Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
163
113
109
24
15
Contributors
109
73
61
49
26
Categories
167
139
127
91
71
Platforms
232
129
75
30
23
Products / Services
108
101
88
53
39
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
6
2
1
1
1
IDS Classtypes
60
46
5
1
1
IDS Protocols
43
30
21
7
6
The following analytic detects modifications to the Windows registry key "ProxyEnable" to enable proxy settings. It leverages data from the Endpoint.Registry datamodel, specifically monitoring changes to the "Internet Settings\ProxyEnable" registry path. This activity is significant as it is commonly exploited by malware and adversaries to establish proxy communication, potentially connecting to malicious Command and Control (C2) servers. If confirmed malicious, this could allow attackers to redirect network traffic through a proxy, facilitating unauthorized communication and data exfiltration, thereby compromising the security of the affected host.
This analytic detects modifications to the Windows registry key responsible for setting up a proxy server. It specifically looks for changes to the "Internet Settings\\ProxyServer" registry path. Such modifications can indicate that malware or an adversary is configuring a proxy to establish unauthorized communication channels, potentially for Command and Control (C2) or data exfiltration. The rule leverages Sysmon EventID 13 data, which records registry value set operations.
Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky. The rule specifically looks for Qemu command-line arguments indicative of network tunneling or proxying, such as low memory allocation ('-m 1M', '-m 2M', '-m 3M'), network device configuration ('-netdev', 'connect='), and running without a graphical interface ('-nographic'), while filtering out common legitimate use cases like CD-ROM or virtual block device usage.
This YARA rule detects the Linux AutoColor backdoor by identifying specific byte patterns related to its core functionalities. These functionalities include installing library implants, self-deletion mechanisms, executing local files, and network proxy communication. The rule specifically targets ELF (Executable and Linkable Format) files, indicating it's designed for Linux executables.
Detects potentially suspicious execution of the Qemu utility in a Windows environment.
Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.
Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.
Amazon GuardDuty detects Tor Network activity in an AWS account.
Detects the execution of Fast Reverse Proxy (FRP) client or server binaries, or command-line arguments indicative of FRP configuration files. FRP is a legitimate tool that can be used by adversaries to establish command and control (C2) channels by exposing local services behind NAT or firewalls to the internet, effectively creating a proxy.
This rule detects the execution of the IOX tunneling tool, which is used for port forwarding and intranet proxy purposes. It specifically looks for the executable name 'iox.exe' and common command-line arguments associated with its forwarding and proxy functionalities, such as '.exe fwd -l', '.exe fwd -r', '.exe proxy -l', and '.exe proxy -r'. Additionally, it includes specific MD5, SHA1, and SHA256 hashes for version 0.4 of the tool to enhance detection accuracy.
Detects the execution of 'npc.exe', the client component of NPS (a port forwarding and intranet penetration proxy server). Detection is based on the executable name, specific command-line arguments indicative of server connection and authentication, or known hashes of the 'npc.exe' client.
Detects the use of NPS, a port forwarding and intranet penetration proxy server
Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.
Detects the use of IOX - a tool for port forwarding and intranet proxy purposes
Detects the execution of the "cloudflared" tool with command-line arguments indicative of establishing or running a tunnel. This activity has been observed in post-compromise scenarios by threat actors, such as the Akira ransomware group, to maintain persistence and remote access to compromised networks by creating covert communication channels.
This rule detects the execution of the 'cloudflared' binary when it has been renamed. It looks for specific command-line arguments associated with Cloudflare Tunnel operations ('tunnel cleanup', 'tunnel run', '-url tunnel') in conjunction with a list of known SHA256 hashes for legitimate cloudflared executables. The rule triggers if these conditions are met and the executable's name is NOT one of the known legitimate 'cloudflared.exe' names, indicating a potential attempt to disguise its execution.
Detects the execution of the "cloudflared" tool with the "tunnel cleanup" command. This command is used to remove Cloudflare Tunnel connections, which could be an indicator of an adversary attempting to remove traces of their C2 infrastructure or clean up after an operation. The rule looks for specific command-line arguments including 'tunnel', 'cleanup', and either '-config' or '-connector-id'.
Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.
Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.
Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule. This can be used by adversaries for lateral movement, defense evasion, or command and control.
This rule detects outbound network connections to ngrok tunneling service endpoints. Ngrok is a legitimate tool that can be used to expose local servers to the internet, but it is also frequently leveraged by malicious actors for data exfiltration, command and control, and bypassing network restrictions. Detection of communication to these specific ngrok domains could indicate unauthorized use of the service for malicious purposes.
Detects the execution of '3proxy.exe', a tiny free proxy server, based on its image name, description, or specific command-line parameters. This tool can be used by adversaries for command and control activities, specifically for proxying network traffic.
Detects the modification of the PortProxy registry key, which is used for port forwarding. This can indicate an adversary setting up a proxy for lateral movement or command and control.
Page 21 of 22