Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,247 detections
Filters
Last updated
All Time
Detection languages
690
140
94
67
56
Contributors
389
247
199
52
45
Categories
787
411
262
248
188
Platforms
836
265
264
169
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,247
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
This rule detects a high volume of outbound network connections (20 or more within an hour) from a single device and process to non-RFC1918 IP addresses on ports commonly associated with Remote Access Trojans (RATs) or Command and Control (C2) communication. The ports monitored include 443, 8443, 8080, 80, 4444, 5555, 6666, and 7777. This pattern can indicate a compromised host attempting to establish C2 with an external adversary.
Detects generic application layer protocol abuse for C2 communications
This rule detects potential C2 beaconing activity over HTTP. It specifically looks for HTTP GET requests where the URI path consists of 8 to 16 lowercase alphanumeric characters. The rule uses a threshold of 20 such requests within 60 seconds from the same source IP address to identify beaconing behavior.
This rule detects processes making a high volume of successful network connections to GitHub's raw content (raw.github.com). This behavior can be indicative of an adversary downloading tools, scripts, or other malicious content from GitHub, potentially as part of a command and control (C2) channel or for staging purposes. The rule counts connections per hour per initiating process filename and flags if the count exceeds 5.
Detects outbound network connections initiated by 7-Zip processes. This could indicate compromise of the 7-Zip application, potentially through exploitation of vulnerabilities like CVE-2026-48095, leading to data exfiltration or command and control communication.
This rule detects unusual network beaconing activity from processes. It identifies processes that make more than 50 network connections within a 15-minute window to distinct remote IP addresses and ports, excluding common legitimate processes like svchost.exe, chrome.exe, msedge.exe, and explorer.exe. The rule then enriches this information with the last seen time of the process.
Detects the creation of a file on a server system by common network utilities (curl, ftp, powershell, winscp, certutil) within a 5-minute window of a network connection to common ports (21, 22, 80, 443). This could indicate ingress tool transfer or data exfiltration attempts.
This rule detects potential command and control (C2) beaconing activity by monitoring network events for specific URL patterns and user agent strings associated with known C2 frameworks like AzureVeil and Adaptix. It identifies beaconing if multiple devices communicate with the same remote IP address using these indicators within a 15-minute window, with more than 5 beacon counts and more than 1 distinct device.
This rule detects outbound network connections from devices to IP addresses identified as malicious by a threat intelligence feed. It joins device network events with threat intelligence indicators, specifically looking for successful connections or connection requests to IPs with a confidence score greater than 50. The alert provides details about the device, the remote IP, the initiating process, and the threat intelligence context.
This rule detects potential command and control (C2) communication over SMTP by looking for repeated 'EHLO' commands within a short timeframe from the same source IP address. The threshold is set to trigger if 10 'EHLO' commands are observed within 300 seconds (5 minutes) from a single source.
This rule detects potential command and control (C2) beaconing activity over HTTP. It specifically looks for HTTP POST requests with a content size between 50 and 300 bytes that occur at a regular interval (15 times in 60 seconds) from a single source IP address. This pattern is often indicative of malware communicating with a C2 server.
Detects network connections to typo-squatted lure domains, payload hosts, and C2 servers associated with the fake Gemini CLI and Claude Code campaign.
Detects DNS queries commonly associated with Local LLM (Large Language Model) frameworks or AI-related domains. This activity may indicate unauthorized AI usage or potential data exfiltration channels.
Detects network connections to known suspicious domains or IP addresses
This rule detects potential C2 beaconing behavior by identifying devices that make a high number of periodic outbound connections (20 or more within an hour) to a single external IP address on common web and C2-related ports (80, 443, 8080, 8443, 4444, 5555, 8888, 9001). The rule summarizes these connections by device, remote IP, and initiating process, highlighting sustained communication patterns indicative of command and control.
Detects network connections to known Command and Control (C2) servers associated with the ValleyRAT backdoor, used by the Silver Fox APT group.
Detects network connections to known CountLoader C2 domains based on McAfee Labs analysis. This rule identifies outbound network traffic from devices to a predefined list of Command and Control (C2) domains associated with the CountLoader malware. The detection logic specifically looks for the presence of these domains in the 'RemoteUrl' field of network events.
Sublime Threat Intelligence and Research (STIR) identified a phishing campaign using a recently published open-source Javascript virtual machine and obfuscation tool called KrakVM. The initial KrakVM-encoded HTML file arrives as an attachment in phishing emails. These emails are short, often not even including a body, with subjects and HTML attachment filenames suggesting the target has a new voicemail, a vendor credit, or unpaid invoices
This rule detects potential command and control (C2) communications over non-standard ports. It identifies devices that make a high number of network connections to distinct remote IP addresses on ports other than common ones (80, 443, 53, 22, 21, 25, 110, 143, 993, 995) and not to private IP ranges. The rule aggregates connection counts and distinct remote IPs over 15-minute intervals and flags activity where there are more than 30 connections and more than 2 distinct remote IPs.
This rule detects a potential privilege escalation attempt on Linux systems. It looks for two main indicators: first, the execution of the 'su' command from a user's home directory by a process whose executable was recently created in a user's home directory and identified as an ELF binary. Second, it identifies systems where public-facing network connections were made by processes using common remote file transfer utilities (curl, wget, lftp, axel, aria2, scp, rsync, ftp) to fetch code, followed by the execution of a process with 'algif-aead' in its command line, which could indicate fileless execution after remote code fetching. The combination suggests an attacker might be fetching malicious code, potentially compiling it, and then using it to escalate privileges via 'su' or executing it filelessly.
For network requests to the GitHub API containing specific staging and fallback markers (LongLiveTheResistanceAgainstMachines or beautifulcastle) used by TeamPCP in the Bitwarden CLI campaign to retrieve C2 instructions.
Page 48 of 60