Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
163
113
109
24
15
Contributors
109
73
61
49
26
Categories
167
139
127
91
71
Platforms
232
129
75
30
23
Products / Services
108
101
88
53
39
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
6
2
1
1
1
IDS Classtypes
60
46
5
1
1
IDS Protocols
43
30
21
7
6
Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page.
Connection Proxy
Sigma
Detects setting proxy configuration
Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule
Detects the modification of the PortProxy registry key which is used for port forwarding.
Detects the execution of the open-source Yuze tool via rundll32 to establish a reverse SOCKS5 proxy tunnel. The Warlock ransomware group has been observed using this lightweight C-based tunneling tool to maintain persistent C&C access across multiple ports.
This rule detects suspicious command-line activity indicative of SSH tunneling, external IP checks, and reconnaissance commands. It looks for specific IP addresses associated with known C2 or SSH tunnel infrastructure, SSH command-line options like 'StrictHostKeyChecking=no' and reverse tunnel flags ('-R', '-N'), the use of 'ifconfig.me' for external IP discovery, and various 'whoami' and 'groups' commands for system reconnaissance. It also flags activity related to 'FMAPP.exe' or 'FMAPP.dll'.
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google Residential Proxy Network Disruption. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: a DNS lookup to a specific domain mentioned in the report. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest- residential-proxy-network) to document where the indicator came from and to support incident notes and reporting.
This rule detects two related activities that could indicate the use of AI webchat services as a covert C2 proxy via WebView2. The first part identifies network connections to specific AI webchat domains (grok.com, copilot.microsoft.com) via proxy or web logs. The second part identifies the creation of the 'msedgewebview2.exe' process by unusual parent processes, excluding common browsers and Microsoft Office applications. This combination aims to catch scenarios where WebView2, often used by AI webchat applications, is leveraged for malicious command and control.
Detects the Microsoft Edge WebView2 process (msedgewebview2.exe) being spawned by suspicious parent processes that typically do not use embedded web content, such as PowerShell, CMD, or common lolbins. This activity is a key indicator of the 'AI-Proxy' technique where malware uses WebView2 to programmatically interact with AI web interfaces for C2.
This rule correlates multiple indicators of compromise (IOCs) across file, network, and process events to detect potential advanced persistent threats (APTs) or sophisticated malware. It looks for specific file paths associated with tools like Lightshot, ScreenConnect, or suspicious VS Code extensions, combined with network connections to known malicious domains/IPs or unusual ports, and the execution of suspicious processes like 'Code.exe' outside of its legitimate VS Code path or 'ScreenConnect' related executables. A high threat score is assigned if multiple types of these indicators are observed on the same device and account within a 30-day window.
Esta detección identifica posibles conexiones relacionadas con el uso de VPNs dentro del entorno corporativo, correlacionando puertos asociados a protocolos VPN, dominios no habituales, procesos iniciadores y adaptadores de red virtuales o tunelizados. El objetivo es descubrir actividad de VPN no autorizada, conexiones cifradas ocultas dentro de tráfico HTTPS y el uso de extensiones de navegador que actúan como túneles tipo VPN.
La lógica de esta consulta aplica múltiples capas de filtrado para reducir falsos positivos:
- Filtra conexiones salientes hacia puertos característicos de IPsec, OpenVPN, WireGuard, L2TP y PPTP.
- Detecta túneles sobre puerto 443 cuando el proceso iniciador no corresponde a aplicaciones del sistema.
- Excluye ruido generado por procesos de Windows y dominios legítimos asociados a Microsoft, Google y servicios cloud corporativos.
- Identifica adaptadores TAP, TUN, Wintun, WireGuard, Tailscale o ZeroTier presentes en el host.
- Clasifica el tipo probable de VPN según el puerto utilizado y el proceso que inicia la conexión.
Esta detección permite encontrar:
- Clientes VPN instalados sin autorización.
- Extensiones de navegador que establecen túneles SSL-VPN encubiertos.
- Herramientas de túneles encubiertos como WireGuard stealth, Tailscale o ZeroTier.
- Actividad anómala desde navegadores que podría indicar proxies cifrados o VPNs embebidas.
La lógica de esta consulta aplica múltiples capas de filtrado para reducir falsos positivos:
- Filtra conexiones salientes hacia puertos característicos de IPsec, OpenVPN, WireGuard, L2TP y PPTP.
- Detecta túneles sobre puerto 443 cuando el proceso iniciador no corresponde a aplicaciones del sistema.
- Excluye ruido generado por procesos de Windows y dominios legítimos asociados a Microsoft, Google y servicios cloud corporativos.
- Identifica adaptadores TAP, TUN, Wintun, WireGuard, Tailscale o ZeroTier presentes en el host.
- Clasifica el tipo probable de VPN según el puerto utilizado y el proceso que inicia la conexión.
Esta detección permite encontrar:
- Clientes VPN instalados sin autorización.
- Extensiones de navegador que establecen túneles SSL-VPN encubiertos.
- Herramientas de túneles encubiertos como WireGuard stealth, Tailscale o ZeroTier.
- Actividad anómala desde navegadores que podría indicar proxies cifrados o VPNs embebidas.
Detects the ZinFoq Go-based post-exploitation implant. This rule identifies the binary based on a unique, hardcoded timestamp string used for its timestomping anti-forensics feature, along with other specific C2 artifacts.
This rule detects Command and Control (C2) communication associated with the Mythic C2 framework utilizing Server Message Block (SMB) for peer-to-peer (P2P) beaconing. It specifically looks for SMB_COM_WRITE_ANDX commands with a data size greater than 360 bytes, containing a specific null byte pattern at offset 86, and a PCRE match for a GUID-like string, which are indicators of Mythic C2 SMB P2P beacon traffic.
Detects potential WARP PANDA Junction implant activity by identifying processes, other than the legitimate 'vvold' service, listening on TCP port 8090. The Junction implant uses this port to masquerade and receive commands.
The purpose of this query is to identify accounts that have logged in from multiple different countries within a short time window (last hour or last day).
This is typically used for security monitoring to detect suspicious or anomalous authentication behavior.
This is typically used for security monitoring to detect suspicious or anomalous authentication behavior.
This rule is a valid AWS Network Firewall configuration enforcing standard port/protocol usage for SSH traffic to maintain network hygiene and detect anomalies.
This rule enforces standard port/protocol alignment for TLS traffic to detect anomalies and maintain network hygiene using AWS Network Firewall. The rule is valid.
This rule enforces port/protocol alignment for HTTP traffic using AWS Network Firewall, blocking TCP port 80 traffic that is not HTTP and vice versa, to maintain network hygiene and detect anomalies. The rule is valid.
Detects common shell processes launching a reverse shell using the '/dev/tcp' redirection. This technique is known to be used by adversaries like the Clop ransomware group for persistence and command and control.
Detects the execution of the Ligolo-ng tunneling tool, which is used by the Silent Lynx APT group for command and control and network pivoting.
Detects the execution of legitimate tools (like sshd, tor, obfs4proxy) or their renamed counterparts from user-writable directories, specifically within AppData folders. This technique is associated with Operation SkyCloak to establish persistence and covert communication channels by masquerading as legitimate software.
Page 16 of 22