Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
117 detections
Filters
Last updated
All Time
Detection languages
40
39
17
6
6
Contributors
26
25
18
11
6
Categories
45
39
31
19
18
Platforms
49
42
16
11
5
Products / Services
39
36
17
11
10
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
29
8
2
1
IDS Protocols
17
14
7
1
Detects sign-ins from known UNC6671 residential-proxy IPs, ranked by rarity (first-seen for the user) and correlated with a following sensitive account action (MFA registration, mailbox rule change, admin role change).
Detects a single user account signing into OfficeHome from 3+ distinct proxy/anyIP-flagged IP addresses within a 15-minute window, consistent with AiTM session replay from rotating residential proxy infrastructure.
This rule detects outgoing TCP traffic to port 1082 that initiates or utilizes a SOCKS5 proxy connection, specifically identifying patterns associated with the Myxa VPN tool. The detection monitors for the specific SOCKS5 handshake byte and identifies known hardcoded IP addresses associated with this tool's proxy infrastructure.
Detects Outlook sign-ins that reuse the same SessionId roughly every 8 hours while source IP/ASN change, consistent with attackers replaying a stolen AiTM-captured session token through rotating residential proxy infrastructure.
Detects the Payroll Pirates (Storm-2755) AiTM phishing redirect chain: Google Meet/Ads redirector, an AWS S3 intermediate hop, and final resolution of a previously-unseen domain, indicating completion of the multi-hop chain to an AiTM proxy.
This rule identifies potential post-Adversary-in-the-Middle (AiTM) session hijacking by correlating suspicious initial authentication events (e.g., AiTM indicators, unusual behavioral flags) with subsequent successful sign-ins originating from known residential proxies or anonymization VPN providers within a 24-hour window.
Detects network connections to Bunny CDN infrastructure that contain common URL path indicators associated with phishing, a technique observed in activity attributed to UNC1151 (Ghostwriter).
This rule detects successful or failed logon attempts originating from IP addresses identified by threat intelligence as associated with botnets, command and control (C2) infrastructure, or proxies. The rule specifically looks for 'LogOn' or 'FailedLogOn' activity types where the source IP's threat intelligence indicator type is 'Botnet', 'C2', or 'Proxy', and where activity insights are available.
Detects anomalous lateral movement or network pivoting activity originating from an internet-facing Nginx server. The detection identifies an incoming HTTP POST request from an external IP address followed immediately by an outbound network connection from that same Nginx server to an internal RFC1918 host on the FastCGI port (9000). This behavior is consistent with the 'Velvet Ant' operation's technique of abusing proxy_pass configurations to relay traffic into isolated internal network segments via FastCGI request-chaining.
Detects potential SSH reverse tunneling or SOCKS proxying, often used by threat actors like Akira or associated with Bumblebee loaders, to establish persistent C2 channels. The rule monitors process execution of plink.exe and ssh.exe with suspicious arguments (e.g., -R, -D, -N), network connections to known malicious C2 IP addresses, and SSH tunnel processes running as SYSTEM or spawned by non-interactive service-related processes.
Detects use of external SOCKS proxy to relay C2 traffic
Detects Linux processes masquerading as common daemons (smbd, httpd, sshd, crond) that are executing from non-standard file paths and establishing network connections on non-canonical ports to private (RFC1918) IP addresses. This behavior is indicative of a SOCKS5 proxy or C2 infrastructure masquerading as system services to blend in with legitimate traffic, as observed in Velvet Ant operations.
This rule detects successful or failed logon attempts originating from IP addresses identified by threat intelligence as associated with botnets, command and control (C2) infrastructure, or proxies. The rule specifically looks for 'LogOn' or 'FailedLogOn' activity types where the source IP's threat intelligence indicator type is 'Botnet', 'C2', or 'Proxy', and where activity insights are available.
Detects the use of the HTTP CONNECT method on non-standard ports (8888, 9999, 4444). The CONNECT method is frequently used by HTTP proxies to establish TCP tunnels; unauthorized use of this method on uncommon ports is a common indicator of protocol tunneling used to bypass network egress filtering or for command and control (C2) communication.
Detects instances where the Squid proxy application is used to establish network connections over ports 21 (FTP) or 22 (SSH) to specific external IP ranges. This behavior may indicate an attacker using the internal proxy server to anonymize command-and-control (C2) traffic or perform unauthorized external reconnaissance.
Detects the use of living-off-the-land tools like plink.exe, netsh.exe, and ssh.exe to create tunnels that forward RDP traffic (port 3389). This behavior is often indicative of an adversary attempting to bypass network controls or hide RDP sessions by tunneling them through other protocols or non-standard port configurations.
This rule monitors process execution events for the presence of the Chisel network tunneling tool. It identifies Chisel by its executable names (e.g., chisel.exe, chisel_linux) and command-line arguments typical of a Chisel client or server configuration, including SOCKS proxy setups and known indicator ports.
Detects the use of living-off-the-land tools like plink.exe, netsh.exe, and ssh.exe to create tunnels that forward RDP traffic (port 3389). This behavior is often indicative of an adversary attempting to bypass network controls or hide RDP sessions by tunneling them through other protocols or non-standard port configurations.
This rule detects successful OAuth logins originating from IP addresses identified as residential proxies. This behavior can indicate an adversary attempting to bypass geo-restrictions or obscure their true location, potentially as part of a credential stuffing attack, account takeover, or to evade detection.
Detects a user who interacted with a code-of-conduct lure subsequently authenticating through an anonymous proxy or anonymisation service. This rule correlates URL click events or sign-in events with subjects related to 'code of conduct' or 'policy acknowledgement' and then checks if the subsequent authentication occurred via an anonymous proxy.
This rule detects successful OAuth sign-ins originating from a residential proxy IP address, correlated with a successful identity logon event for the same user. This pattern can indicate an adversary using residential proxies to bypass geo-restrictions or blend in with legitimate user traffic while attempting to access accounts via OAuth.
Page 3 of 6