Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
219 detections
Filters
Last updated
All Time
Detection languages
109
46
38
12
5
Contributors
46
46
32
31
21
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
158
61
34
25
4
Products / Services
115
75
58
19
18
MITRE Techniques
91
48
34
27
19
CVEs
4
2
1
1
1
IDS Classtypes
50
20
16
6
5
IDS Protocols
44
23
21
9
6
This analytic detects suspicious use of `rundll32.exe` in combination with `mshtml.dll` and the export `RunHTMLApplication`.
This behavior is often observed in malware to execute JavaScript or VBScript in memory, enabling payload staging or
bypassing script execution policies and bypassing the usage of the "mshta.exe" binary.
The detection leverages Cisco Network Visibility Module telemetry which offers network flow activity
along with process information such as command-line arguments
If confirmed malicious, this activity may indicate initial access or payload download.
This behavior is often observed in malware to execute JavaScript or VBScript in memory, enabling payload staging or
bypassing script execution policies and bypassing the usage of the "mshta.exe" binary.
The detection leverages Cisco Network Visibility Module telemetry which offers network flow activity
along with process information such as command-line arguments
If confirmed malicious, this activity may indicate initial access or payload download.
This rule detects anomalous increases in inbound network connection volume or unique remote IP address counts associated with a specific process running on a Linux host. This behavior can be indicative of automated scanning, brute-forcing attempts, or a Denial of Service (DoS) attack targeting an exposed API service.
Identifies suspicious processes performing beacon-like network communications with rare external destinations. The rule detects consistent hourly activity intervals and high connection counts to endpoints rarely contacted by other devices in the organization, serving as a heuristic for automated C2 beaconing.
Detects a potential automated exploit sweep or brute-force attempt, identified by a high frequency of HTTP requests (GET or POST) directed to the same URI from a single source IP address within a short time frame.
This rule identifies potential command and control (C2) beaconing activity by detecting periodic, low-jitter outbound network connections. It analyzes network logs to find connections to external IP addresses that maintain a consistent frequency over a period of time, specifically flagging hosts that demonstrate repetitive traffic patterns with low variation (jitter). The rule further filters by identifying 'rare' destinations, focusing on remote IPs that have been connected to by three or fewer hosts within the environment, which is a common indicator of targeted C2 infrastructure.
Detects HTTP traffic originating from internal hosts to external destinations on port 8989, specifically targeting '/chat/completions' URI patterns. This activity is indicative of the CARBONATO/Hermes Agent leveraging LLM gateway infrastructure as a command-and-control (C2) channel.
Detects high-volume DNS traffic characterized by long, high-entropy subdomain labels, which are often used as a mechanism for command-and-control (C2) communication or data exfiltration via DNS tunneling.
This rule detects potential Cobalt Strike SMB beacon activity by identifying the creation of suspicious named pipes (commonly associated with Cobalt Strike) and correlating them with low-jitter, uniform outbound network communication patterns typical of command and control (C2) beaconing behavior.
This rule detects high-frequency HTTP GET requests containing abnormally long Base64-encoded strings within the URI. This pattern is often indicative of automated payload assembly or exfiltration where data is fragmented across multiple requests, or the use of URL-shortener services to facilitate C2 communication.
Detects TLS traffic featuring certificates where both the subject and issuer common name (CN) are set to 'SLIVER', which is the default configuration for the Sliver C2 framework's self-signed certificates.
Detects network traffic permitted from zones typically associated with NetScaler appliances (DMZ, perimeter, VPN, gateway) to sensitive internal zones (internal, trust, LAN, corp) using common administrative or lateral movement protocols (SMB, RDP, WinRM, RPC, LDAP). This behavior is indicative of potential lateral movement or exploitation originating from a compromised edge appliance.
This rule detects a potential SYN flood denial-of-service attack, characterized by a high volume of TCP SYN packets directed at a target within a short timeframe. Such activity is indicative of attempts to exhaust server resources by leaving TCP handshakes incomplete.
Detects high-frequency DNS NXDOMAIN responses for domains exhibiting patterns indicative of Domain Generation Algorithms (DGA), specifically fixed-length, high-entropy character strings. This behavior is commonly associated with botnets attempting to locate command and control infrastructure.
Detects network traffic containing TLS Server Name Indication (SNI) fields associated with known 'jailbreak-as-a-service' LLM proxies, specifically WormGPT, FraudGPT, and EvilGPT. These services are often used by threat actors to generate malicious content, phishing emails, or exploit code.
Detects the initiation of a SOCKS5 proxy handshake from an internal host to an external destination. The rule monitors for the characteristic SOCKS5 greeting (0x05) while specifically excluding HTTP traffic to identify potential unauthorized proxy tunneling used for command and control or data exfiltration.
Detects HTTP traffic patterns associated with the SocGholish Traffic Distribution System (TDS). The rule identifies an HTTP 302 redirect response where the 'Location' header points to a URL containing 'update' and a .js extension, a characteristic behavioral signature used by SocGholish for its drive-by-download campaigns.
This rule detects potential Cobalt Strike SMB beacon activity by identifying the creation of suspicious named pipes (commonly associated with Cobalt Strike) and correlating them with low-jitter, uniform outbound network communication patterns typical of command and control (C2) beaconing behavior.
Detects network traffic attempting to connect to known proxy farm fallback hostnames using TLS SNI or HTTP CONNECT methods. These hostnames are often associated with command-and-control infrastructure designed to proxy traffic and mask the true destination of communications.
Detects periodic, repetitive outbound HTTPS network connections from AI agent-runtime environments to domains that are not in the predefined allow-list. This behavior is consistent with C2 beaconing disguised as application API traffic, potentially indicating an AI agent has been compromised or misused for unauthorized external command communication.
Detects a sequence of Tox P2P protocol packets consisting of a Cookie Request, Cookie Response, and Crypto Handshake within a single network flow. This pattern is indicative of the Tox P2P protocol, which is sometimes abused by malware (e.g., AvisLoader) for command-and-control (C2) communications to evade traditional network inspection.
Detects periodic outbound network connections (beaconing) to rare remote destinations initiated by processes running from non-standard or user-writable locations. The rule calculates the interval coefficient of variation (CV) between successful connections to identify regular, consistent patterns indicative of command and control communication while excluding known legitimate update and service traffic.
Page 2 of 11