPTCHA JavaScript payloads.
This rule detects outgoing HTTP POST requests to the public BSC testnet RPC endpoint ('bsc-testnet-rpc.publicnode.com') containing an 'eth_call' request, which is a technique used by the 'EtherHiding' campaign to fetch malicious JavaScript payloads directly from blockchain smart contracts, bypassing traditional web-based C2 infrastructure.
Detects network traffic patterns associated with the Kimsuky threat group utilizing raw.githubusercontent.com as a dead-drop resolver. The rule specifically identifies the retrieval of configuration files (.ini) and victim-specific data files (.dat) containing MachineGuid identifiers, which are characteristic of Kimsuky's command and control (C2) operations.
Detects network communication patterns associated with the RUSTYSHADE malware family, which leverages the GitHub REST API for command-and-control (C2) operations. The rule monitors for specific SNI indicators, GitHub API URL patterns for command retrieval, task/result file interactions, exfiltration of files (screenshots/webcam photos), and custom encrypted request body markers.
This rule detects network communication associated with the REVSTEALER 'EtherHiding' technique. It monitors for POST requests to Polygon network RPC endpoints containing specific contract interaction signatures ('eth_call' with '0x4965e13f' and a specific contract address), as well as TLS connections to known malicious domains and fallback RPC providers used to resolve C2 instructions from blockchain data.
This rule detects network communication associated with the REVSTEALER 'EtherHiding' technique. It monitors for POST requests to Polygon network RPC endpoints containing specific contract interaction signatures ('eth_call' with '0x4965e13f' and a specific contract address), as well as TLS connections to known malicious domains and fallback RPC providers used to resolve C2 instructions from blockchain data.
Detects malicious traffic directed towards unpkg.com associated with the 'Beamglea' campaign. The rule specifically monitors for connections to known malicious npm-mirrored packages or pages serving fake Cloudflare CAPTCHA challenges, which are common tactics for credential theft and browser-based exploitation.
Detects network activity related to the Beamglea/ClickFix framework using api.keyval.org as a dead-drop resolver. The rule monitors for DNS resolutions, TLS SNI requests, and HTTP GET/PUT requests to the identified C2 infrastructure, which is used for retrieving and storing obfuscated redirect values.
Detects malicious traffic directed towards unpkg.com associated with the 'Beamglea' campaign. The rule specifically monitors for connections to known malicious npm-mirrored packages or pages serving fake Cloudflare CAPTCHA challenges, which are common tactics for credential theft and browser-based exploitation.
Detects DNS queries to Cloudflare Workers subdomains that mimic the QUICAgent beaconing pattern. Adversaries utilize these workers as dead-drop resolvers to retrieve updated C2 instructions or redirection information, effectively blending in with legitimate traffic to the workers.dev domain.
This rule detects suspicious network connections to GitHub and Postimg where specific assets are retrieved by a non-browser User Agent. This behavior is associated with the TWINLOOT campaign, where a Python-based implant retrieves fake loading-screen assets as part of a C2 communication sequence, utilizing legitimate image and video hosting services as dead-drop resolvers.
Detects periodic beaconing and configuration polling by the TWINLOOT implant using Azure Blob Storage as a dead-drop mechanism. The rules identify specific TLS SNI patterns and HTTP requests for 'cfg.json' files hosted on Azure Blob storage using non-browser user-agents.
Detects a malformed/high-entropy repeated-label DNS query pattern used by ACRStealer as a connectivity canary check prior to establishing C2.
Detects network traffic indicating potential Command and Control (C2) tasking communication via Microsoft SharePoint. The rule monitors for requests to specific SharePoint paths associated with the TWINLOOT campaign, which leverages legitimate cloud infrastructure for malicious command delivery.
Detects the ACRStealer Telegram Dead Drop Resolver handoff: a non-Telegram-client TLS/SNI contact into Telegram's IP range immediately followed by a DNS/TLS/HTTP connection to the resolved C2 domain res.explicittweak.cc.
Detects DNS resolution and subsequent TLS connection to the ACRStealer Telegram-based Dead Drop Resolver domain (res.explicittweak.cc), used to fetch C2 configuration via Telegram's IP range.
Detects a process that queries a public IP lookup service (ipify.org, ifconfig.me) and, within 30 seconds, initiates a second distinct network connection from the same causality/actor process chain that transfers data, consistent with environmental-keying techniques used by DOUBLECUP to fetch secondary-stage payloads keyed to the victim's public IP.
Detects DeviceManager's EtherHiding C2 resolution: an eth_call JSON-RPC request using get_data_selector 0x1dcf296b against the known-malicious contract address 0xc027490af56a9d7050fc259ecd03da1580b84aae, excluding requests with a browser-like User-Agent.
Page 2 of 5