Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
219 detections
Filters
Last updated
All Time
Detection languages
109
46
38
12
5
Contributors
46
46
32
31
21
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
158
61
34
25
4
Products / Services
115
75
58
19
18
MITRE Techniques
91
48
34
27
19
CVEs
4
2
1
1
1
IDS Classtypes
50
20
16
6
5
IDS Protocols
44
23
21
9
6
Detects the use of the HTTP CONNECT method on non-standard ports (8888, 9999, 4444). The CONNECT method is frequently used by HTTP proxies to establish TCP tunnels; unauthorized use of this method on uncommon ports is a common indicator of protocol tunneling used to bypass network egress filtering or for command and control (C2) communication.
This rule identifies endpoints making network connections to a set of known suspicious or malicious IP addresses. It aggregates the number of connections and the variety of processes initiating these connections, allowing analysts to identify potential command and control (C2) communication patterns from compromised hosts.
This rule detects network connections using the Generic Routing Encapsulation (GRE) protocol to external IP addresses. GRE is often used for tunneling and can be leveraged by adversaries for command and control or data exfiltration to bypass network filtering.
Detects DNS queries and network connections to 'netdna-ssl.com' and its subdomains, as well as specific IP addresses (104.21.72.58, 172.67.175.240) associated with the re-registered domain. This domain was re-registered by a third party in July 2025 and now resolves legacy WP Engine CDN hostnames, creating a potential supply chain risk.
This rule detects macOS.Gaslight C2 communication by identifying repeated HTTPS connections to api.telegram.org from non-browser processes. It specifically looks for patterns consistent with the Rust-based implant's getUpdates polling loop, as well as sendMessage and botattach patterns. The detection logic is split into EDR-side (DeviceNetworkEvents) and NDR-side (CommonSecurityLog) components, requiring a minimum of 3 connections/flows within an hour to trigger.
This rule detects network connections using the GRE (Generic Routing Encapsulation) protocol to external IP addresses. GRE is often used for tunneling and can be leveraged by adversaries for command and control or data exfiltration, especially when communicating outside of internal networks.
This rule detects unusual outbound Server Message Block (SMB) traffic originating from common Windows processes (explorer.exe, svchost.exe, system.exe) to external IP addresses (not RFC1918 private ranges). It triggers if a device makes 5 or more SMB connections to unique remote IPs within an hour. This could indicate lateral movement, data exfiltration, or other malicious activity.
This rule detects unusual outbound Server Message Block (SMB) traffic originating from common Windows processes (explorer.exe, svchost.exe, system.exe) to external IP addresses (not RFC1918 private ranges). It triggers if a device makes 5 or more SMB connections to unique remote IPs within an hour. This could indicate lateral movement, data exfiltration, or other malicious activity.
This rule detects the use of TLS protocol on port 443 with a specific content signature, indicating potential Command and Control (C2) activity. It triggers an alert if 20 such connections are observed from the same source within 60 seconds.
Detects audio capture and exfiltration via RTP media streams
This rule identifies an anomalous surge in network connection attempts to a particular remote IP address. It establishes a baseline of average daily connection counts to each remote IP over the past week. It then compares the current hourly connection count to this baseline, triggering an alert if the current count is more than five times the baseline and surpasses a total of 500 connections within that hour. This could indicate various malicious activities such as data exfiltration, command and control communication, or a denial-of-service attack originating from the monitored environment.
This rule detects potential bandwidth hijacking activity associated with peer-to-peer botnet traffic. It triggers an alert when a high volume of TCP traffic (more than 200 packets within 60 seconds) with a packet size greater than 1000 bytes is observed originating from the home network to any destination. The 'flow:to_server,established' indicates that the rule is looking for established connections where the traffic is flowing from the internal network to an external server. The 'threshold' keyword ensures that only sustained high-volume traffic triggers the alert, reducing noise from legitimate, short bursts of activity. The 'classtype:policy-violation' suggests that this activity is considered a violation of network usage policies.
This rule detects a high number of distinct URLs and total network connections originating from a single remote IP address within a one-minute time window. This behavior can be indicative of various malicious activities such as data exfiltration, command and control (C2) communication, or network scanning. The threshold for distinct URLs is set to greater than 100 and total connections greater than 500.
This rule detects potential command and control (C2) communication over the MQTT protocol. It specifically looks for TCP traffic on port 1883 (the standard MQTT port) from the home network to any destination. The detection is triggered by the presence of a specific byte sequence ('|10|') at the beginning of the payload, which corresponds to an MQTT PUBLISH message type. A threshold of 5 such messages within 60 seconds from the same source IP is set to reduce false positives, indicating a sustained pattern of MQTT PUBLISH activity that could be indicative of C2.
This rule detects potential command and control (C2) communication over TCP that uses AES encryption with a hardcoded key pattern. It specifically looks for the byte sequence "41 45 53" (which corresponds to the ASCII string "AES") within the payload of a TCP flow from the internal network to any external destination. The rule further refines detection by checking for a payload size between 100 and 500 bytes and applies a threshold of 20 occurrences within 60 seconds from the same source IP to reduce false positives. This pattern is indicative of certain malware families that use predictable AES keying for their C2 channels.
This rule detects the use of TLS protocol on port 443 with a specific content signature, indicating potential Command and Control (C2) activity. It triggers an alert if 20 such connections are observed from the same source within 60 seconds.
This rule detects the use of MQTT (Message Queuing Telemetry Transport) over TLS on port 8883, specifically identifying it as a potential encrypted Command and Control (C2) channel. It triggers an alert if there are at least 5 established TCP connections to port 8883 from a single source within a 60-second window, indicating persistent communication often associated with C2 activities.
This rule detects non-HTTPS/non-HTTP traffic attempting to tunnel over TCP port 443. It specifically looks for established TCP connections to port 443 where the application layer protocol is neither TLS nor HTTP, indicating potential covert communication or tunneling activity often associated with malware or command and control.
This rule detects potential sandbox evasion techniques by identifying HTTP traffic containing specific API calls often used by malware to determine if it's running in a sandboxed environment. Specifically, it looks for the 'GetForegroundWindow' function, which retrieves a handle to the foreground window, and the 'Sleep' function, which can be used to delay execution and bypass time-based sandbox analysis. The combination of these two indicates an attempt to check for user interaction and evade detection.
This rule detects a high volume of UDP traffic on port 4500 to the home network, which is commonly used for IPSec NAT Traversal. The rule is specifically looking for an 'evasion' scenario, implying that this traffic pattern might be indicative of an attempt to bypass security controls or blend in with legitimate IPSec traffic. The threshold of 10 connections from the same source within 30 seconds suggests an attempt to identify sustained or repeated activity rather than a single, isolated event.
This rule detects when the 'sIDHistory' attribute is added to a domain account. This is a common technique used in privilege escalation, particularly in Active Directory environments, where an attacker adds the SID of a highly privileged account (like a Domain Admin) to a compromised account's sIDHistory. This grants the compromised account the privileges of the added SID without changing its primary SID.
Page 8 of 11