Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
408 detections
Filters
Last updated
All Time
Detection languages
405
2
1
Contributors
144
114
48
39
36
Categories
281
276
132
105
60
Platforms
381
25
16
7
5
Products / Services
388
318
30
5
4
MITRE Techniques
174
103
44
30
28
CVEs
4
1
1
IDS Classtypes
201
121
21
19
14
IDS Protocols
2,431
868
408
324
97
Detects network traffic on non-standard ports (excluding port 443) where the TLS Server Name Indication (SNI) field contains 'dl.google.com'. This pattern is frequently observed as a method for C2 tunneling tools like Xray-core to disguise malicious command and control traffic by masquerading as legitimate Google service traffic.
Detects network traffic attempting to use 'dl.google.com' as the TLS Server Name Indication (SNI) header, which is a common indicator of Xray-core C2 tunneling or obfuscation. This rule identifies traffic attempting to masquerade as legitimate Google traffic and should be correlated with endpoint process information to confirm the initiating process is not a browser or authorized Google-related application.
Detects outbound network traffic attempting to access lookalike subdomains mimicking Okta or Microsoft 365 identity provider login pages. This behavior is associated with adversary-in-the-middle (AiTM) phishing campaigns, such as those attributed to UNC6671, where attackers use spoofed infrastructure to capture user credentials and session tokens.
Detects outbound network traffic attempting to access lookalike subdomains mimicking Okta or Microsoft 365 identity provider login pages. This behavior is associated with adversary-in-the-middle (AiTM) phishing campaigns, such as those attributed to UNC6671, where attackers use spoofed infrastructure to capture user credentials and session tokens.
Detects network traffic (TLS SNI or HTTP Host) to known domains associated with Adversary-in-the-Middle (AiTM) phishing campaigns. These domains mimic passkey, SSO, or account security portals to steal credentials and session cookies.
Detects network activity (DNS lookups, TLS SNI, and HTTP Host headers) associated with proxy infrastructure (iproyal.com and lightningproxies.net) known to be used by the HEAVYGRAM/CHOSEN BRICK threat actors to mask Telegram-based command and control traffic.
Detects network activity, including DNS queries and TLS certificate usage, related to the impersonation of the Uzbekistan state railway authority through the domain 'uzrailwaystax.com' and associated SSL/TLS certificates.
Detects network communication patterns associated with the RUSTYSHADE malware family, which leverages the GitHub REST API for command-and-control (C2) operations. The rule monitors for specific SNI indicators, GitHub API URL patterns for command retrieval, task/result file interactions, exfiltration of files (screenshots/webcam photos), and custom encrypted request body markers.
Detects DNS queries and established TLS connections to Microsoft Dev Tunnels (devtunnels.ms), which can be abused by adversaries to establish tunnels for unauthorized remote access, such as tunneling RDP traffic to bypass network security controls.
This rule detects network traffic patterns associated with the Koktevrat Android RAT, specifically identifying periodic TLS beacons (heartbeats) destined for known C2 domains (streams-tv.lol and stream-plus.lat). The behavior suggests the use of Android's AlarmManager to schedule recurring callbacks to the C2 infrastructure.
Detects anomalous TLS traffic characterized by an empty Server Name Indication (SNI) field in the TLS handshake, combined with a high frequency of such connections. This behavior is indicative of certain proxy protocols like Xray VLESS with REALITY, which are often used to evade Deep Packet Inspection (DPI) and traffic shaping policies by disguising C2 or tunneling traffic as legitimate-looking TLS connections.
Detects Odyssey Stealer malware communicating with a known C2 infrastructure using TLS and performing data exfiltration via HTTP requests to raw-IP destinations using disguised file names such as analytics.gif, pixel.png, and content.js.
Detects outbound TLS traffic to known remote access and management software domains (e.g., ScreenConnect, AnyDesk, TeamViewer), which are frequently abused by adversaries for establishing Command and Control (C2) channels.
Detects potential data exfiltration activity where a host is communicating with the Telegram Bot API. The rule identifies high-frequency connections to api.telegram.org and inspects HTTP URIs for signs of Telegram Bot token usage combined with 'sendDocument' or 'sendPhoto' commands, which are common indicators of malicious exfiltration.
Detects TLS connections using suspicious certificates identified as belonging to the SilkParasite threat actor. The rule monitors for specific certificate issuer strings paired with either malicious subject domain patterns (targeting Central Asian entities) or specific JA4X fingerprints associated with known malicious activity.
Detects TLS connections using suspicious certificates identified as belonging to the SilkParasite threat actor. The rule monitors for specific certificate issuer strings paired with either malicious subject domain patterns (targeting Central Asian entities) or specific JA4X fingerprints associated with known malicious activity.
This rule detects outbound TLS connections from server-role assets to 'devtunnels.ms', a service that facilitates temporary public tunnels to internal services. This behavior is flagged as a potential indicator of unauthorized command-and-control (C2) tunneling, particularly when originating from critical infrastructure like Domain Controllers or Exchange OWA servers.
This rule detects outbound TLS connections from server-role assets to 'devtunnels.ms', a service that facilitates temporary public tunnels to internal services. This behavior is flagged as a potential indicator of unauthorized command-and-control (C2) tunneling, particularly when originating from critical infrastructure like Domain Controllers or Exchange OWA servers.
This rule detects outbound TLS connections from server-role assets to 'devtunnels.ms', a service that facilitates temporary public tunnels to internal services. This behavior is flagged as a potential indicator of unauthorized command-and-control (C2) tunneling, particularly when originating from critical infrastructure like Domain Controllers or Exchange OWA servers.
Detects outbound network traffic associated with the Tailscale VPN protocol, specifically identifying potential unauthorized or personal tailnet communication channels. The detection monitors for TLS SNI strings ending in '.ts.net' and WireGuard handshakes on UDP port 41641. These indicators are common to all Tailscale client activity and require environment-specific exclusions of sanctioned Tailscale infrastructure to minimize noise.
Detects high-frequency TLS sessions initiated from internal hosts to Microsoft identity, Graph API, and account management endpoints. This behavior often mimics legitimate interaction but may indicate an adversary rotating infrastructure, automating reconnaissance, or interacting with C2 channels disguised as legitimate SaaS traffic.
Page 10 of 20