Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
408 detections
Filters
Last updated
All Time
Detection languages
405
2
1
Contributors
144
114
48
39
36
Categories
281
276
132
105
60
Platforms
381
25
16
7
5
Products / Services
388
318
30
5
4
MITRE Techniques
174
103
44
30
28
CVEs
4
1
1
IDS Classtypes
201
121
21
19
14
IDS Protocols
2,431
868
408
324
97
Detects a multi-stage sequence of network connections to Microsoft cloud services (login.microsoftonline.com, graph.microsoft.com, and data exfiltration endpoints like sharepoint.com) consistent with Storm-3121/Storm-3032 adversary activity. This rule is designed for IDS/IPS monitoring of traffic patterns indicating authentication, reconnaissance, and potential data exfiltration from Microsoft 365 environments.
Detects network communication associated with Mantax Otax Android malware, including traffic to identified command-and-control (C2) infrastructure and attempts to retrieve dynamic configuration files from GitHub.
Detects outbound network traffic (HTTPS and TLS) directed at the specific S3-compatible object storage host 'ams1.vultrobjects.com'. This pattern is associated with 'HEAVYGRAM', a threat actor or toolkit using Vultr S3 buckets for potential data exfiltration.
Detects outbound network traffic (HTTPS and TLS) directed at the specific S3-compatible object storage host 'ams1.vultrobjects.com'. This pattern is associated with 'HEAVYGRAM', a threat actor or toolkit using Vultr S3 buckets for potential data exfiltration.
Detects network activity associated with the KREMLIN browser extension communicating with a known command and control domain (luizestrelhashapr.online). The rule monitors DNS queries, TLS SNI connections, and HTTP WebSocket upgrade requests to identify potential C2 communication.
Detects network traffic initiated by the WeaselBiscuit loader targeting api.npoint.io, a known free JSON storage service often abused by adversaries as a dead drop resolver for Command and Control (C2) configurations or secondary payloads.
Detects network traffic initiated by the WeaselBiscuit loader targeting api.npoint.io, a known free JSON storage service often abused by adversaries as a dead drop resolver for Command and Control (C2) configurations or secondary payloads.
Detects network traffic initiated by the WeaselBiscuit loader targeting api.npoint.io, a known free JSON storage service often abused by adversaries as a dead drop resolver for Command and Control (C2) configurations or secondary payloads.
Detects Odyssey Stealer malware communicating with a known C2 infrastructure using TLS and performing data exfiltration via HTTP requests to raw-IP destinations using disguised file names such as analytics.gif, pixel.png, and content.js.
Detects network traffic indicating a HEAVYGRAM malware instance communicating with the Telegram Bot API. This is identified by monitoring encrypted TLS traffic to api.telegram.org, which is a common technique used by malware to establish a command-and-control channel using legitimate web services.
Detects network traffic indicating a HEAVYGRAM malware instance communicating with the Telegram Bot API. This is identified by monitoring encrypted TLS traffic to api.telegram.org, which is a common technique used by malware to establish a command-and-control channel using legitimate web services.
Detects network traffic indicating a HEAVYGRAM malware instance communicating with the Telegram Bot API. This is identified by monitoring encrypted TLS traffic to api.telegram.org, which is a common technique used by malware to establish a command-and-control channel using legitimate web services.
This rule detects outbound TLS connections from the internal network to external destinations where the server certificate is self-signed. It identifies connections where both the certificate issuer and subject common names (CN) are present, which is often indicative of opportunistic encryption used by C2 infrastructure or malicious payloads. The rule includes a threshold to reduce noise by limiting alerts for the same source over a specific window.
Detects outbound network traffic attempting to reach known public DNS-over-HTTPS (DoH) resolvers. This rule monitors for specific SNI fields in TLS handshakes or HTTP/2 :authority headers that indicate communication with common third-party DoH services, which may be used to bypass internal DNS filtering and monitoring controls.
Detects outbound network traffic associated with the Tailscale VPN protocol, specifically identifying potential unauthorized or personal tailnet communication channels. The detection monitors for TLS SNI strings ending in '.ts.net' and WireGuard handshakes on UDP port 41641. These indicators are common to all Tailscale client activity and require environment-specific exclusions of sanctioned Tailscale infrastructure to minimize noise.
Detects established TLS outbound connections to external networks on ports other than standard ones (e.g., 443, 465, 587, 993, 995, 8443, 9443). This behavior may indicate a covert C2 channel or unauthorized data exfiltration attempting to bypass standard firewall controls.
This rule detects network activity associated with GhostCode phishing campaigns. It monitors for suspicious TLS SNI fields and HTTP Host headers matching known device-code phishing subdomain patterns (e.g., [service]-access-[8-chars].[domain]). Additionally, it detects requests to specific known malicious hostnames and high-entropy URI paths indicative of phishing kit redirects.
This rule detects network traffic patterns associated with the Koktevrat Android RAT, specifically identifying periodic TLS beacons (heartbeats) destined for known C2 domains (streams-tv.lol and stream-plus.lat). The behavior suggests the use of Android's AlarmManager to schedule recurring callbacks to the C2 infrastructure.
This rule detects network traffic patterns associated with the Koktevrat Android RAT, specifically identifying periodic TLS beacons (heartbeats) destined for known C2 domains (streams-tv.lol and stream-plus.lat). The behavior suggests the use of Android's AlarmManager to schedule recurring callbacks to the C2 infrastructure.
This rule detects outbound TLS connections to suspicious domain names characteristic of the Koktevrat malware's DGA. The rule identifies SNI strings that match a specific regex pattern (8-16 alphanumeric characters followed by .icu or .cfd TLDs), which is indicative of automated C2 communication.
This rule detects outbound TLS connections to suspicious domain names characteristic of the Koktevrat malware's DGA. The rule identifies SNI strings that match a specific regex pattern (8-16 alphanumeric characters followed by .icu or .cfd TLDs), which is indicative of automated C2 communication.
Page 11 of 20