Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
84 detections
Filters
Last updated
All Time
Detection languages
36
24
10
8
2
Contributors
15
14
11
9
7
Categories
40
22
21
11
7
Platforms
58
13
12
5
4
Products / Services
19
16
9
9
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
8
1
1
IDS Protocols
6
2
1
Detects the sequence where a private key file is written to the host followed by the execution of ssh.exe with parameters indicating a reverse port forwarding tunnel (-R), an identity file (-i), and background execution (-N or -f) within a 30-minute window.
Detects the execution of tooling routed through a reverse SOCKS5 pivot via wrappers such as via_socks.sh, proxychains4 with a SOCKS5 configuration, or LD_PRELOAD injection of libproxychains.so.
The following analytic identifies the use of netsh.exe to configure a connection proxy, which can be leveraged for persistence by executing a helper DLL. It detects this activity by analyzing process creation events from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving "portproxy" and "v4tov4" parameters. This activity is significant because it indicates potential unauthorized network configuration changes, which could be used to maintain persistence or redirect network traffic. If confirmed malicious, this could allow an attacker to maintain covert access or manipulate network communications, posing a significant security risk.
The following analytic detects the modification of registry keys related to the Windows Proxy settings via netsh.exe. It leverages data from the Endpoint.Registry data model, focusing on changes to the registry path "*\\System\\CurrentControlSet\\Services\\PortProxy\\v4tov4\\tcp*". This activity is significant because netsh.exe can be used to establish a persistent proxy, potentially allowing an attacker to execute a helper DLL whenever netsh.exe runs. If confirmed malicious, this could enable the attacker to maintain persistence, manipulate network configurations, and potentially exfiltrate data or further compromise the system.
Detects the execution of Python-based tunneling tools located in the 'C:\Users\Public\indigo\' directory, which is a known staging location for malicious implants used in covert tunneling operations.
Detects usage of ntdsutil.exe with arguments designed to dump the Active Directory database (NTDS.dit) and the use of netsh.exe for establishing covert port forwarding. These are known 'Living-off-the-Land' (LotL) techniques observed in campaigns attributed to the threat actor Volt Typhoon.
Detects SMB traffic targeting the IPC$ share within the internal network, which is a common behavior of PIVOTPIPE lateral movement techniques using SMB named pipes for peer-to-peer (P2P) beacon communication.
Detects communication patterns associated with the OnyxC2 malware, including host-fingerprint synchronization over HTTP, potential reverse SOCKS5 proxy tunnel initialization, and inbound HTTP responses containing command tasking such as cmd.exe.
Detects internal SMB traffic indicative of P2P beaconing using the IPC$ named pipe, which is often a sign of lateral movement or command-and-control communication between compromised hosts.
Detects unusual network connections over port 445 involving SMB named pipes commonly associated with lateral movement tools or P2P beaconing. The rule identifies communication through suspicious or generic pipe naming conventions that deviate from standard system process behavior (e.g., lsass, services, svchost, System).
Detects network traffic containing a specific 4-byte sequence ('13 12 11 09') identified as the initial handshake packet for the SparroWocky malware's reverse port-mapping server component.
Detects network activity associated with the SloppyRAT malware, specifically tracking the polling mechanism for reverse SOCKS proxy tasks and subsequent acknowledgment of these tasks via HTTP requests.
Detects network traffic within the internal network that matches the initial handshake phase of a SOCKS proxy connection. This is a common indicator of an attacker using an internal system to proxy command and control (C2) traffic or pivot within the network using tools like HTRAN, ZXProxy, or custom implementations.
Detects anomalous pythonw.exe execution from non-standard installation paths that exhibits a fan-out pattern of network connections to multiple sensitive internal administrative ports (445, 3389, 5985, 22, 1433, 135, 389). This behavior is characteristic of lateral movement using a SOCKS5 proxy tunnel, such as the activity observed in the TWINLOOT campaign where implants pivot through reverse tunnels to access internal resources.
JadeProx proxy/tunnel binary retrieval from Alibaba OSS bucket dlrz-web with known binary naming pattern
Detects an attacker-controlled SOCKS5 proxy masquerading as the Samba daemon (smbd) by renaming the process to 'smbd' and executing it with the '-D' flag from non-standard filesystem locations such as /tmp, /home, /var/tmp, or /dev/shm. This behavior is associated with the Velvet Ant threat group, which uses this technique to maintain persistent command-and-control communication while evading detection by blending in with legitimate system processes.
This rule detects successful or failed logon attempts originating from IP addresses identified by threat intelligence as associated with botnets, command and control (C2) infrastructure, or proxies. The rule specifically looks for 'LogOn' or 'FailedLogOn' activity types where the source IP's threat intelligence indicator type is 'Botnet', 'C2', or 'Proxy', and where activity insights are available.
Detects the execution of GS-Netcat or GSSocket, known tools used by the Velvet Ant threat group to establish encrypted C2 tunnels and SOCKS proxies on Linux systems. The rule identifies suspicious command-line patterns, including secret keys (-s), listener configurations (-l -p), and shell redirection (-e), particularly when executed from volatile directories like /tmp/ or /dev/shm/.
This rule detects successful or failed logon attempts originating from IP addresses identified by threat intelligence as associated with botnets, command and control (C2) infrastructure, or proxies. The rule specifically looks for 'LogOn' or 'FailedLogOn' activity types where the source IP's threat intelligence indicator type is 'Botnet', 'C2', or 'Proxy', and where activity insights are available.
Detects the use of the 'netsh interface portproxy' command to set up a port forwarding rule where the connection address is outside of common private IP ranges. This behavior is frequently associated with attackers establishing persistent network pivots or internal proxies to redirect C2 traffic.
Detects the execution of Perl-based SOCKS proxy tunneling activity on Linux systems, as observed in Velvet Ant operations. The rule identifies Perl processes that contain socket/fork/daemonization indicators when spawned by web server processes like Nginx, Apache, or common shells used in CGI contexts, suggesting the exploitation of a web application to establish an internal network pivot.
Page 1 of 4