Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
178 detections
Filters
Last updated
All Time
Detection languages
92
31
29
9
6
Contributors
66
27
16
11
8
Categories
105
81
64
53
28
Platforms
95
58
11
11
9
Products / Services
83
78
23
19
15
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
49
38
3
1
IDS Protocols
55
28
6
Detects network traffic indicating potential Command and Control (C2) tasking communication via Microsoft SharePoint. The rule monitors for requests to specific SharePoint paths associated with the TWINLOOT campaign, which leverages legitimate cloud infrastructure for malicious command delivery.
Detects the ACRStealer Telegram Dead Drop Resolver handoff: a non-Telegram-client TLS/SNI contact into Telegram's IP range immediately followed by a DNS/TLS/HTTP connection to the resolved C2 domain res.explicittweak.cc.
Detects Shai-Hulud / ChainDrop activity by correlating known malicious hashes, npm/Node/Bun execution, payload artifacts, IDE persistence, credential discovery, cloud metadata access, GitHub exfiltration, C2 domains, Ethereum RPC activity, staging files, persistence artifacts, and known IOC IP connections.
KQL Query
Detects HTTP GET requests to a specific Cloudflare Workers domain ('is-01-ast.ols-img-12.workers.dev') used for msaRAT WebRTC signaling, characterized by the presence of spoofed 'Origin' and 'Referer' headers pointing to 'microsoft.com' alongside a 'HeadlessChrome' user agent, indicating malicious command-and-control behavior.
This query identifies creation/loading of SysExcSvc.dll and SysReadSvc.dll along with suspicious LSASS memory dumping, reverse SSH tunnel creation.
These patterns are prevalent with "Phantom" including unusual OneDrive or Microsoft Graph access from LOLBins or unexpected processes.
These patterns are prevalent with "Phantom" including unusual OneDrive or Microsoft Graph access from LOLBins or unexpected processes.
Detects C2Looper v2 retrieving GitHub-hosted C2 tasking files (cmd.json, result.json, beacon.json) via raw.githubusercontent.com or api.github.com, requiring repeated requests to reduce false positives from incidental single fetches.
Detects the Payroll Pirates (Storm-2755) AiTM phishing redirect chain: Google Meet/Ads redirector, an AWS S3 intermediate hop, and final resolution of a previously-unseen domain, indicating completion of the multi-hop chain to an AiTM proxy.
Detects Shai-Hulud / ChainDrop activity by correlating known malicious hashes, npm/Node/Bun execution, payload artifacts, IDE persistence, credential discovery, cloud metadata access, GitHub exfiltration, C2 domains, Ethereum RPC activity, staging files, persistence artifacts, and known IOC IP connections.
Detects payload callbacks to the Rognar Telegram-bot-linked DOUBLECUP C2 URL (hxxp://67.219.107.181/hgflssvslvidfugvbldiuv).
Detects HTTP requests to a Cloudflare Workers subdomain
(*.workers.dev) targeting the /token/v1/{UID} signaling endpoint, originating from a headless Chrome user agent. Chaos ransomware's msaRAT offloads all C2 signaling to the browser via CDP-injected JavaScript, performing WebRTC SDP
Offer/Answer exchange through this trusted developer platform to evade domain reputation blocking.
(*.workers.dev) targeting the /token/v1/{UID} signaling endpoint, originating from a headless Chrome user agent. Chaos ransomware's msaRAT offloads all C2 signaling to the browser via CDP-injected JavaScript, performing WebRTC SDP
Offer/Answer exchange through this trusted developer platform to evade domain reputation blocking.
This rule detects anomalous patterns of Microsoft Graph API activity involving the /calendar, /events, and /calendarView endpoints. It identifies application identities performing high-frequency create (POST/PATCH) and read (GET) operations within a short time window. This behavior is indicative of a compromised mailbox being used as a C2 dead-drop channel, where the calendar is used to exchange commands and results between the adversary and the compromised environment.
TOKYOCORE RansomAgent User-Agent HTTP Traffic to Public File Hosting Service
Larva-24009 HeptaX C2 beacon to shared infrastructure (get-command/index/new-upload/post_proc)
Detects DeviceManager's EtherHiding C2 resolution: an eth_call JSON-RPC request using get_data_selector 0x1dcf296b against the known-malicious contract address 0xc027490af56a9d7050fc259ecd03da1580b84aae, excluding requests with a browser-like User-Agent.
STAC4749 DNS Query to Known C2 Domain or Cloudflare Workers.dev C2 Subdomain
Detects outbound HTTP POST requests directed to Discord webhooks containing specific indicators associated with the TOKYOCORE ransomware, specifically identifying a unique User-Agent and a hardcoded exfiltration/C2 string in the request body.
Detects the combined msaRAT CDP C2 sequence within a single event - Page.setBypassCSP disabling Content Security Policy, all five Runtime.addBinding callback registrations (msaOpen, msaClose, msaError, msaMessage, dataAck), and a Runtime.evaluate call injecting JavaScript that establishes an RTCPeerConnection. All three behaviors must be present together, reducing false positives from unrelated CDP activity.
Detects the execution of Google Chrome or Microsoft Edge in headless mode by the Windows Installer service (msiexec.exe), utilizing remote debugging ports and custom user-data directories. This behavior is indicative of browser-hijacking techniques, such as those observed in msaRAT, used to establish covert C2 channels by manipulating the browser's CDP interface.
Detects the combined msaRAT CDP C2 sequence within a single event - Page.setBypassCSP disabling Content Security Policy, all five Runtime.addBinding callback registrations (msaOpen, msaClose, msaError, msaMessage, dataAck), and a Runtime.evaluate call injecting JavaScript that establishes an RTCPeerConnection. All three behaviors must be present together, reducing false positives from unrelated CDP activity.
Detects an HTTP GET request to the Microsoft Graph API (/v1.0/users/*/calendarView) containing a specific hardcoded far-future date (2050-05-13) in the startDateTime parameter. This pattern is indicative of a command-and-control (C2) mechanism leveraging a legitimate cloud service to maintain persistent communication channels.
Page 5 of 9