Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
88 detections
Filters
Last updated
All Time
Detection languages
46
20
16
4
2
Contributors
27
17
10
9
8
Categories
47
44
32
31
12
Platforms
50
40
10
6
3
Products / Services
41
38
13
13
6
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
27
16
2
1
IDS Protocols
34
7
5
Flags outbound HTTPS traffic to a specific Azure Blob Storage path ('note1ggbbhggdwa1.blob.core.windows.net/note/ats/') when initiated by 'RuntimeBroker_update.exe'. This pattern is indicative of a dead-drop command and control (C2) mechanism, potentially associated with the 'Operation Dragon Weave' campaign.
Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks.
In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.
In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.
This rule detects network connections to known dead drop resolver domains (letsdiskuss.com or digitalpoint.com) that originate from processes other than common web browsers (Chrome, Edge, Firefox, Internet Explorer). This behavior is indicative of command and control (C2) activity where malware uses legitimate web services to retrieve further instructions or C2 infrastructure details.
Detects C2 configuration retrieval via Pastebin and similar dead drop services
This rule detects HTTP traffic where the host is 'gist.github.com' and the URI contains '/raw/', indicating a potential Dead Drop Resolver using GitHub Gist for Command and Control (C2) activities. It triggers an alert if five such connections are observed from the same source IP within 300 seconds.
Curl Download From Telegram Channel
Cortex XDR
Detects the use of curl.exe to download files from public Telegram channels to the user's Temp directory, indicative of Gamaredon Dead Drop Resolver (DDR) resolution.
This rule detects DNS queries for 'pastebin.com' that occur at a high frequency (5 times within 60 seconds from the same source IP). This pattern is indicative of a Dead Drop Resolver Command and Control (C2) mechanism, where attackers use services like Pastebin to host C2 instructions or data, and malware frequently queries these services to retrieve commands or exfiltrate data. The rule specifically targets DNS traffic on port 53.
This rule detects attempts to retrieve C2 configuration from Pastebin, specifically looking for HTTP requests to 'pastebin.com' that include '/raw/' in the URI. It uses a threshold of 5 occurrences within 300 seconds from the same source to reduce false positives.
Detects browser processes making DNS queries or network connections to BNB Smart Chain RPC endpoints (and related EVM-compatible chain RPCs). This technique is a signal for EtherHiding-style attacks where malicious JavaScript injected into compromised websites queries smart contracts for payload retrieval. This generalizes beyond ClearFake to catch UNC5342 (North Korean DPRK) and other EtherHiding adopters documented since October 2025.
Detects curl.exe being used to fetch content from Telegram channels and saving it to the AppData\Local\Temp directory, indicative of Gamaredon Dead Drop Resolver (DDR) resolution.
Detects DNS requests to the specific Azure Blob Storage subdomain used by the Azureveil Adaptix agent in Operation Dragon Weave as a dead-drop command and control server.
Detects the use of curl.exe to download files from public Telegram channels to the user's Temp directory. This is indicative of a Dead Drop Resolver (DDR) technique utilized by the Gamaredon group to retrieve Command and Control (C2) configuration data.
Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form
Detects the "EtherHiding" technique used by the FakeGit campaign. The malware queries a Polygon Mainnet smart contract via a public RPC node to resolve its current C2 server address. This rule looks for network connections to known blockchain RPC providers containing the specific function selectors used by the malware's V1 and V2 contracts.
Detects network connections to the typosquatted domain nexsnield.com, which is used by the malicious uBlock Origin Lite extension to track installations and correlate activity.
Detects network traffic indicative of the Diaoyu Loader downloading second-stage payloads from GitHub. The loader masquerades these payloads as image files within a WordPress-like directory structure.
PwnDrp Access
Sigma
Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity
Detects the use of rundll32.exe to set WebDAV cookies, which can be indicative of forced authentication attempts or other malicious network activity. This technique is often used by adversaries to capture NTLM hashes by tricking a system into authenticating to a malicious server.
This rule detects the addition of an AppX package to the processing pipeline where the package's source path contains domains commonly associated with file sharing, code hosting, or temporary storage services. Adversaries often leverage these services to host malicious payloads, including AppX packages, to bypass traditional security controls or to deliver malware. The rule specifically looks for EventID 854 from the 'AppXDeployment-Server' log source and checks if the 'Path' field contains any of the listed suspicious domains.
Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks.
In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.
In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.
Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.
Page 4 of 5