Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
117 detections
Filters
Last updated
All Time
Detection languages
40
39
17
6
6
Contributors
26
25
18
11
6
Categories
45
39
31
19
18
Platforms
49
42
16
11
5
Products / Services
39
36
17
11
10
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
29
8
2
1
IDS Protocols
17
14
7
1
This rule set detects multi-stage network patterns indicative of AiTM phishing campaigns. It identifies common redirection techniques, including lookalike domains hosting Microsoft OAuth authorize URLs, DNS resolution of Google ad-tech infrastructure followed by novel domains, malicious use of Google Meet and Google Ads click-tracking endpoints as phishing hops, and references to AWS S3-hosted intermediate landing pages.
Detects anomalous sign-in activity where a single Microsoft 365 or Entra ID user account successfully authenticates from multiple distinct residential or mobile-carrier ASNs within a 24-hour window. This behavior is highly indicative of an adversary replaying stolen session tokens (AiTM) through rotating residential proxy networks to blend into legitimate user traffic and circumvent location-based or datacenter IP-based access restrictions.
Detects network traffic associated with the SloppyRAT backdoor, which utilizes a reverse SOCKS proxy mechanism. The rule identifies specific HTTP GET/POST heartbeats and command responses to the '/api/poll' and '/api/proxy/ack' endpoints commonly used for C2 operations.
Detection rules designed to identify various stages of an Adversary-in-the-Middle (AiTM) phishing campaign, including malicious redirect chains (e.g., Google Meet/Ads redirects, AWS S3-hosted assets) and common lure patterns in SMTP traffic referencing voicemail portals.
Detection of suspicious DNS queries associated with Adversary-in-the-Middle (AiTM) phishing infrastructure. The rules monitor for suspicious subdomains and TLD patterns targeting Microsoft login services, as well as behavioral sequences involving initial Google Ads traffic redirection followed by rapid lookups of suspected malicious or newly registered domains and external geolocation services.
Detects network traffic associated with the SparroWocky/FamousSparrow C2 framework, including HTTP CONNECT proxy tunneling, SOCKS5 handshakes, and established TLS sessions to known malicious infrastructure.
This rule detects outbound TLS connections from server-role assets to 'devtunnels.ms', a service that facilitates temporary public tunnels to internal services. This behavior is flagged as a potential indicator of unauthorized command-and-control (C2) tunneling, particularly when originating from critical infrastructure like Domain Controllers or Exchange OWA servers.
Detects network traffic associated with the GhostCode phishing kit, specifically identifying API requests to a harvester service and subsequent responses indicating the activation of FlashProxy residential proxy services. These indicators suggest an attacker is leveraging proxy infrastructure to manage command-and-control communications and mask the source of malicious activity.
This rule detects potentially malicious use of residential proxies by monitoring for outbound HTTP CONNECT requests originating from consumer devices in the internal network. The use of HTTP CONNECT is a common method for establishing tunnels through proxies to mask C2 communication or facilitate unauthorized access, often associated with botnets or malicious proxy networks.
This rule detects potentially malicious use of residential proxies by monitoring for outbound HTTP CONNECT requests originating from consumer devices in the internal network. The use of HTTP CONNECT is a common method for establishing tunnels through proxies to mask C2 communication or facilitate unauthorized access, often associated with botnets or malicious proxy networks.
This rule detects outbound TLS connections from server-role assets to 'devtunnels.ms', a service that facilitates temporary public tunnels to internal services. This behavior is flagged as a potential indicator of unauthorized command-and-control (C2) tunneling, particularly when originating from critical infrastructure like Domain Controllers or Exchange OWA servers.
This rule detects outbound TLS connections from server-role assets to 'devtunnels.ms', a service that facilitates temporary public tunnels to internal services. This behavior is flagged as a potential indicator of unauthorized command-and-control (C2) tunneling, particularly when originating from critical infrastructure like Domain Controllers or Exchange OWA servers.
This rule detects outbound TLS connections from server-role assets to 'devtunnels.ms', a service that facilitates temporary public tunnels to internal services. This behavior is flagged as a potential indicator of unauthorized command-and-control (C2) tunneling, particularly when originating from critical infrastructure like Domain Controllers or Exchange OWA servers.
Detects anomalous HTTP CONNECT proxy handshake requests and responses associated with Tengu malware. The rule monitors for 'HTTP/1.1 200 Connection Established' and 'HTTP/1.1 407 Proxy Auth Required' responses initiated from internal hosts, as well as outgoing HTTP CONNECT requests containing a 'Proxy-Authorization' header that match established Tengu bot proxy patterns.
Detects the execution of Python scripts explicitly named 'socks5.py'. This is a common pattern used by adversaries to establish proxying capabilities for command and control or to tunnel traffic through a compromised host.
Detects HTTP response body content indicating the activation of a FlashProxy residential proxy by the GhostCode C2 harvester, based on geoip API responses.
This rule detects potentially malicious use of residential proxies by monitoring for outbound HTTP CONNECT requests originating from consumer devices in the internal network. The use of HTTP CONNECT is a common method for establishing tunnels through proxies to mask C2 communication or facilitate unauthorized access, often associated with botnets or malicious proxy networks.
This rule detects potentially malicious use of residential proxies by monitoring for outbound HTTP CONNECT requests originating from consumer devices in the internal network. The use of HTTP CONNECT is a common method for establishing tunnels through proxies to mask C2 communication or facilitate unauthorized access, often associated with botnets or malicious proxy networks.
Detects network requests originating from the Netch gateway tool or similar environments, attempting to fetch auto-configuration profiles for Shadowsocks from the external domain 'www.sheng886.top' using the '/api/v1/internal/shadowsocks/auto-config' endpoint. The rule specifically matches the Go-http-client user agent, which is common in automated scripts and Go-based proxy tools.
Detects network requests originating from the Netch gateway tool or similar environments, attempting to fetch auto-configuration profiles for Shadowsocks from the external domain 'www.sheng886.top' using the '/api/v1/internal/shadowsocks/auto-config' endpoint. The rule specifically matches the Go-http-client user agent, which is common in automated scripts and Go-based proxy tools.
Detects network requests originating from the Netch gateway tool or similar environments, attempting to fetch auto-configuration profiles for Shadowsocks from the external domain 'www.sheng886.top' using the '/api/v1/internal/shadowsocks/auto-config' endpoint. The rule specifically matches the Go-http-client user agent, which is common in automated scripts and Go-based proxy tools.
Page 2 of 6