Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
452 detections
Filters
Last updated
All Time
Detection languages
251
100
69
13
8
Contributors
113
74
46
46
44
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
302
94
46
43
29
Products / Services
317
231
88
54
28
MITRE Techniques
171
167
100
60
59
CVEs
4
3
2
2
2
IDS Classtypes
5
3
3
1
1
IDS Protocols
7
6
Detects suspicious and malformed user agent strings in proxy logs that may indicate malicious activity, including the use of specific malware or tools like Cobalt Strike, APT28 malware, Racoon Stealer, and Erbium stealer. The rule identifies various anomalies such as incorrect formatting, typos, and specific user agent strings known to be associated with adversary tools.
Detects potential Command and Control (C2) communication associated with the Small Sieve malware. This rule specifically looks for HTTP GET requests to 'api.telegram.org' with a specific chat_id and 'text=com/' in the URI, which are indicators of Small Sieve's use of the Telegram Bot API for C2.
This rule detects HTTP POST requests that exhibit characteristics commonly associated with the Empire post-exploitation framework. Specifically, it looks for a combination of a distinct user-agent string ('Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko') and specific URI paths ('/admin/get.php', '/news.php', '/login/process.php'). This pattern is indicative of an Empire agent communicating with its command and control server.
This rule detects Cobalt Strike Malleable C2 profile patterns by analyzing HTTP proxy logs. It looks for specific User-Agent strings, HTTP methods (GET/POST), URIs, and hostnames that are characteristic of known Cobalt Strike profiles, including those mimicking Amazon, generic browsers, OCSP, and OneDrive traffic. The rule aims to identify command and control communications attempting to blend in with legitimate web traffic.
Detects suspicious User-Agent strings that appear to be Base64 encoded. This pattern has been observed in some malware, such as YamaBot, to obfuscate the true User-Agent. The rule specifically looks for Base64 encoded prefixes of common browser User-Agents like 'Chrome', 'AppleWebKit', 'Dalvik', and 'Mozilla', with an offset to account for potential padding variations.
This rule detects suspicious user agent strings commonly associated with cryptocurrency miners (XMRig and CCMiner) in proxy logs. The presence of these user agents indicates that a system on the network might be infected with mining malware and is attempting to communicate with mining pools or command and control servers.
This rule detects the use of Background Intelligent Transfer Service (BITS) to connect to IP addresses directly, rather than fully qualified domain names (FQDNs). This behavior can be indicative of malicious activity, as adversaries often use BITS for command and control or data transfer, and connecting to IP addresses can be a way to bypass DNS-based security controls or to obscure the true destination.
This rule detects direct access to raw content hosted on various paste services. Adversaries often use these services to host malicious code (e.g., encrypted or encoded payloads) that is downloaded in subsequent stages of an attack, leveraging the services for command and control or defense evasion.
Detects HTTP requests with an empty user agent string in proxy logs. This can indicate an uncommon or potentially malicious request method, as legitimate browsers and many applications typically send a user agent. PowerShell's `(New-Object Net.WebClient).DownloadString` is one example of a tool that might generate such a request.
This rule detects suspicious network requests to the Telegram API (api.telegram.org) that do not include a standard 'Telegram' or 'Bot' user-agent string. This behavior is often indicative of malware or custom tools attempting to use Telegram's API for command and control or data exfiltration without revealing their identity as a legitimate Telegram client or bot.
This rule detects HTTP requests where the User-Agent header contains ' WindowsPowerShell/'. This pattern is indicative of PowerShell making web requests, potentially for downloading files, interacting with web services, or command and control activities. This can be a legitimate administrative activity but is also frequently abused by adversaries.
Detects the default communication pattern used by the BabyShark C2 framework, specifically looking for the 'momyshark?key=' string within the URI of proxy requests. This pattern is indicative of BabyShark malware attempting to communicate with its command and control server.
Detects the use of rclone, a command-line program to manage files on cloud storage, by identifying its default user-agent string in proxy logs. This activity can indicate data exfiltration to cloud storage services.
Detects a unique URL marker '/MSHTML_C7/' used in GET requests, which has been associated with RomCom exploitation attempts, potentially leveraging CVE-2023-36884. This marker is indicative of command and control communication or initial access related to the exploit.
Detects potential C2 communication related to Devil Bait malware by identifying specific URI patterns in GET requests. The rule looks for URIs containing '/cross.php?op=', '&dt=', and '&uid=' which are indicative of Devil Bait's communication with its command and control server.
Detects potential malicious .ICO files downloaded from a compromised 3CXDesktopApp via web requests to a malicious GitHub repository, indicative of the SmoothOperator campaign.
Detects downloads of potentially malicious file types (executables, scripts, documents, archives) from domains that are not common Top-Level Domains (TLDs). This rule aims to identify suspicious file transfers that bypass typical, trusted sources.
Detects potential beaconing activity to known malicious domains associated with the 3CXDesktopApp supply chain compromise. This rule specifically looks for connections through a proxy to a list of hardcoded domains identified as indicators of compromise (IOCs) during the 3CXDesktopApp incident.
Detects connections made by Microsoft BITSAdmin to domains using uncommon Top-Level Domains (TLDs). This can indicate command and control activity or data exfiltration where an adversary is attempting to blend in with legitimate traffic but using less common TLDs to avoid common filtering.
Detects a specific URL pattern containing a specific extension and parameters pointing to an IP address. This pattern was seen being used by RomCOM potentially exploiting CVE-2023-36884. The rule looks for GET requests where the URI contains a file extension like .zip, .asp, .htm, .url, .xml, .chm, .mht, .vbs, or .search-ms, followed by '?d=' and an IPv4 address.
Detects HTTP GET requests for specific file paths associated with the RomCom threat actor, potentially exploiting CVE-2023-36884. These file paths include various file types such as .url, .search-ms, .vbs, .mht, and .asp, which are likely used for initial access or further stages of the attack.
Page 21 of 22