Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
142 detections
Filters
Last updated
All Time
Detection languages
42
41
21
13
9
Contributors
36
22
20
9
8
Categories
92
45
32
20
16
Platforms
68
53
21
11
3
Products / Services
39
34
31
18
11
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
1
IDS Classtypes
19
16
4
1
1
IDS Protocols
25
8
6
1
1
Detects Node.js processes initiating network connections to remote destination port 2222. This specific port and behavior pattern are known to be used by the Miasma botnet as a fallback C2 channel or for SSH-based remote access when standard communication ports are blocked or monitored.
Detects network activity associated with Djinn Stealer malware, identifying either direct connections to a known command-and-control (C2) server or HTTP exfiltration attempts using a characteristic User-Agent string and binary content type.
Detects suspicious network activity using the STUN/TURN protocol on port 3478 initiated by non-browser and non-conferencing processes. The rule specifically targets unsigned processes or those located in user-writable directories (such as Temp or AppData), which are common indicators of Grandoreiro malware sideloading and establishing C2 communication tunnels.
Detects network communication with known SNOWLIGHT dropper C2 infrastructure (IP 38.60.253.35, port 8084), as well as unauthorized network activity originating from the Windows Update service (wusvc.exe) and suspicious file execution of a known malicious hash associated with this activity.
Detects outbound network connections initiated by ConfigurationRemotingServer.exe on port 443, which may indicate a reverse shell connection established via DSC (Desired State Configuration) resources.
Detects instances where a Perl interpreter attempts to mask itself as a Samba (smbd) service process, or where smbd/perl processes initiate network connections on port 5000, and identifies smbd processes spawned by non-standard parent processes like sh, bash, or perl, which is indicative of potential unauthorized service manipulation or backdoor activity.
Detects execution of Python interpreters used as an SMB server, specifically where the implementation is not using the standard SMB port (445). This behavior is often associated with the use of tools like Impacket's smbserver.py for lateral movement, staging, or data exfiltration, attempting to blend in by using non-standard ports.
This rule monitors for network connections that occur over non-standard ports (STUN, MQTT) or to specific suspicious IP addresses and domains, while excluding known legitimate user-facing applications. The detection aims to identify potentially malicious command and control (C2) communication or unauthorized network activity performed by non-standard processes.
Detects outbound network connections initiated by common AI agent runtime processes (Python, Node.js, OpenClaw) to external destinations that are not identified as known AI service providers, specifically focusing on non-standard ports or the use of WebSocket protocols. This behavior may indicate an AI agent being used for unauthorized data exfiltration, command-and-control communication, or interaction with an unverified external service.
Detects broad hollowing logic involving injected Microsoft utilities (InstallUtil.exe, RegAsm.exe, RegSvcs.exe, aspnet_compiler.exe, MSBuild.exe) communicating over non-standard web command and control ports (8443, 5443, 8041). This rule specifically excludes common initiating processes like cmd.exe, powershell.exe, explorer.exe, and svchost.exe to reduce noise.
Detects C2 traffic using non-standard ports to evade detection
Detects C2 traffic using non-standard ports to evade detection
This rule detects non-HTTPS/non-HTTP traffic attempting to tunnel over TCP port 443. It specifically looks for established TCP connections to port 443 where the application layer protocol is neither TLS nor HTTP, indicating potential covert communication or tunneling activity often associated with malware or command and control.
Detects the creation of a firewall rule using 'netsh.exe' or PowerShell ('New-NetFirewallRule') that includes the deceptive name 'Microsoft.Windows.CloudExperienceHost'. This specific naming convention is associated with the BLUERABBIT backdoor, which uses it to allow inbound VNC remote access.
Detects wscript.exe initiating outbound network connections to non-standard HTTP ports (ports other than 80, 443, or 8080), which aligns with JS.MonoGlyphRAT's C2 communication profile.
This rule detects non-DNS traffic attempting to use port 53, which is typically reserved for DNS queries. This behavior is often indicative of command and control (C2) evasion techniques, where attackers tunnel their C2 communications over a commonly allowed port to bypass firewalls and network monitoring. The rule specifically looks for TCP traffic to port 53 that is not identified as DNS application-layer protocol, originating from the home network, and establishes a flow. A threshold of 5 such events within 30 seconds from the same source IP triggers the alert.
This rule detects unusual application traffic on TCP port 8443. It triggers an alert if a source IP address initiates more than 20 TCP connections to port 8443 within a 60-second window. This threshold-based detection aims to identify potentially malicious or anomalous communication patterns that might indicate command and control activity or data exfiltration over a non-standard port often used for HTTPS.
This rule detects non-HTTP traffic being tunneled over TCP port 80. It specifically looks for established TCP connections to port 80 where the application layer protocol is not identified as HTTP and the data payload size is greater than 100 bytes. A threshold is applied to trigger an alert if 10 such events occur from the same source IP within 60 seconds. This behavior is often indicative of command and control (C2) communication or data exfiltration attempting to blend in with legitimate web traffic.
This rule detects suspicious processes (e.g., powershell.exe, cmd.exe, mshta.exe) making outbound network connections to public IP addresses on non-standard ports. This behavior can indicate command and control (C2) communication or data exfiltration attempts, as adversaries often use non-standard ports to evade detection.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-32631
Detects TCP connections to ports commonly associated with reverse shells,
C2 frameworks, and attacker tooling, as observed by Tetragon eBPF kernel-level
network monitoring. After initial container compromise, attackers establish
outbound connections on non-standard ports to maintain command and control.
Tetragon provides full process context (binary, pod, namespace, parent process)
tied to the network event, enabling high-fidelity correlation.
C2 frameworks, and attacker tooling, as observed by Tetragon eBPF kernel-level
network monitoring. After initial container compromise, attackers establish
outbound connections on non-standard ports to maintain command and control.
Tetragon provides full process context (binary, pod, namespace, parent process)
tied to the network event, enabling high-fidelity correlation.
Page 5 of 7