Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
408 detections
Filters
Last updated
All Time
Detection languages
405
2
1
Contributors
144
114
48
39
36
Categories
281
276
132
105
60
Platforms
381
25
16
7
5
Products / Services
388
318
30
5
4
MITRE Techniques
174
103
44
30
28
CVEs
4
1
1
IDS Classtypes
201
121
21
19
14
IDS Protocols
2,431
868
408
324
97
Detects network traffic (TLS SNI or HTTP Host) to Firebase domains (firebaseio.com, firebaseapp.com, firebasedatabase.app) associated with Mantax Otax and other Android ransomware families for ransom negotiation chat channels.
Detects network communication to Firebase infrastructure (.firebaseio.com) initiated by Android devices, which may indicate command-and-control (C2) activity associated with the Mantax Otax malware family. This rule tracks initial connections and should be correlated with specific suspicious domains for higher confidence.
Detects Odyssey Stealer malware communicating with a known C2 infrastructure using TLS and performing data exfiltration via HTTP requests to raw-IP destinations using disguised file names such as analytics.gif, pixel.png, and content.js.
This rule detects TLS handshakes where the Server Name Indication (SNI) field contains an IP address literal instead of a domain name. Legitimate web services and applications typically use FQDNs for TLS SNI to support virtual hosting. Using an IP literal in the SNI field is a technique often used by malware, C2 infrastructure, and malicious scripts to establish encrypted connections while avoiding standard DNS lookups, which may be logged or monitored.
Detects potential data exfiltration activity where a host is communicating with the Telegram Bot API. The rule identifies high-frequency connections to api.telegram.org and inspects HTTP URIs for signs of Telegram Bot token usage combined with 'sendDocument' or 'sendPhoto' commands, which are common indicators of malicious exfiltration.
Detects potential data exfiltration activity where a host is communicating with the Telegram Bot API. The rule identifies high-frequency connections to api.telegram.org and inspects HTTP URIs for signs of Telegram Bot token usage combined with 'sendDocument' or 'sendPhoto' commands, which are common indicators of malicious exfiltration.
This rule monitors TLS traffic for a specific combination of certificate issuer Common Name (CN) matching 'YE1' and Server Name Indication (SNI) hostnames using known disposable or high-risk top-level domains (TLDs). This behavior is associated with the IronToll campaign, often indicative of command-and-control communication or malicious infrastructure staging.
This rule monitors TLS traffic for a specific combination of certificate issuer Common Name (CN) matching 'YE1' and Server Name Indication (SNI) hostnames using known disposable or high-risk top-level domains (TLDs). This behavior is associated with the IronToll campaign, often indicative of command-and-control communication or malicious infrastructure staging.
Detects network activity associated with the Mantax/Otax Android malware family, specifically identifying C2 communication to the domain apimantax.otax.fun via TLS SNI and HTTP host headers, as well as potential dynamic C2 configuration retrieval via GitHub using the OkHttp client.
Detects network activity associated with the Mantax/Otax Android malware family, specifically identifying C2 communication to the domain apimantax.otax.fun via TLS SNI and HTTP host headers, as well as potential dynamic C2 configuration retrieval via GitHub using the OkHttp client.
Detects outbound TLS traffic where the Server Name Indication (SNI) matches the hardcoded domain 'ms.checrity.com', which is associated with ShadowPad backdoor activity.
Detects periodic heartbeat beaconing activity to the domain 'tt.yeyoujs.com' over both encrypted TLS (SNI observation on port 9443) and DNS queries. This pattern is indicative of a command-and-control (C2) channel establishing or maintaining persistence.
Detects periodic heartbeat beaconing activity to the domain 'tt.yeyoujs.com' over both encrypted TLS (SNI observation on port 9443) and DNS queries. This pattern is indicative of a command-and-control (C2) channel establishing or maintaining persistence.
Detects outbound network traffic associated with the Tailscale VPN protocol, specifically identifying potential unauthorized or personal tailnet communication channels. The detection monitors for TLS SNI strings ending in '.ts.net' and WireGuard handshakes on UDP port 41641. These indicators are common to all Tailscale client activity and require environment-specific exclusions of sanctioned Tailscale infrastructure to minimize noise.
This rule detects command-and-control (C2) communication patterns associated with the 'soraki-proxy.workers.dev' domain, a Cloudflare Workers-hosted proxy service. Additionally, it identifies potential malicious mTLS implants by flagging non-standard TLS handshakes that use self-signed or auto-generated certificates missing standard organization (O) fields in the subject DN.
Detects network activity associated with the ProRAM C2 infrastructure. The rule monitors for DNS resolutions, TLS SNI field matches, and specific HTTP WebSocket upgrade patterns directed towards the 'clash-verge-upgrade.com' domain.
Detects network communication to Firebase infrastructure (.firebaseio.com) initiated by Android devices, which may indicate command-and-control (C2) activity associated with the Mantax Otax malware family. This rule tracks initial connections and should be correlated with specific suspicious domains for higher confidence.
Detects network communication to Firebase infrastructure (.firebaseio.com) initiated by Android devices, which may indicate command-and-control (C2) activity associated with the Mantax Otax malware family. This rule tracks initial connections and should be correlated with specific suspicious domains for higher confidence.
Detects network activity associated with the ProRAM C2 infrastructure. The rule monitors for DNS resolutions, TLS SNI field matches, and specific HTTP WebSocket upgrade patterns directed towards the 'clash-verge-upgrade.com' domain.
Detects outbound network traffic from internal hosts to the HiveMQ public broker using the MQTT protocol over TLS, a behavior associated with the Toy Ghouls mqtt-bird-agent C2 infrastructure.
Detects network traffic associated with the GemStone malicious browser extension, including initial registration to a command-and-control (C2) server on Cloudflare Workers, periodic heartbeat beacons, command polling, and external public IP address lookups for victim identification.
Page 13 of 20