Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
219 detections
Filters
Last updated
All Time
Detection languages
109
46
38
12
5
Contributors
46
46
32
31
21
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
158
61
34
25
4
Products / Services
115
75
58
19
18
MITRE Techniques
91
48
34
27
19
CVEs
4
2
1
1
1
IDS Classtypes
50
20
16
6
5
IDS Protocols
44
23
21
9
6
Detects SSH traffic originating from designated edge appliances (e.g., firewalls, NAS devices) directed towards internal network destinations. This pattern is often indicative of network pivoting, lateral movement, or unauthorized remote access from exposed or compromised perimeter assets.
This rule detects outgoing TCP traffic that initiates a SOCKS5 handshake (indicated by the byte sequence |05 01 00|) on destination ports other than standard web ports (80, 443, 8080, 8443). This behavior is characteristic of TOR client traffic attempting to establish an anonymous connection to an external TOR relay or node via non-standard network ports.
This rule detects persistent, long-lived outbound network connections from a single device to external public IP addresses over common web ports (80 and 443). By calculating the connection count, total duration, and average interval between connections, it identifies periodic beaconing activity consistent with command and control (C2) communication patterns, such as those observed in UNC1549 TRUSTRAP traffic.
Detects DNS TXT query responses containing anomalously large RDATA payloads (exceeding 100 bytes). Large TXT records are frequently used in DNS tunneling or data exfiltration scenarios to smuggle data out of a network while bypassing traditional network security controls. The rule applies a threshold limit to identify persistent, potentially malicious exfiltration activity from a specific source over a 60-second window.
Detects outbound network traffic from internal hosts to the domain 'avenger-sync.live' over TLS port 443, which is associated with PamStealer stage-two command and control communication.
Detects outbound HTTPS traffic on non-standard ports that matches a specific JA3 fingerprint associated with the Sliver command and control framework. This indicates potential beaconing or C2 communication from a compromised host.
This rule detects potential command and control (C2) beaconing activity by identifying devices communicating with known suspicious remote IP addresses at regular, repeating intervals. It calculates the time difference between consecutive connections to specific suspicious IPs and identifies devices that establish at least three connections within one-hour bins, adhering to a 1 to 15-minute heartbeat interval.
This rule identifies potential BRICKSTORM command and control (C2) activity by detecting sustained beaconing patterns to known public DNS-over-HTTPS (DoH) providers (8.8.8.8, 1.1.1.1) over port 443. It buckets network connections into 10-minute windows and flags source devices exhibiting frequent, repetitive traffic patterns, enriched with asset context to prioritize alerts from edge appliances such as firewalls, NAS devices, or storage sync services.
This rule detects network connections to external (non-private) IP addresses on port 8013. Additionally, it identifies potential anomalies where a network request on this port contains a message indicating that the required certificate was not found in the HTTP request header, which may indicate unauthorized or malicious activity, such as C2 communication attempt over non-standard ports or communication bypass.
This rule monitors outbound network connections from internal hosts to specific ports associated with database management (MySQL: 3306) and service orchestration/discovery (Nacos: 8848, 9848). It aggregates connection counts and distinct target IP addresses by source host and initiating process. High volumes of connections to these specific service ports from unexpected processes may indicate unauthorized discovery, brute-force attempts, or lateral movement.
This rule detects potential command and control (C2) beaconing activity using DNS tunneling. It monitors for a high frequency of DNS TXT record queries to long subdomains (exceeding 50 characters), which is a common characteristic of tools like DNScat and iodine that encode data within DNS requests.
Identifies network connections to known ShinyHunters IP addresses or domains associated with the recent Oracle PeopleSoft exploitation campaign. This rule monitors both endpoint network events and perimeter firewall/proxy logs for outbound communication to the specified malicious infrastructure.
This rule identifies suspicious outbound network beaconing by analyzing flow statistics for consistency in interval and payload size. It flags processes that demonstrate periodic communication (heartbeats) to external endpoints on non-standard ports. The detection logic calculates a 'beacon_score' based on the consistency of the communication interval, small average payload sizes, low variance in payload sizes, and the number of connections. Additional weighting is applied to connections made by typically non-network processes (e.g., svchost, explorer, wscript) or those connecting to ports associated with known malware like SystemBC.
This rule monitors network traffic for specific command-and-control (C2) communication patterns associated with the Ousaban banking trojan. It detects response packets from an external server to a client machine containing JSON-like structural indicators such as 'inicio{', 'host', and 'porta' followed by '}fim'.
Detects frequent, persistent outbound TLS connections to api.telegram.org. This behavior is indicative of a malware sample or backdoor polling the Telegram Bot API for command and control (C2) instructions, effectively using the legitimate Telegram infrastructure to tunnel malicious communication.
Detects recurring network connections (beaconing) to domains ending in 'azurewebsites.net' over HTTPS (port 443). The rule identifies potential command and control (C2) behavior by aggregating counts of connections and distinct destination IPs per process and host over time, flagging activity that exhibits regular, repeating patterns.
Detects anomalous network traffic patterns from SOHO/IoT and edge devices indicative of Tor-based C2 communication, including DNS queries for .onion domains, outbound connections to known Tor relay ports, and high-volume encrypted traffic over non-standard high-range ports.
This rule detects outgoing TCP traffic that initiates a SOCKS5 handshake (indicated by the byte sequence |05 01 00|) on destination ports other than standard web ports (80, 443, 8080, 8443). This behavior is characteristic of TOR client traffic attempting to establish an anonymous connection to an external TOR relay or node via non-standard network ports.
This rule detects abnormal, high-frequency network connection patterns originating from common web browser processes (msedge.exe, chrome.exe, brave.exe). It identifies scenarios where a browser process makes repetitive connections to a very small set of non-standard external domains, excluding common legitimate browser-related traffic. This behavior is indicative of background polling or C2 activity, such as that observed in malicious browser extensions (e.g., StegoAd) following an activation period.
This rule monitors network traffic for activity related to the Tox decentralized protocol. It identifies specific domains (tox.chat) or known hex-encoded identifiers associated with Payouts King ransomware leak sites and ransom notes embedded in network requests or payloads.
Detects DNS TXT query responses containing anomalously large RDATA payloads (exceeding 100 bytes). Large TXT records are frequently used in DNS tunneling or data exfiltration scenarios to smuggle data out of a network while bypassing traditional network security controls. The rule applies a threshold limit to identify persistent, potentially malicious exfiltration activity from a specific source over a 60-second window.
Page 6 of 11