Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
4
3
2
1
1
Contributors
3
3
2
1
1
Categories
10
3
2
2
1
Platforms
8
3
1
Products / Services
4
2
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
3
1
IDS Protocols
4
This rule detects the presence of the Amatera (ACR Stealer) loader by identifying characteristic indicators, including specific Telegra.ph dead-drop URLs, domain-fronting artifacts using github.com, and hardcoded C2 IP addresses. It also identifies credential theft targeting by searching for artifacts related to password managers such as KeePass, Bitwarden, WinAuth, and Authy, combined with the presence of C2 communication indicators.
Detects domain fronting abuse of Cloudflare CDN where the TLS SNI (outer front domain) differs from the inner HTTP Host header actually requested, a technique used to smuggle C2 traffic behind a trusted Cloudflare-fronted domain
Detects HTTP and DNS requests directed towards the .workers.dev domain, which are commonly leveraged by threat actors for command and control (C2) redirection and domain fronting. This activity is frequently associated with the Gamaredon (Shuckworm/ACTINIUM) threat group's infrastructure.
Detects domain fronting technique to hide C2 behind CDN providers
Detects domain fronting technique to hide C2 behind CDN providers
This rule detects potential domain fronting by identifying a mismatch between the Server Name Indication (SNI) field in the TLS handshake and the Host header, specifically when the SNI field contains domains commonly used for content delivery networks (CDNs) like cloudfront.net, azureedge.net, or fastly.net. This technique can be used to obfuscate the true destination of network traffic, often for malicious purposes such as bypassing censorship or exfiltrating data.
ET INFO Observed Observed Commonly Actor Abused Online Service Domain (getenjoyment .net in TLS SNI)
ET MALWARE Observed Malicious Domain (significant-adopted-bearing-own .trycloudflare .com in TLS SNI)
ET MALWARE Observed Malicious Domain (tamku .shoplerter .opnetorologies .net in TLS SNI)
Detects outbound network connections to Azure Front Door (azurefd.net) that are not initiated by common web browsers or known benign applications/services. This rule aims to identify potentially suspicious use of Azure Front Door for command and control (C2) or other malicious activities, as adversaries can leverage this legitimate service for obfuscation, such as domain fronting.
KQL Query from file: Check for Azure Outdated Security Protocols
Detects connections with Azure Front Door (known legitimate service that can be leveraged for C2)
that fall outside of known benign behavioral baseline (not using common apps or common azurefd.net endpoints)
that fall outside of known benign behavioral baseline (not using common apps or common azurefd.net endpoints)
