Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
106 detections
Filters
Last updated
All Time
Detection languages
47
23
20
7
3
Contributors
20
20
19
13
6
Categories
55
45
28
20
13
Platforms
54
35
22
6
2
Products / Services
48
47
22
15
5
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
20
13
8
6
IDS Protocols
29
15
1
Detects outbound network connections (both TCP and TLS) from internal hosts to known command-and-control (C2) infrastructure associated with the SparroWocky malware family. This rule monitors for established connections to a curated list of malicious IP addresses over ports 443 and 8080.
Detects network traffic on TCP port 3308 consistent with VectraRAT beaconing, utilizing MessagePack-over-TCP. The rule monitors for established connections to external networks with specific stream size and content characteristics typical of this C2 communication channel.
Detects network traffic on TCP port 3308 consistent with VectraRAT beaconing, utilizing MessagePack-over-TCP. The rule monitors for established connections to external networks with specific stream size and content characteristics typical of this C2 communication channel.
Detects network traffic on TCP port 3308 consistent with VectraRAT beaconing, utilizing MessagePack-over-TCP. The rule monitors for established connections to external networks with specific stream size and content characteristics typical of this C2 communication channel.
Detects network traffic on TCP port 3308 consistent with VectraRAT beaconing, utilizing MessagePack-over-TCP. The rule monitors for established connections to external networks with specific stream size and content characteristics typical of this C2 communication channel.
Detects the ESET Management Agent (ERAAgent.exe) initiating outbound network connections using non-standard socket families, specifically AF_VSOCK (virtual socket) or VMCI (Virtual Machine Communication Interface). These interfaces are typically used for inter-process communication between a host and a guest virtual machine, or between guest virtual machines, and may indicate malicious activity such as lateral movement from a virtualized environment, virtual machine escape attempts, or unauthorized communication within an ESXi host environment.
Detects established raw-TCP C2 communication sessions associated with the GapiUpdate Go-based RAT, identifying both known malicious infrastructure and behavioral anomalies characteristic of long-lived, encrypted C2 persistence.
Detects established raw-TCP C2 communication sessions associated with the GapiUpdate Go-based RAT, identifying both known malicious infrastructure and behavioral anomalies characteristic of long-lived, encrypted C2 persistence.
Detects the ESET Management Agent (ERAAgent.exe) initiating outbound network connections using non-standard socket families, specifically AF_VSOCK (virtual socket) or VMCI (Virtual Machine Communication Interface). These interfaces are typically used for inter-process communication between a host and a guest virtual machine, or between guest virtual machines, and may indicate malicious activity such as lateral movement from a virtualized environment, virtual machine escape attempts, or unauthorized communication within an ESXi host environment.
Detects the ESET Management Agent (ERAAgent.exe) initiating outbound network connections using non-standard socket families, specifically AF_VSOCK (virtual socket) or VMCI (Virtual Machine Communication Interface). These interfaces are typically used for inter-process communication between a host and a guest virtual machine, or between guest virtual machines, and may indicate malicious activity such as lateral movement from a virtualized environment, virtual machine escape attempts, or unauthorized communication within an ESXi host environment.
Detects incoming TCP and UDP traffic containing the 'sxcdewqaz!@#' magic string. This pattern is characteristic of a packet-triggered backdoor (often referred to as 'Fire Ant'), which uses custom packet payloads to activate malicious functionality on a listening host.
Detects network-based command signaling shared by the Fire Ant/REPTILE-derivative backdoor and its reverse-tunneling implant capability. Identifies the 'magic string' activation sequence and matching 'kill marker' termination sequence over TCP and UDP — indicative of packet-triggered backdoor activation, port-knocking style C2, or reverse-tunnel establishment via raw socket communication.
Detects outbound network connections to known command-and-control infrastructure associated with the Aeza Group bulletproof hosting provider. The rule monitors for connections to specific malicious IP addresses, traffic on TCP port 8133, and requests to the domain 'profitnow.io'.
Detects the ESET Management Agent (ERAAgent.exe) initiating outbound network connections using non-standard socket families, specifically AF_VSOCK (virtual socket) or VMCI (Virtual Machine Communication Interface). These interfaces are typically used for inter-process communication between a host and a guest virtual machine, or between guest virtual machines, and may indicate malicious activity such as lateral movement from a virtualized environment, virtual machine escape attempts, or unauthorized communication within an ESXi host environment.
Detects the ESET Management Agent (ERAAgent.exe) initiating outbound network connections using non-standard socket families, specifically AF_VSOCK (virtual socket) or VMCI (Virtual Machine Communication Interface). These interfaces are typically used for inter-process communication between a host and a guest virtual machine, or between guest virtual machines, and may indicate malicious activity such as lateral movement from a virtualized environment, virtual machine escape attempts, or unauthorized communication within an ESXi host environment.
Detects the ESET Management Agent (ERAAgent.exe) initiating outbound network connections using non-standard socket families, specifically AF_VSOCK (virtual socket) or VMCI (Virtual Machine Communication Interface). These interfaces are typically used for inter-process communication between a host and a guest virtual machine, or between guest virtual machines, and may indicate malicious activity such as lateral movement from a virtualized environment, virtual machine escape attempts, or unauthorized communication within an ESXi host environment.
Detects a 32-byte ICMP echo request carrying the backdoor's 8-byte bot ID, explicitly excluding the standard Windows ping.exe payload pattern (the dominant legitimate traffic at this size) and rate-limited to reduce alert volume.
This KQL detects attack used TCP port 4307 for unauthenticated access and replaced public\js\locale.php with a web shell that provided persistent remote access.
Detects network connections originating from processes named 'sftunneld' or connections to public IP addresses over specific ports (443, 8305). This pattern is often used to identify potentially suspicious outbound communication, such as tunneling or C2 activity, particularly when observed from non-standard internal processes.
Detects network connections originating from processes named 'sftunneld' or connections to public IP addresses over specific ports (443, 8305). This pattern is often used to identify potentially suspicious outbound communication, such as tunneling or C2 activity, particularly when observed from non-standard internal processes.
This KQL detects activity associated with network traffic to known C2 infrastructure (45.146.252.17), suspicious Node/NPM execution chains and dropped payload/marker files. Also looks for indicators of remote control, clipboard access, screenshot/desktop-control packages, Socket.IO C2 traffic, and file/browser/wallet data exfiltration behavior.
Page 2 of 6