Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
178 detections
Filters
Last updated
All Time
Detection languages
92
31
29
9
6
Contributors
66
27
16
11
8
Categories
105
81
64
53
28
Platforms
95
58
11
11
9
Products / Services
83
78
23
19
15
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
49
38
3
1
IDS Protocols
55
28
6
Detects suspicious modifications or deletions of Outlook calendar events using the Microsoft Graph API, potentially indicating the use of calendar infrastructure as a command-and-control (C2) heartbeat or exfiltration channel. The rule monitors for specific pattern-based event updates or deletions following calendar enumeration, which is a technique used to maintain persistent communication or exfiltrate small amounts of data.
Detects anomalous activity in Microsoft 365 calendar events where potential C2 data is exfiltrated or synchronized. This is identified by the creation or modification of calendar events containing suspicious file names (e.g., File0.txt, File1.txt) or specific command-and-control markers within the event subject.
Detects the combined msaRAT CDP C2 sequence within a single event - Page.setBypassCSP disabling Content Security Policy, all five Runtime.addBinding callback registrations (msaOpen, msaClose, msaError, msaMessage, dataAck), and a Runtime.evaluate call injecting JavaScript that establishes an RTCPeerConnection. All three behaviors must be present together, reducing false positives from unrelated CDP activity.
Detects suspicious modifications or deletions of Outlook calendar events using the Microsoft Graph API, potentially indicating the use of calendar infrastructure as a command-and-control (C2) heartbeat or exfiltration channel. The rule monitors for specific pattern-based event updates or deletions following calendar enumeration, which is a technique used to maintain persistent communication or exfiltrate small amounts of data.
Possible EtherHiding - outbound eth_call JSON-RPC request to blockchain RPC endpoint
Detects anomalous activity in Microsoft 365 calendar events where potential C2 data is exfiltrated or synchronized. This is identified by the creation or modification of calendar events containing suspicious file names (e.g., File0.txt, File1.txt) or specific command-and-control markers within the event subject.
Detects anomalous activity in Microsoft 365 calendar events where potential C2 data is exfiltrated or synchronized. This is identified by the creation or modification of calendar events containing suspicious file names (e.g., File0.txt, File1.txt) or specific command-and-control markers within the event subject.
Detects suspicious modifications or deletions of Outlook calendar events using the Microsoft Graph API, potentially indicating the use of calendar infrastructure as a command-and-control (C2) heartbeat or exfiltration channel. The rule monitors for specific pattern-based event updates or deletions following calendar enumeration, which is a technique used to maintain persistent communication or exfiltrate small amounts of data.
This rule detects internal network traffic communicating with the Telegram Bot API endpoint 'api.telegram.org' using the 'getUpdates' method. This pattern is commonly used by malware for C2 polling to retrieve commands from an adversary-controlled Telegram bot.
Detects network requests originating from common package manager User-Agents (e.g., pip, npm, cargo) targeted at external domains that do not match known legitimate repositories. This behavior is indicative of potential command and control (C2) activity or malicious package staging using lookalike or arbitrary domains to bypass standard package registry traffic patterns.
Detects HTTP requests where the referrer is a major LLM service (e.g., ChatGPT, Claude) but the destination host uses keywords indicative of phantom squatting (e.g., parcel, delivery, login) suggesting an attempt to use LLM-generated content or platforms to facilitate malicious redirects or phishing.
Detects frequent, persistent outbound TLS connections to api.telegram.org. This behavior is indicative of a malware sample or backdoor polling the Telegram Bot API for command and control (C2) instructions, effectively using the legitimate Telegram infrastructure to tunnel malicious communication.
Detects network activity associated with the Grandoreiro banking trojan, specifically identifying C2 communication tunneled over WebRTC/STUN (port 3478) or MQTT (Azure/Google Cloud services) originating from processes executing out of the AppData\Local directory. This behavior aligns with Grandoreiro's known DLL side-loading mechanism where legitimate but vulnerable binaries are used to load malicious libraries.
Detects high-frequency HTTPS network connections to Google Drive or Google APIs originating from processes that are not common web browsers or productivity software. This behavior is indicative of the GearDoor backdoor, commonly used by APT41, which leverages Google services as a command-and-control (C2) channel.
Detects network connections to Microsoft OneDrive or SharePoint domains from processes that are not standard, known-good applications (e.g., browsers or standard sync clients). This behavior may indicate an adversary leveraging cloud storage for command-and-control (C2) operations or data exfiltration.
Detects suspicious network connections or process activity targeting Discord webhooks or API endpoints, potentially indicating data exfiltration, command and control, or token validation by malicious actors. The rule specifically looks for non-Discord processes making these connections or using suspicious user agents.
This rule detects network connections or DNS queries related to the TON blockchain ecosystem, specifically targeting domains and API endpoints associated with TON network infrastructure. These communication patterns may indicate interaction with cryptocurrency-related services or potential malware utilizing TON-based infrastructure for command and control or data exfiltration.
Detects network connections to Microsoft OneDrive or SharePoint domains from processes that are not standard, known-good applications (e.g., browsers or standard sync clients). This behavior may indicate an adversary leveraging cloud storage for command-and-control (C2) operations or data exfiltration.
This rule detects command and control (C2) communication patterns associated with the Millenium RAT malware. It identifies suspicious traffic to 'api.telegram.org' utilizing the 'getUpdates' method initiated by processes that do not identify as standard web browsers, as well as traffic directed to the known proxy relay domain '75877.mcdir.me'.
Detects high-frequency HTTPS network connections to Google Drive or Google APIs originating from processes that are not common web browsers or productivity software. This behavior is indicative of the GearDoor backdoor, commonly used by APT41, which leverages Google services as a command-and-control (C2) channel.
Detects suspected NarwhalRAT activity where a process (e.g., userscreen.exe or pythonw.exe in suspicious locations) communicates with the pCloud API to resolve a dead-drop location, followed within 60 seconds by a beacon connection to a different remote IP, characteristic of C2 communication.
Page 6 of 9