Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
532 detections
Filters
Last updated
All Time
Detection languages
207
185
44
24
19
Contributors
154
107
100
72
18
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
291
209
74
56
23
Products / Services
194
142
120
110
21
MITRE Techniques
296
147
118
86
85
CVEs
5
3
1
1
1
IDS Classtypes
78
69
17
8
5
IDS Protocols
85
51
18
9
9
This rule detects outbound network communications (TLS, MQTT, and HTTP) to HiveMQ infrastructure. The pattern of activity suggests the presence of 'Bird Agent' malware utilizing the MQTT protocol for command and control (C2) communication, as well as periodic HTTP beaconing to HiveMQ broker endpoints.
This rule detects anomalies in outbound network data transfer by comparing the current daily volume of data sent to external, non-private IP addresses against the historical average for those specific sources. It alerts when the daily volume exceeds 500MB and shows a significant spike (3x or more) compared to historical baseline data or when no historical data is available for a new source connection.
Detects activity associated with the 'BlueKit' session relay tool, which uses the rrweb library to capture and replay user session interactions. This rule identifies web browser network events involving rrweb-related scripts occurring within 10 minutes of a successful user sign-in, indicating a potential Adversary-in-the-Middle (AiTM) phishing attack where credentials and session cookies are being captured.
Detects activity associated with the 'BlueKit' session relay tool, which uses the rrweb library to capture and replay user session interactions. This rule identifies web browser network events involving rrweb-related scripts occurring within 10 minutes of a successful user sign-in, indicating a potential Adversary-in-the-Middle (AiTM) phishing attack where credentials and session cookies are being captured.
Detects anomalous, high-frequency, and highly regular HTTP requests directed at Dahua camera infrastructure for the purpose of harvesting snapshots. The rule uses statistical analysis to identify automated collection patterns, such as a high volume of requests across multiple devices with low variance in request intervals.
Detects outbound HTTP POST requests to the Telegram Bot API (/sendPhoto) that contain sensitive system information, including host credentials (port, login, password) and Shodan host data. This behavior is indicative of an information-stealing malware attempting to exfiltrate captured credentials via a Telegram bot.
Detects the AnonyMousKIT activity sequence, identified by the dispatch of a templated device-recovery lure via the WhatsApp Business API followed by a Telegram Bot API webhook alert to the operator within a 10-minute window. This temporal relationship between the outbound lure and the operator-side notification is used as a signature for the C2 orchestration.
Detects the usage of s5cmd, a command-line tool for S3, to communicate with AWS S3 endpoints. This behavior is indicative of potential data exfiltration by an adversary using authorized cloud storage tools to move data out of the environment.
Detects anomalous data transfer patterns characteristic of exfiltration by identifying a high frequency of relatively small, uniform data chunks sent to an external destination. By aggregating these chunks, the rule identifies cumulative data transfers that exceed the defined organizational threshold for a single connection, potentially bypassing security controls that monitor only individual file transfer sizes.
Detects outbound network traffic consistent with the Chisel proxy/tunneling tool establishing a connection to an external VPS associated with the Miku threat actor. The rule monitors for established TCP connections to a specific remote IP address on port 443, utilizing a threshold to reduce noise by ensuring multiple connection attempts occur.
Detects TLS connections to known CHOSEN BRICK cloud object-storage exfiltration endpoints (VultrObjects, StorjShare, Backblaze B2) and repeated Telegram Bot API document-upload calls consistent with data exfiltration. An earlier revision attempted to chain a Telegram-session flowbit to a later cloud-storage upload, but Suricata flowbits are scoped to a single flow and cannot correlate across the two separate connections involved here, so that cross-flow pair was removed as not functionally valid; each remaining rule fires independently on direct traffic to a known exfil channel.
This rule detects potential command-and-control beaconing activity associated with the Go RAT used in the GapiUpdate campaign. It monitors for outbound network connections over TCP port 5556 to a known malicious C2 IP address, or alternatively, detects persistent outbound activity to other external (non-RFC1918) IP addresses characterized by multiple successive connections within a 10-minute window, which mimics the behavior of persistent beaconing.
This rule detects potential exfiltration of sensitive files, specifically 'cert.pem' and 'private.key', via HTTP POST requests to the '/api/adbk/upload' endpoint. This pattern is characteristic of the RatHat malware attempting to exfiltrate device credentials to a Command and Control (C2) server.
Detects outbound network traffic consistent with the Chisel proxy/tunneling tool establishing a connection to an external VPS associated with the Miku threat actor. The rule monitors for established TCP connections to a specific remote IP address on port 443, utilizing a threshold to reduce noise by ensuring multiple connection attempts occur.
This rule detects outbound TLS connections from server-role assets to 'devtunnels.ms', a service that facilitates temporary public tunnels to internal services. This behavior is flagged as a potential indicator of unauthorized command-and-control (C2) tunneling, particularly when originating from critical infrastructure like Domain Controllers or Exchange OWA servers.
Detects high-volume outbound network traffic (exceeding 100MB) generated by processes identifying as 'python-httpx' to non-internal IP addresses. This activity is often associated with automated data exfiltration using Python-based tools.
Detects outbound network traffic (HTTPS and TLS) directed at the specific S3-compatible object storage host 'ams1.vultrobjects.com'. This pattern is associated with 'HEAVYGRAM', a threat actor or toolkit using Vultr S3 buckets for potential data exfiltration.
Detects outbound network traffic (HTTPS and TLS) directed at the specific S3-compatible object storage host 'ams1.vultrobjects.com'. This pattern is associated with 'HEAVYGRAM', a threat actor or toolkit using Vultr S3 buckets for potential data exfiltration.
Detects network traffic containing specific 'ASISFH' marker strings associated with the CrimsonRAT command-and-control protocol. These markers are utilized by the malware to obfuscate command tokens during C2 communication.
This rule detects potential command-and-control beaconing activity associated with the Go RAT used in the GapiUpdate campaign. It monitors for outbound network connections over TCP port 5556 to a known malicious C2 IP address, or alternatively, detects persistent outbound activity to other external (non-RFC1918) IP addresses characterized by multiple successive connections within a 10-minute window, which mimics the behavior of persistent beaconing.
This rule detects successful outbound network connections to the domain 'gapidriver.com' targeting the URI path '/api/get.php'. This pattern is associated with command and control (C2) activity. Due to the lack of specific HTTP header validation in this telemetry source, the signal may require additional validation, such as analyzing the initiating process lineage.
Page 7 of 26