Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
1
1
Categories
2
2
2
1
Platforms
2
Products / Services
2
2
1
MITRE Techniques
2
1
1
1
1
IDS Classtypes
2
IDS Protocols
2,431
868
408
324
97
2
Detects network activity associated with the QUICAgent backdoor, including QUIC C2 traffic using a self-signed 'RAT System' certificate, direct connections to a known C2 IP address (104.64.211.22), and DNS queries for the hardcoded C2 domain 'register.mediumser.com'.
This rule detects QUIC network traffic where the TLS certificate subject and issuer match specific patterns associated with 'RAT System' and 'RAT CA'. This signature indicates potential command-and-control (C2) communication utilizing self-signed certificates for authentication pinning in an attempt to masquerade or secure malicious traffic.
