Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
408 detections
Filters
Last updated
All Time
Detection languages
405
2
1
Contributors
144
114
48
39
36
Categories
281
276
132
105
60
Platforms
381
25
16
7
5
Products / Services
388
318
30
5
4
MITRE Techniques
174
103
44
30
28
CVEs
4
1
1
IDS Classtypes
201
121
21
19
14
IDS Protocols
2,431
868
408
324
97
This rule detects potential domain fronting by identifying a mismatch between the Server Name Indication (SNI) field in the TLS handshake and the Host header, specifically when the SNI field contains domains commonly used for content delivery networks (CDNs) like cloudfront.net, azureedge.net, or fastly.net. This technique can be used to obfuscate the true destination of network traffic, often for malicious purposes such as bypassing censorship or exfiltrating data.
This rule detects attempts to exploit the Heartbleed vulnerability (CVE-2014-0160) by identifying a specific pattern in TLS heartbeat requests. It looks for a TLS heartbeat request with a type of 0x18 (heartbeat request) and a length greater than 3 bytes, which is indicative of an oversized heartbeat request used in the Heartbleed exploit.
This rule detects outbound TLS connections to known temporary file sharing services, which can be indicative of data exfiltration. The rule inspects the Server Name Indication (SNI) field in TLS traffic for specific domain names associated with these services.
This rule detects TLS connections to domains associated with Gh0st RAT impersonation campaigns, specifically 'Campaign Trio' and 'Campaign Chorus'. It looks for specific strings ('i4tools', 'youdao', 'deepseek') in the TLS Server Name Indication (SNI) field, combined with top-level domains like '.top' or '.vip'. This pattern indicates potential command and control (C2) communication from Gh0st RAT malware.
This rule detects network connections to external hosts exhibiting a specific JARM fingerprint (27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6) that has been associated with a phishing campaign, specifically targeting Harbor Freight. JARM fingerprints are used to identify unique TLS server configurations, and this particular hash indicates a known malicious infrastructure.
This rule detects Command and Control (C2) communication associated with the Amatera Stealer malware. It specifically looks for TLS traffic where the Server Name Indication (SNI) field contains the string "aether100pronotification.table.core.windows.net". This SNI is considered bogus and indicative of Amatera Stealer's C2 activity.
This rule detects network traffic indicative of Kraken Ransomware activity, specifically looking for connections to Cloudflared tunnels. It identifies TLS SNI (Server Name Indication) containing '.trycloudflare.com', which is a domain used by Cloudflare for its tunnel services. This behavior is often leveraged by adversaries for command and control or data exfiltration, as it can help bypass traditional firewall rules and obscure the true destination of the traffic.
This rule detects network traffic to specific JSON storage services (jsonkeeper.com, jsonsilo.com, npoint.io) that have been observed to be abused by the DPRK-linked 'Contagious Interview' threat actors for malware delivery. The detection is based on TLS Server Name Indication (SNI) patterns.
ET MOBILE_MALWARE Observed Klopatra Domain (guncel-tv-player-lnat .]com) in TLS SNI
ET MOBILE_MALWARE Observed Klopatra Domain (adsservice2 .org) in TLS SNI
ET MOBILE_MALWARE Observed Klopatra Domain (adsservices .uk) in TLS SNI
This rule detects TLS Server Name Indication (SNI) requests for 'store.steampowered.com'. This domain is associated with the Valve Steam Store and its presence in TLS SNI could indicate activity related to information stealers like Vidar Stealer, which has been observed targeting Steam accounts.
ET INFO Remote Monitoring and Management (RMM) Tool in TLS SNI (gorelo-rmm .azurewebsites .net)
ET MALWARE Observed Win32/Lumma Stealer Related Domain (sanguen .courses) in TLS SNI
ET EXPLOIT_KIT LandUpdate808 Domain (imf1 .com) in TLS SNI
ET MALWARE TA569 Middleware Server Domain in TLS SNI (buildtoolsrvcore .com)
ET INFO Observed VNT VPN Domain (vnt .wherewego .top in TLS SNI)
ET INFO Blockchain RPC Domain in TLS SNI (api .avax .network)
ET INFO Observed VNT VPN Domain (vnt .8443 .eu .org in TLS SNI)
ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (secure .kasindramaharaj .com)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (sessionstorexint .com)
Page 18 of 20