Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
408 detections
Filters
Last updated
All Time
Detection languages
405
2
1
Contributors
144
114
48
39
36
Categories
281
276
132
105
60
Platforms
381
25
16
7
5
Products / Services
388
318
30
5
4
MITRE Techniques
174
103
44
30
28
CVEs
4
1
1
IDS Classtypes
201
121
21
19
14
IDS Protocols
2,431
868
408
324
97
Detects anomalous TLS traffic directed at Binance or Bybit domains where the server certificate issuer is not from a known trusted certificate authority. This behavior is indicative of a Man-in-the-Middle (MITM) proxy interception, often associated with tools like JSCeal attempting to inspect or modify encrypted traffic to financial services.
Detects anomalous TLS traffic directed at Binance or Bybit domains where the server certificate issuer is not from a known trusted certificate authority. This behavior is indicative of a Man-in-the-Middle (MITM) proxy interception, often associated with tools like JSCeal attempting to inspect or modify encrypted traffic to financial services.
Detects outbound network traffic associated with StyleSmuggler C2 infrastructure. The rule identifies established TLS connections to a known malicious IP address (99.84.67.186) and monitors for WebSocket-over-TLS traffic using the suspicious SNI 'windwsecurity.run'.
This rule detects a multi-stage reconnaissance behavior where an internal host first establishes a TLS connection to speedtest.net, followed immediately by high-volume TCP SYN packet activity (100+ events in 10 seconds), characteristic of network scanning tools like Masscan.
Detects network activity related to the Toy Ghouls 'matrix-bird-agent' backdoor. The rule identifies communication with the domain 'meet.element.tw' via TLS SNI and HTTP host headers, as well as specific Matrix API event types (m.bird.status, m.bird.metrics, m.bird.cmd_response) and references to 'panel-bot' within the HTTP request body, indicating potential command-and-control behavior.
Detects periodic TLS network beacons to external destinations on port 443, characteristic of the BridgeAgent malware. The rule identifies suspicious outbound connections that exhibit consistent, repetitive behavior patterns, potentially indicating C2 communication. It is recommended to correlate this network activity with EDR alerts focusing on masquerading processes, specifically instances where binaries like gnome-shell are running as root and persisted via service mechanisms like zabbix_agent.service.
Detects outbound network traffic associated with StyleSmuggler C2 infrastructure. The rule identifies established TLS connections to a known malicious IP address (99.84.67.186) and monitors for WebSocket-over-TLS traffic using the suspicious SNI 'windwsecurity.run'.
Detects periodic outbound TLS connections over port 443 exhibiting beaconing behavior (5+ established connections with a non-empty SNI from a source host within 300 seconds), consistent with BridgeAgent malware C2 heartbeat/reverse-shell maintenance. Correlate with EDR detections of a process masquerading as /usr/bin/gnome-shell running as root and persisted via a fraudulent zabbix_agent.service.
Detects outbound network traffic to the Telegram Bot API (api.telegram.org) via TLS SNI or HTTP requests, which is a common communication channel for Command and Control (C2) or management for Phishing-as-a-Service (PhaaS) platforms.
Detects network traffic consistent with SynkLoader malware communicating with its C2 infrastructure. The rule identifies suspicious TLS SNI requests to known hardcoded domains and HTTP POST requests using the application/octet-stream content type, which are characteristic of SynkLoader C2 beaconing.
This rule detects potential command-and-control (C2) activity from the TWINLOOT malware, which utilizes Microsoft Teams TURN relay infrastructure to establish a reverse SOCKS5 tunnel. The detection identifies connections to 'worldaz-msit.relay.teams.microsoft.com' followed immediately by a SOCKS5 handshake pattern (05 01 00), indicating encapsulated tunneling within the relay communication.
Detects periodic beaconing and configuration polling by the TWINLOOT implant using Azure Blob Storage as a dead-drop mechanism. The rules identify specific TLS SNI patterns and HTTP requests for 'cfg.json' files hosted on Azure Blob storage using non-browser user-agents.
Detects network activity (DNS queries and TLS connections) to the known command-and-control (C2) domain 'vm180012.hosted-by.qwins.co' associated with the PureLogs Stealer malware.
Detects network activity associated with the PureLogs Stealer, specifically connections to identified infrastructure hosting payloads on Pixeldrain and attempts to retrieve steganographic payloads via specific API endpoints.
Detects TLS sessions to Sapphire Sleet/UNC1069 Hostwinds C2 infrastructure presenting the exact self-signed certificate issuer string linked to the Mastra/axios campaigns.
Detects the ACRStealer Telegram Dead Drop Resolver handoff: a non-Telegram-client TLS/SNI contact into Telegram's IP range immediately followed by a DNS/TLS/HTTP connection to the resolved C2 domain res.explicittweak.cc.
This rule detects outbound TLS connections from the local network to an external destination where the server provides a self-signed certificate. Self-signed certificates are often used by malware for command-and-control (C2) communication or by data exfiltration tools to establish encrypted channels while avoiding the need for legitimate, verifiable PKI infrastructure.
Detects network activity associated with the TWINLOOT malware, identifying command-and-control communication through TLS ALPN, custom HTTP User-Agent strings, and specific SNI values for known C2 infrastructure.
Detects network retrieval of the ShieldBreak exploit PoC or the UnDefend companion tool from their known distribution infrastructure (git.projectnightcrawler.dev, github.com/Nightmare-Eclipse/UnDefend) via TLS SNI or HTTP host/URI matching.
Detects Antino's abuse of trusted cloud services — Microsoft Graph API and Google Docs — as C2 channels, gated on non-standard TLS ports, missing browser User-Agent, and non-HTML response bodies to reduce false positives from the very high volume of legitimate traffic to these domains.
Detects network activity associated with the BumbleBee malware, including domain-generation algorithm (DGA) pattern matches within TLS Server Name Indication (SNI) fields and direct connections to known C2 infrastructure IP addresses over HTTPS.
Page 14 of 20