Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
303 detections
Filters
Last updated
All Time
Detection languages
119
82
68
11
9
Contributors
87
39
27
26
22
Categories
138
107
107
84
44
Platforms
133
129
29
28
16
Products / Services
113
105
39
32
24
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
2
2
2
1
1
IDS Classtypes
78
36
3
1
1
IDS Protocols
74
30
11
2
Detects script-driven (curl, wget, python) outbound connections to
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
Detects execution of Node.js or Bun from a temporary directory performing DNS queries for public Ethereum JSON-RPC provider domains, a technique observed in supply chain compromise payloads such as Shai-Hulud and ChainDrop to resolve command and control endpoints.
Detects a potential command and control (C2) dead-drop sequence where a non-browser process fetches raw content from Pastebin and subsequently contacts a specific C2 domain within the same process context.
Detects network activity involving a specific suspicious webhook domain or URL path alongside connections to legitimate external services (such as Telegram or GitHub API) from non-standard processes on the same device, which may indicate command and control (C2) or data exfiltration behavior.
Detects the Blinder Tunnel C2 loop. The loader beacons about every 63 seconds to the GitHub Contents API (profile upload, one-time license read). The newer variant can instead go through a Cloudflare Workers relay that mirrors the GitHub API paths. Both platforms are legitimate, so the signal is the client: the implant install directory, a non-System32 RuntimeBroker.exe, or any binary under AppData\Local\Microsoft\, none of which are real GitHub clients. Known implant hosts and the known relay alert on a single hit. The lookalike-path arm needs 10 or more connections per hour (a 63-second loop produces 100+), which suppresses incidental noise. Depends on RemoteUrl being populated for TLS connections.
Sweeps proxy, firewall and endpoint network telemetry for requests to the three published BraZetsu Pastebin dead-drop raw URLs used to retrieve the XOR-encrypted C2 config.
Sweeps proxy, firewall and endpoint network telemetry for requests to the three published BraZetsu Pastebin dead-drop raw URLs used to retrieve the XOR-encrypted C2 config.
The following analytic detects the execution of ngrok.exe on a Windows operating system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because while ngrok is a legitimate tool for creating secure tunnels, it is increasingly used by adversaries to bypass network defenses and establish reverse proxies. If confirmed malicious, this could allow attackers to exfiltrate data, maintain persistence, or facilitate further attacks by tunneling traffic through the compromised system.
Sweeps proxy, firewall and endpoint network telemetry for requests to the three published BraZetsu Pastebin dead-drop raw URLs used to retrieve the XOR-encrypted C2 config.
Detects script-driven (curl, wget, python) outbound connections to
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
Sweeps proxy, firewall and endpoint network telemetry for requests to the three published BraZetsu Pastebin dead-drop raw URLs used to retrieve the XOR-encrypted C2 config.
Sweeps proxy, firewall and endpoint network telemetry for requests to the three published BraZetsu Pastebin dead-drop raw URLs used to retrieve the XOR-encrypted C2 config.
Detects outbound HTTP requests to a known C2 domain (letsdiskuss.com) and a specific URI path, characteristic of the 'Lorem Ipsum' malware loader's dead-drop resolver lookup.
Detects outbound HTTP GET requests to specific GitHub repository paths hosted on raw.githubusercontent.com, which are associated with the Kimsuky threat actor's 'Operation GitPower'. These paths indicate the retrieval of malicious payloads or scripts from adversary-controlled repositories.
Identifies suspicious processes performing beacon-like network communications with rare external destinations. The rule detects consistent hourly activity intervals and high connection counts to endpoints rarely contacted by other devices in the organization, serving as a heuristic for automated C2 beaconing.
Detects network activity associated with the RatHat Android malware, specifically tracking device registration, log uploads to '/api/node/', and subsequent WebSocket protocol upgrades used for command-and-control communications.
Detects network traffic to the Telegram Bot API where the request URI contains indicators of sensitive data exfiltration such as 'cookie', 'session', 'password', or 'credential'. This pattern is often associated with adversary-in-the-middle (AiTM) phishing kits (e.g., Evilginx2) exfiltrating stolen session tokens or credentials to an attacker-controlled Telegram bot.
Detects outbound HTTP requests to api.github.com targeting the 'contents' API with patterns indicative of RUSTYSHADE malware command-and-control (C2) communication, including file extensions and filenames typical of its tasking mechanisms.
This rule monitors outbound TLS traffic to detect communication between a potentially compromised internal host and the DeepSeek API. This behavior is associated with the 'CLOSEDQUORUM' malware family, which utilizes LLM-based voting mechanisms for command and control (C2) operations via third-party AI services.
This rule detects a multi-stage phishing redirection chain where a user visits a known survey platform (t.maze.co) followed immediately by a request to a Cloudflare Workers landing page (.workers.dev), a common pattern used by adversaries to obfuscate malicious delivery endpoints.
Detects high-frequency, sequential outbound GET requests to short URL patterns, potentially indicating a sandbox escape attempt or automated command-and-control activity where shortened links are used to download multi-stage payloads.
Page 1 of 15