Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
408 detections
Filters
Last updated
All Time
Detection languages
405
2
1
Contributors
144
114
48
39
36
Categories
281
276
132
105
60
Platforms
381
25
16
7
5
Products / Services
388
318
30
5
4
MITRE Techniques
174
103
44
30
28
CVEs
4
1
1
IDS Classtypes
201
121
21
19
14
IDS Protocols
2,431
868
408
324
97
Detects network traffic attempting to connect to known proxy farm fallback hostnames using TLS SNI or HTTP CONNECT methods. These hostnames are often associated with command-and-control infrastructure designed to proxy traffic and mask the true destination of communications.
Detects network traffic (TLS SNI and HTTP Host headers) attempting to connect to known command-and-control infrastructure associated with the NodeRabbit RAT and Mirage Kitten campaign. The rule monitors for unauthorized connectivity to specific domains including 'oracle-challenge.s3.us-east-1.amazonaws.com', 'plugplay.azurewebsites.net', and 'lifespotify.com'.
Detects TLS traffic featuring certificates where both the subject and issuer common name (CN) are set to 'SLIVER', which is the default configuration for the Sliver C2 framework's self-signed certificates.
Detects the presence of self-signed TLS certificates with the common name 'JDYFJ' in the certificate subject or issuer fields. This pattern has been associated with the KV-Botnet, which has been utilized by the Volt Typhoon threat actor to obfuscate command and control traffic through compromised SOHO routers.
Detects network traffic containing TLS Server Name Indication (SNI) fields associated with known 'jailbreak-as-a-service' LLM proxies, specifically WormGPT, FraudGPT, and EvilGPT. These services are often used by threat actors to generate malicious content, phishing emails, or exploit code.
Detects outbound network traffic exhibiting the default self-signed TLS certificate subject and issuer fields 'O=Cobalt Strike' combined with the known default JA3 fingerprint '72a589da586844d7f0818ce684948eea' associated with Cobalt Strike C2 communication.
Detects outbound network traffic attempting to connect to known infrastructure associated with the VPN-for-X extension, which has been observed acting as a fallback proxy. The rule alerts on specific TLS SNI strings (de8.staticvaultcdn.org, de4.servefaststatic.work, de34.rapidstaticserve.cc) commonly leveraged by this infrastructure.
This rule detects potentially malicious Command and Control (C2) traffic utilizing DNS over HTTPS (DoH) to interact with public resolvers like Cloudflare, Google, and Quad9. It identifies both high-frequency, repeated direct-to-resolver TLS sessions and specific HTTP requests to these resolvers that resolve domains associated with known C2 infrastructure, such as the ClickFix campaign.
This rule detects potentially malicious Command and Control (C2) traffic utilizing DNS over HTTPS (DoH) to interact with public resolvers like Cloudflare, Google, and Quad9. It identifies both high-frequency, repeated direct-to-resolver TLS sessions and specific HTTP requests to these resolvers that resolve domains associated with known C2 infrastructure, such as the ClickFix campaign.
Detects egress to the NeedyMantis C2 domain corp.tripswithengine[.]com across three vantage points: TLS SNI (port 443), DNS resolution, and HTTP Host header. Each content match is anchored to the start of its buffer ('startswith') so a different domain that merely contains 'corp.tripswithengine.com' as a suffix of a longer label (e.g. 'notcorp.tripswithengine.com') cannot match — only this exact domain or a genuine subdomain of it triggers.
Detects egress to the NeedyMantis C2 domain corp.tripswithengine[.]com across three vantage points: TLS SNI (port 443), DNS resolution, and HTTP Host header. Each content match is anchored to the start of its buffer ('startswith') so a different domain that merely contains 'corp.tripswithengine.com' as a suffix of a longer label (e.g. 'notcorp.tripswithengine.com') cannot match — only this exact domain or a genuine subdomain of it triggers.
Detects egress to the NeedyMantis C2 domain corp.tripswithengine[.]com across three vantage points: TLS SNI (port 443), DNS resolution, and HTTP Host header. Each content match is anchored to the start of its buffer ('startswith') so a different domain that merely contains 'corp.tripswithengine.com' as a suffix of a longer label (e.g. 'notcorp.tripswithengine.com') cannot match — only this exact domain or a genuine subdomain of it triggers.
Detects egress to the NeedyMantis C2 domain corp.tripswithengine[.]com across three vantage points: TLS SNI (port 443), DNS resolution, and HTTP Host header. Each content match is anchored to the start of its buffer ('startswith') so a different domain that merely contains 'corp.tripswithengine.com' as a suffix of a longer label (e.g. 'notcorp.tripswithengine.com') cannot match — only this exact domain or a genuine subdomain of it triggers.
Detects network activity (DNS, TLS, HTTP) associated with suspected C2 infrastructure hosted on Cloudflare Workers, specifically identifying patterns consistent with trojanized authentication pages acting as browser-based C2 relays or WebRTC/WebSocket signaling channels.
Detects specific C2 communication patterns associated with SCKIT, including HTTPS beaconing to the skyleen.fr domain and structured URI patterns used for configuration and status requests.
Detects periodic outbound network traffic to the Telegram Bot API (api.telegram.org) indicative of potential command and control (C2) beaconing, specifically monitoring for repeating connections over extended time intervals.
Detects network activity associated with ngrok tunnel domains or suspicious lookalike Microsoft SSO domains (microsoft-sso.com) attempting to perform OIDC discovery, JWKS retrieval, or MFA-related EAM endpoint interactions. This behavior is indicative of adversary-in-the-middle (AiTM) attacks targeting authentication processes.
Detects specific C2 communication patterns associated with SCKIT, including HTTPS beaconing to the skyleen.fr domain and structured URI patterns used for configuration and status requests.
This rule detects outbound network beaconing from the SCKit malware to known command-and-control (C2) domains hosted on skyleen.fr or to a specific malicious IP address (139.84.223.178). The rule monitors both TLS SNI indicators in HTTPS traffic and direct IP connections to identify compromised hosts communicating with the attacker's infrastructure.
Detects Heartbleed (CVE-2014-0160) exploitation attempts by monitoring for malformed TLS heartbeat requests (undersized payload) followed by oversized responses from the server that indicate potential memory disclosure.
Detects network activity associated with NetSupport Manager remote access software, specifically monitoring for connections to known malicious domains and infrastructure, as well as recurring beaconing patterns indicative of command-and-control behavior.
Page 3 of 20