Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
667 detections
Filters
Last updated
All Time
Detection languages
304
127
82
42
35
Contributors
151
83
80
37
31
Categories
442
354
165
142
112
Platforms
398
212
86
70
20
Products / Services
184
122
103
93
65
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
5
3
3
1
1
IDS Classtypes
74
35
7
6
3
IDS Protocols
71
22
17
7
2
Detects a specific sequence of behavior associated with Gryxa data collection and exfiltration. A single process queries system state or logs (scheduled tasks, WMI, event logs), creates an archive file (.zip, .7z, .rar), and establishes an outbound public network connection shortly thereafter.
Detects PHP script execution interacting with the Microsoft Exchange Web Services (EWS) API, which may indicate web shell usage, email collection, or exfiltration activity.
Detects outbound network connections to known SectopRAT C2 infrastructure, specifically targeting the hardcoded IP 98.142.252.140 or the non-standard port 15847 often used for encrypted exfiltration.
This rule detects potential post-exploitation activity where a web server process spawns a command shell, executes system discovery commands, and immediately initiates an outbound network connection. This behavior is indicative of a web-based exploit leading to interactive command execution and subsequent C2 communication.
Detects the suspicious combination of a file modification within Magento frontend or checkout JavaScript/template directories followed by an outbound network connection initiated by web server processes (e.g., Apache, Nginx, PHP). This pattern is consistent with the injection of a digital skimmer (e.g., Magecart style) and the subsequent exfiltration of stolen payment card data to an attacker-controlled endpoint.
This rule detects the suspicious archival of browser credential files (e.g., Login Data, Cookies, wallet.dat) or the transmission of data to common command-and-control (C2) services such as Telegram, Discord, or raw IP addresses using common system tools like PowerShell, curl, or certutil.
Detects network traffic to the Telegram Bot API where the request URI contains indicators of sensitive data exfiltration such as 'cookie', 'session', 'password', or 'credential'. This pattern is often associated with adversary-in-the-middle (AiTM) phishing kits (e.g., Evilginx2) exfiltrating stolen session tokens or credentials to an attacker-controlled Telegram bot.
This analytic detects intrusion events from known threat activity using Cisco Secure Firewall Intrusion Events.
It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where one or multiple Snort signatures
associated with a known threat or threat actor activity have been triggered within a one-hour time window. The detection uses a
lookup table (cisco_snort_ids_to_threat_mapping) to map Snort signature IDs to known threat actors and their techniques.
When multiple signatures associated with the same threat actor are triggered within the time window, and the count of
unique signatures matches or exceeds the expected number of signatures for that threat technique, an alert is generated.
This helps identify potential coordinated threat activity in your network environment by correlating related intrusion
events that occur in close temporal proximity.
Currently, this detection will alert on the following threat actors or malware families as defined in the cisco_snort_ids_to_threat_mapping lookup:
* AgentTesla
* Amadey
* ArcaneDoor
* AsyncRAT
* CastleRAT
* Chafer
* DCRAT
* LokiBot
* Lumma Stealer
* Nobelium
* Quasar
* Remcos
* Snake
* Static Tundra
* Xworm
To add or update threat actors, update the cisco_snort_ids_to_threat_mapping.csv lookup file with new or modified threat names and associated Snort signature IDs.
It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where one or multiple Snort signatures
associated with a known threat or threat actor activity have been triggered within a one-hour time window. The detection uses a
lookup table (cisco_snort_ids_to_threat_mapping) to map Snort signature IDs to known threat actors and their techniques.
When multiple signatures associated with the same threat actor are triggered within the time window, and the count of
unique signatures matches or exceeds the expected number of signatures for that threat technique, an alert is generated.
This helps identify potential coordinated threat activity in your network environment by correlating related intrusion
events that occur in close temporal proximity.
Currently, this detection will alert on the following threat actors or malware families as defined in the cisco_snort_ids_to_threat_mapping lookup:
* AgentTesla
* Amadey
* ArcaneDoor
* AsyncRAT
* CastleRAT
* Chafer
* DCRAT
* LokiBot
* Lumma Stealer
* Nobelium
* Quasar
* Remcos
* Snake
* Static Tundra
* Xworm
To add or update threat actors, update the cisco_snort_ids_to_threat_mapping.csv lookup file with new or modified threat names and associated Snort signature IDs.
Detects outbound network traffic from internal hosts to the domain 'skyleen.fr' over TLS/HTTPS, which is characteristic of credential exfiltration associated with the Sckit supply chain worm.
Detects a process reading credential store files (Login Data) from multiple Chromium-based browsers, immediately followed by an HTTP POST request to a specific exfiltration endpoint associated with the Psychedelic Stealer malware.
Detects unauthorized exfiltration of sensitive information, such as camera credentials or location data, directed to the Telegram Bot API as part of the 'Operation CameraSwarm' campaign.
This rule detects network traffic associated with Lumma Stealer information-stealing malware, specifically identifying HTTP POST requests that utilize the 'TeslaBrowser/5.5' user agent. This pattern is indicative of the malware exfiltrating stolen data to its Command and Control (C2) server.
This rule detects outgoing HTTP POST requests to the '/api/credentials' endpoint, which is characteristic of the AMOS (Atomic macOS Stealer) malware family communicating with its command-and-control server to exfiltrate stolen sensitive information.
Detects a suspected infostealer activity chain involving the unauthorized access of credential and session cookie files, followed by the archival of these files into a temporary or staging directory, and concluding with an outbound network connection to an uncommon destination from the archiving process.
Detects inbound command-and-control traffic to the MOVEit Transfer application targeting the LEMURLOOT web shell, and subsequent detection of gzip-compressed database exfiltration.
Detects a multi-stage communication pattern involving an initial request to a URL-mirroring or shortening service with a long base64-encoded path, followed by a request to a screenshot/rendering API, and culminating in the reception of an image file. This chain is indicative of command and control (C2) communication where command output or exfiltrated data is encoded into images rendered by external web services to bypass traditional network security filters.
Detects outbound network connections to known SectopRAT C2 infrastructure, specifically targeting the hardcoded IP 98.142.252.140 or the non-standard port 15847 often used for encrypted exfiltration.
Detects high-volume outbound network connections over port 443 with significant duration, which is indicative of staged data exfiltration activity. The rule identifies sustained transfers exceeding 50MB that last longer than 5 minutes, targeting non-local network destinations.
Detects anomalous, high-frequency outbound network connections to port 443 initiated by the binary 'rnpkeys.exe'. This behavior is characteristic of the Sauron Loader, which uses this masqueraded process to exfiltrate collected data, such as screenshots, via an encrypted C2 channel.
Detects HTTP POST requests directed to the URI path '/api/credentials' over the non-standard TCP port 8133, which is indicative of AMOS (Atomic macOS) Stealer exfiltrating stolen credentials to a C2 server.
Detects network activity associated with the RatHat Android malware, specifically identifying C2 data exfiltration API calls over FRP (FRP/Go Agent) tunnels and WebSocket handshake traffic for command-and-control communication.
Page 1 of 32