Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
106 detections
Filters
Last updated
All Time
Detection languages
47
23
20
7
3
Contributors
20
20
19
13
6
Categories
55
45
28
20
13
Platforms
54
35
22
6
2
Products / Services
48
47
22
15
5
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
20
13
8
6
IDS Protocols
29
15
1
This detection identifies outbound IPv4 and IPv6 network connections to non-standard ports that may indicate suspicious network activity, unauthorized communication, or potential command-and-control (C2) traffic.
It excludes commonly used ports for DNS (53), HTTP (80), HTTPS (443), and alternate web services (8000, 8080), along with private, loopback, link-local, multicast, and documentation-only IP ranges to reduce noise.
It excludes commonly used ports for DNS (53), HTTP (80), HTTPS (443), and alternate web services (8000, 8080), along with private, loopback, link-local, multicast, and documentation-only IP ranges to reduce noise.
The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes.
It leverages the Network_Traffic data model to detect large ICMP packet that aren't blocked and are directed toward external networks. We use All_Traffic.bytes in the detection to capture variations in inbound versus outbound traffic sizes, as significant discrepancies or unusually large ICMP exchanges can indicate information smuggling, covert communication, or command-and-control (C2) activities.
If validated as malicious, this could signal ICMP tunneling, unauthorized data transfer, or compromised endpoints requiring immediate investigation.
It leverages the Network_Traffic data model to detect large ICMP packet that aren't blocked and are directed toward external networks. We use All_Traffic.bytes in the detection to capture variations in inbound versus outbound traffic sizes, as significant discrepancies or unusually large ICMP exchanges can indicate information smuggling, covert communication, or command-and-control (C2) activities.
If validated as malicious, this could signal ICMP tunneling, unauthorized data transfer, or compromised endpoints requiring immediate investigation.
Detects outbound TCP traffic on port 443 destined for a hardcoded IP address associated with ValleyRAT C2 activity. The rule specifically monitors for established connections with a small payload size (5 bytes) that lack standard TLS handshake characteristics (no SNI), and applies a threshold to mitigate noise. This behavior is indicative of C2 heartbeats from malicious implants using DLL side-loading techniques.
Detects outbound connections to a known malicious C2 infrastructure associated with the CARBONATO threat actor. The rule identifies both established SSH sessions using the OpenSSH implementation and the initiation of outbound TCP connections on ports dynamically determined by an MD5 hash, which is a known behavior of this actor's C2 communication strategy.
Detects network communication associated with VelvetCake C2 infrastructure, including plaintext authentication, specific inventory request commands, and session termination commands over port 12345.
Detects outbound TCP traffic originating from the internal network destined for a known RMRLX RAT command and control (C2) server on port 4561. This signature identifies the client-side 'hello' beaconing behavior characteristic of this specific malware.
Detects network activity associated with the GHAPPIER implant beaconing to a hardcoded command and control (C2) server. The rule monitors for established TCP connections on port 15152 that contain specific JSON status indicators and the string 'ghappier' in the payload, which are characteristic of this malware's communication protocol.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
Detects outbound network activity associated with the ChainScript malware family, including WebSocket C2 communication identified by a specific 'X-Agent-Token' header and TLS connections to known rotating command-and-control domains.
This rule detects a raw TCP authentication handshake associated with the VelvetCake malware family. It specifically monitors for established connections to a known malicious C2 IP address (111.92.246.145) over port 12345 containing the specific hardcoded 'PASSWORD' string used for initial communication.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
This rule monitors network traffic to detect a specific 'Client Hello' beaconing behavior associated with the RMRLX Remote Access Trojan (RAT), identifying potential command-and-control communication directed at a known malicious IP address over TCP port 4561.
This rule monitors for outbound TCP traffic from internal hosts to a specific IP address (212.34.141.103) on port 4521, which is associated with C2 beaconing behavior, potentially involving the abuse of MSBuild.exe as a LOLBin.
Detects a specific raw TCP handshake sequence used by the VelvetCake downloader malware to authenticate with its Command and Control (C2) server. The rule monitors for a 'PASSWORD ' string followed by a 'GET qqq' command in the initiation of an established outbound TCP connection.
This rule monitors network traffic to detect a specific 'Client Hello' beaconing behavior associated with the RMRLX Remote Access Trojan (RAT), identifying potential command-and-control communication directed at a known malicious IP address over TCP port 4561.
Detects established outbound TCP connections to a known AsyncRAT C2 IP address on port 4944. This rule identifies infected internal hosts communicating with a malicious server typically used for remote access and control.
Detects established raw-TCP C2 communication sessions associated with the GapiUpdate Go-based RAT, identifying both known malicious infrastructure and behavioral anomalies characteristic of long-lived, encrypted C2 persistence.
Detects established raw-TCP C2 communication sessions associated with the GapiUpdate Go-based RAT, identifying both known malicious infrastructure and behavioral anomalies characteristic of long-lived, encrypted C2 persistence.
Detects network communication to known malicious infrastructure associated with the SparroWocky malware, often used by the FamousSparrow threat actor. The rule monitors for established TCP or TLS-encrypted connections on ports 443 and 8080 directed toward specific IP addresses identified as part of the C2 infrastructure.
Page 1 of 6