Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
117 detections
Filters
Last updated
All Time
Detection languages
40
39
17
6
6
Contributors
26
25
18
11
6
Categories
45
39
31
19
18
Platforms
49
42
16
11
5
Products / Services
39
36
17
11
10
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
29
8
2
1
IDS Protocols
17
14
7
1
This rule detects attempts to proxy web pages through the HTTPPROXY service on an OpenCanary honeypot. This indicates that an attacker or automated tool has interacted with the honeypot's HTTP proxy, potentially attempting to use it for further malicious activity or reconnaissance.
The analytic detects the use of the `curl` command with proxy-related arguments such as `-x`, `socks`, `--preproxy`, and `--proxy`. This activity is significant as it may indicate an adversary attempting to use a proxy to evade network monitoring and obscure their actions. If confirmed malicious, this behavior could allow attackers to bypass security controls, making it difficult to track their activities and potentially leading to unauthorized data access or exfiltration.
Detects network communication initiated to the 'portmap.io' domain. This domain is often associated with port forwarding services that can be abused by malicious actors for command and control (C2) communication or data exfiltration, potentially masking the true destination of the traffic.
This YARA rule detects the Linux AutoColor backdoor by identifying specific byte patterns related to its core functionalities. These functionalities include installing library implants, self-deletion mechanisms, executing local files, and network proxy communication. The rule specifically targets ELF (Executable and Linkable Format) files, indicating it's designed for Linux executables.
Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors
Detects the execution of Fast Reverse Proxy (FRP) client or server binaries, or command-line arguments indicative of FRP configuration files. FRP is a legitimate tool that can be used by adversaries to establish command and control (C2) channels by exposing local services behind NAT or firewalls to the internet, effectively creating a proxy.
This rule detects the execution of the IOX tunneling tool, which is used for port forwarding and intranet proxy purposes. It specifically looks for the executable name 'iox.exe' and common command-line arguments associated with its forwarding and proxy functionalities, such as '.exe fwd -l', '.exe fwd -r', '.exe proxy -l', and '.exe proxy -r'. Additionally, it includes specific MD5, SHA1, and SHA256 hashes for version 0.4 of the tool to enhance detection accuracy.
Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule. This can be used by adversaries for lateral movement, defense evasion, or command and control.
Detects when Microsoft Cloud App Security reports user activity originating from an IP address identified as an anonymous proxy. This indicates potential attempts to obscure the true source of network connections, which could be used for malicious purposes such as bypassing security controls or maintaining anonymity during an attack.
Detects the execution of 'curl.exe' with command-line flags that disable security checks for proxy or DNS over HTTPS (DoH) connections. This behavior can indicate an attempt to bypass security controls or establish covert communication channels.
This rule detects sign-in attempts originating from IP addresses identified as malicious by Azure AD Identity Protection, specifically when these attempts are characterized by a high failure rate. This indicates potential brute-force attacks, credential stuffing, or other unauthorized access attempts from known bad IP addresses.
Detects the execution of Htran or Htran-like tools such as NATBypass, identified by specific executable names or command-line arguments. These tools are commonly used for proxying network connections to obscure the origin of malicious traffic.
Page 6 of 6