Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
117 detections
Filters
Last updated
All Time
Detection languages
40
39
17
6
6
Contributors
26
25
18
11
6
Categories
45
39
31
19
18
Platforms
49
42
16
11
5
Products / Services
39
36
17
11
10
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
29
8
2
1
IDS Protocols
17
14
7
1
This rule detects an unusually high volume of network connections to common proxy ports (3128, 8080, 80, 443) initiated by critical system processes such as 'services.exe', 'svchost.exe', or 'rundll32.exe'. This behavior can indicate the installation and use of a trojan proxy or other malicious software attempting to exfiltrate data or establish command and control through a proxy.
Detects the use of the HTTP CONNECT method on non-standard ports (8888, 9999, 4444). The CONNECT method is frequently used by HTTP proxies to establish TCP tunnels; unauthorized use of this method on uncommon ports is a common indicator of protocol tunneling used to bypass network egress filtering or for command and control (C2) communication.
This rule detects suspicious network connections to known infrastructure associated with the 'Borrowed Trust' gambling kit. It identifies connections to specific IP addresses, IP ranges, compromised subdomains, URLs containing affiliate referrer codes, known redirect destinations, and a unique favicon path. The rule specifically excludes connections originating from common browser processes to focus on non-browser initiated activity, which could indicate malware or other malicious software attempting to establish C2 or exfiltrate data.
Detects the execution of the Squid proxy application with command line arguments that may indicate its use for malicious proxying or tunneling activities. This includes arguments related to safe ports, connection types (CONNECT, PORT, PASV), specific port numbers (21), and outgoing address configurations.
Detects a custom frp process enabling both reverse proxy and SOCKS5 functionality from an endpoint not approved as a proxy server. This rule specifically looks for process creation events where the executable name matches common frp variants (wormfrp, frpc, ssh) and the command line arguments indicate the setup of a reverse proxy, SOCKS5 tunnel, or related server connection parameters.
Detects network connections to Bunny CDN infrastructure that contain common URL path indicators associated with phishing, a technique observed in activity attributed to UNC1151 (Ghostwriter).
Detects when RegAsm.exe initiates outbound HTTPS connections to domains associated with Telegram or Cloudflare. This behavior is indicative of malware like Vidar using RegAsm.exe for network communication, potentially for command and control or data exfiltration, leveraging legitimate services as proxies.
Detects instances where the Squid proxy application is used to establish network connections over ports 21 (FTP) or 22 (SSH) to specific external IP ranges. This behavior may indicate an attacker using the internal proxy server to anonymize command-and-control (C2) traffic or perform unauthorized external reconnaissance.
Identifies GhostSocks executing with command line parameters specifically pointing to remote relay nodes, obfuscating the final exfiltration destination.
Detects patterns indicative of double extortion ransomware attacks, specifically the staging of large volumes of archived data followed by suspicious command and control (C2) communications. The rule identifies the creation, modification, or movement of multiple large archive files (RAR, 7z, ZIP, TAR, GZ, CAB) in common temporary or system directories, and correlates this activity with outbound network connections to known C2 indicators such as Tor/I2P/VPN/proxy services or non-RFC1918 IP addresses.
Detects a proxy process constructing forwarder-client identifiers and asynchronous queues for bidirectional web socket tunnelling, indicative of WormSocket or similar malware activity.
Detects a custom proxy process listening for forwarding instructions and creating a second outbound connection to a supplied host and service. This rule specifically looks for network events where the process image name contains 'chainworm', 'svc', or 'proxy' (case-insensitive) and the command line arguments indicate forwarding or connection establishment activities like 'forward', 'next hop', 'bind', 'listen', 'reconnect', or 'TcpClient'.
Detects patterns indicative of double extortion ransomware attacks, specifically the staging of large volumes of archived data followed by suspicious command and control (C2) communications. The rule identifies the creation, modification, or movement of multiple large archive files (RAR, 7z, ZIP, TAR, GZ, CAB) in common temporary or system directories, and correlates this activity with outbound network connections to known C2 indicators such as Tor/I2P/VPN/proxy services or non-RFC1918 IP addresses.
Detects the execution of the Chisel client establishing a reverse SOCKS tunnel with authentication. This activity is often associated with adversaries using Chisel for command and control or data exfiltration.
Detects Python executing a compiled Python file (.pyc) with PySoxy SSL arguments, indicating potential SOCKS proxy activity over SSL.
Detects the execution of Python with the '-remote_port' command-line argument, which is indicative of a SOCKS proxy tunnel being established, potentially by PySoxy or similar tools.
Detects network callbacks from hardware implants like O.MG Cable or USB Rubber Ducky
Detects unusual network communication from runtime processes mapped to Interlock/Rhysida backdoors on specific documented proxy C2 ports (1080, 4043, 8080). The rule specifically targets 'node.exe', 'java.exe', and 'javaw.exe' processes initiating these connections.
Detects Python executing a proxy tunnel via the '-remote_ip' argument, which is indicative of PySoxy usage for SOCKS proxying. This activity can be used by adversaries for command and control or data exfiltration.
This rule detects the use of a SOCKS proxy as an external Command and Control (C2) relay. Specifically, it looks for TCP traffic on port 1080 (a common SOCKS proxy port) from the home network to any destination, and checks for the SOCKS version 5 handshake initiation sequence (05 01 00) at the beginning of the payload. This pattern indicates a client attempting to establish a SOCKSv5 connection, which can be used by malware for C2 communication to evade detection and bypass network restrictions.
This rule detects an unusually high volume of network connections to common proxy ports (3128, 8080, 80, 443) initiated by critical system processes such as 'services.exe', 'svchost.exe', or 'rundll32.exe'. This behavior can indicate the installation and use of a trojan proxy or other malicious software attempting to exfiltrate data or establish command and control through a proxy.
Page 4 of 6