Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
89 detections
Filters
Last updated
All Time
Detection languages
46
21
16
4
2
Contributors
27
17
10
9
8
Categories
48
44
33
31
12
Platforms
50
41
10
6
3
Products / Services
41
38
14
13
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
27
16
2
1
IDS Protocols
34
7
5
Detects a potential command and control (C2) dead-drop sequence where a non-browser process fetches raw content from Pastebin and subsequently contacts a specific C2 domain within the same process context.
Detects the Blinder Tunnel C2 loop. The loader beacons about every 63 seconds to the GitHub Contents API (profile upload, one-time license read). The newer variant can instead go through a Cloudflare Workers relay that mirrors the GitHub API paths. Both platforms are legitimate, so the signal is the client: the implant install directory, a non-System32 RuntimeBroker.exe, or any binary under AppData\Local\Microsoft\, none of which are real GitHub clients. Known implant hosts and the known relay alert on a single hit. The lookalike-path arm needs 10 or more connections per hour (a 63-second loop produces 100+), which suppresses incidental noise. Depends on RemoteUrl being populated for TLS connections.
Sweeps proxy, firewall and endpoint network telemetry for requests to the three published BraZetsu Pastebin dead-drop raw URLs used to retrieve the XOR-encrypted C2 config.
Sweeps proxy, firewall and endpoint network telemetry for requests to the three published BraZetsu Pastebin dead-drop raw URLs used to retrieve the XOR-encrypted C2 config.
Sweeps proxy, firewall and endpoint network telemetry for requests to the three published BraZetsu Pastebin dead-drop raw URLs used to retrieve the XOR-encrypted C2 config.
Sweeps proxy, firewall and endpoint network telemetry for requests to the three published BraZetsu Pastebin dead-drop raw URLs used to retrieve the XOR-encrypted C2 config.
Sweeps proxy, firewall and endpoint network telemetry for requests to the three published BraZetsu Pastebin dead-drop raw URLs used to retrieve the XOR-encrypted C2 config.
Detects outbound HTTP requests to a known C2 domain (letsdiskuss.com) and a specific URI path, characteristic of the 'Lorem Ipsum' malware loader's dead-drop resolver lookup.
Detects outbound HTTP requests to 'letsdiskuss.com' with a URI pattern of '/user/', which is characteristic of the 'STAC4924' loader utilizing a dead-drop resolver for command-and-control communication.
Detects anomalous outbound HTTP/TLS requests to rutracker.org that contain a GUID-like identifier in the URI or deviate from normal user traffic patterns, which is characteristic of the 'VPN-for-X' browser extension acting as a command-and-control beacon.
Detects suspicious processes such as PowerShell, Python, or scripting hosts performing network communication with major AI/LLM provider APIs, followed immediately by child process execution or related activity. This pattern is indicative of LLM-assisted automation for malicious activities, potentially using AI to generate code, scripts, or orchestrate command and control actions.
Detects high-frequency requests to Hugging Face dataset repository commit and discussion endpoints, which may indicate the use of the platform as a dead drop resolver or for C2 polling.
Detects network requests to specific GitHub, Blogspot, and Telegram endpoints, which are known to be used by the 'VPN-for-X' extension to fetch proxy configuration files. This behavior is indicative of C2 channel configuration retrieval.
Detects outbound network traffic to known public BNB Smart Chain (BSC) data seed nodes using JSON-RPC 'eth_call' methods or TLS connections. This pattern is indicative of malware using blockchain infrastructure as a dead drop resolver for C2 command retrieval or configuration updates.
Detects two-stage communication pattern used by the Lorem Ipsum Loader. The first stage involves a GET request to a specific host acting as a dead-drop resolver to retrieve configuration. The second stage involves a POST request to an external destination containing a JPEG file header, characteristic of image-based C2 traffic.
Detects repetitive network traffic to the Slack API endpoint '/api/conversations.history' using the 'Go-http-client' User-Agent. This behavior is indicative of the Graphalgo RAT polling Slack for command-and-control (C2) instructions.
This rule detects network requests directed at raw.githubusercontent.com that attempt to retrieve 'init.dat' or files named with a specific GUID format, patterns which are characteristic of the Kimsuky threat group using GitHub as a dead drop resolver for C2 infrastructure discovery.
Detects network activity associated with the 'VPN-for-X' browser extension, specifically targeting communication with external services used for proxy configuration fetching and dead-drop proxy list retrieval. This includes TLS SNI checks for GitHub, Blogspot, and Telegram, as well as specific URI requests for proxy configurations and server lists.
Detects network traffic to specific domains (api.hhos.ru, mainapi.store) associated with the VPN-for-X browser extension's monetization API. This behavior is indicative of command-and-control or tracking communication identified as potentially malicious within the context of a browser extension.
Detects RevStealer malware attempting to use blockchain infrastructure for C2 communication or failover. The rules identify specific 'eth_call' JSON-RPC method calls to Polygon smart contracts containing hardcoded indicators, as well as TLS connections to known public RPC providers used as fallback C2 infrastructure.
This rule detects network communication (DNS queries and TLS connections) to known actor-controlled Slack workspace subdomains, as well as the presence of a specific hardcoded public key in Slack API traffic, suggesting the use of Slack as a Command and Control (C2) channel.
Page 1 of 5