Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
489 detections
Filters
Last updated
All Time
Detection languages
143
130
118
29
23
Contributors
84
68
57
54
30
Categories
179
155
151
107
91
Platforms
262
161
70
34
10
Products / Services
130
120
71
69
54
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
6
5
4
2
2
IDS Classtypes
66
37
14
9
4
IDS Protocols
37
30
27
14
9
This rule detects suspicious network connections originating from specific processes (DbgView64.exe or VirtualBox.exe) to Microsoft Teams TURN relay servers, where the RemoteUrl does not start with "teams.microsoft.com". This indicates potential protocol tunneling or an attempt to exfiltrate data or establish command and control through an unexpected channel, possibly leveraging Microsoft Teams infrastructure in an unauthorized manner. The use of DbgView64.exe or VirtualBox.exe as initiating processes for such connections is highly unusual and indicative of malicious activity.
Identifies the Python-based tunneler establishing a secure Heroku websocket tunnel for reverse proxying, as observed in the SNOWGLAZE threat activity.
Detects the Cloudflared tunnel binary being renamed to svchost.exe and then used to establish a tunnel. This is indicated by the process name being 'svchost.exe' and the command line containing 'tunnel', '--url', and '--no-autoupdate'. This technique is often used by adversaries to masquerade malicious activity as legitimate system processes.
This rule detects suspicious network connections originating from specific processes (DbgView64.exe or VirtualBox.exe) to Microsoft Teams TURN relay servers, where the RemoteUrl does not start with "teams.microsoft.com". This indicates potential protocol tunneling or an attempt to exfiltrate data or establish command and control through an unexpected channel, possibly leveraging Microsoft Teams infrastructure in an unauthorized manner. The use of DbgView64.exe or VirtualBox.exe as initiating processes for such connections is highly unusual and indicative of malicious activity.
Detects GRE encapsulation used to bypass network address translation controls
This rule detects anomalous network connections originating from common communication applications (Teams, Slack, Discord, Skype) to non-standard ports (not 80, 443, 8080, 8443) and to IP addresses not typically associated with Microsoft or other major cloud providers (e.g., not starting with 13. or 51.). It specifically looks for a high volume of such connections (10 or more within an hour) from a single process on a device, which could indicate protocol tunneling or the use of these applications for command and control.
Monitors for systems communicating with trycloudflare.com infrastructure, which may indicate creation or use of temporary Cloudflare tunnels capable of bypassing traditional remote access controls.
Detects connections to 'lhr.life' tunnel domains. Miasma utilizes temporary tunneling services to bypass ingress firewalls and establish reverse shells.
Detects GRE encapsulation used to traverse network boundaries and bypass controls
Detects kubectl exec and port-forward operations via the Kubernetes API server. 'Exec' provides interactive shell access to a running container, while 'Port-forward' tunnels into the pod network, potentially bypassing network policies. This rule also detects 'attach' operations.
This rule detects potential command and control (C2) communications over non-standard ports. It identifies devices that make a high number of network connections to distinct remote IP addresses on ports other than common ones (80, 443, 53, 22, 21, 25, 110, 143, 993, 995) and not to private IP ranges. The rule aggregates connection counts and distinct remote IPs over 15-minute intervals and flags activity where there are more than 30 connections and more than 2 distinct remote IPs.
This rule detects potential DNS tunneling activity by looking for an unusually high volume of DNS queries of type TXT or NULL, or DNS queries with exceptionally long names (50 characters or more), originating from multiple distinct clients within a one-hour window. This pattern is often indicative of adversaries exfiltrating data or establishing command and control through DNS.
This rule detects potential DNS tunneling activity by identifying unusually large DNS queries. Specifically, it looks for UDP packets on port 53 (DNS) that contain the DNS query header (01 00 00 01) and have a data size greater than 100 bytes. A threshold of 10 such queries from the same source within 60 seconds is set to reduce false positives.
Flags executables whose embedded metadata identifies them as Cloudflared while the filename differs from expected distribution names, suggesting potential evasion through binary renaming.
Identifies processes consistent with Cloudflare Quick Tunnel usage by detecting unauthenticated cloudflared executions that publish local services through the --url option. Such behavior may enable unauthorized external access to internal resources.
Flags executables whose embedded metadata identifies them as Cloudflared while the filename differs from expected distribution names, suggesting potential evasion through binary renaming.
This rule detects potential DNS tunneling activity by identifying DNS queries with high entropy subdomains. Specifically, it looks for subdomains that consist of 30 or more alphanumeric characters (a-z, 0-9). A threshold is applied, triggering an alert if 5 such queries are observed from the same source IP within a 60-second window. This pattern is often indicative of data exfiltration or command and control communication over DNS.
Detects the execution of the Bitvise SSH client, which OilRig uses for SSH tunneling and persistent access.
Monitors for systems communicating with trycloudflare.com infrastructure, which may indicate creation or use of temporary Cloudflare tunnels capable of bypassing traditional remote access controls.
Detects DNS queries to domains associated with tunneling tools (Ngrok, Tailscale) and Remote Monitoring and Management (RMM) tools (FleetDeck, TacticalRMM, Level.io, Pulseway, ScreenConnect, Splashtop, RustDesk, Atera, Remcos) known to be used by threat actors like Scattered Spider/Muddled Libra for covert persistent connectivity, remote access, and lateral movement.
Detects interactive shell execution within a container in a production, using 'exec'. The execution of `cat`, followed by network connections. This could be communicating with a service that runs arbitrary commands.
Page 15 of 24