Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
178 detections
Filters
Last updated
All Time
Detection languages
92
31
29
9
6
Contributors
66
27
16
11
8
Categories
105
81
64
53
28
Platforms
95
58
11
11
9
Products / Services
83
78
23
19
15
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
49
38
3
1
IDS Protocols
55
28
6
Detects outbound HTTPS traffic from a web server to api.telegram.org. This pattern is indicative of the Montana Empire phishing kit using the Telegram Bot API for command and control (C2) communication, allowing the adversary to exfiltrate stolen data or receive instructions.
Identifies network connections to Telegram domains used by Vidar to read the C2 IP address dynamically from the profile description, specifically when initiated by AutoIt3.exe.
Detects use of Discord webhooks for covert C2 or data exfiltration
This rule detects macOS.Gaslight C2 communication by identifying repeated HTTPS connections to api.telegram.org from non-browser processes. It specifically looks for patterns consistent with the Rust-based implant's getUpdates polling loop, as well as sendMessage and botattach patterns. The detection logic is split into EDR-side (DeviceNetworkEvents) and NDR-side (CommonSecurityLog) components, requiring a minimum of 3 connections/flows within an hour to trigger.
Detects the unique URL structures matching the Service Worker DGA targeting randomized Amazon S3 buckets, indicative of potential command and control communication.
Identifies the Node/Python payload initiating outbound queries to Solana RPC nodes to fetch encoded C2 instructions hidden in blockchain transaction memos.
Detects Graph API or SharePoint activity interacting with specific lists or a site GUID used by the jupyter-powerdev backdoor for Command and Control (C2) operations. This activity is indicative of the jupyter-powerdev malware leveraging SharePoint as a C2 channel.
Detects malware using Pastebin as a dead drop resolver for C2 config
Detects outbound HTTPS traffic to known malicious infrastructure (supp0v3[.]com), used across all campaign waves for credential theft and remote access.
This rule detects the use of the Slack API for potential bidirectional command and control (C2) communication. Specifically, it looks for HTTP traffic to 'slack.com' that includes the '/api/chat.postMessage' URI. A threshold of 10 occurrences within 60 seconds from the same source IP is set to reduce false positives, indicating a high frequency of message posting activity which could be indicative of automated C2.
This rule detects bidirectional Command and Control (C2) communication utilizing the Telegram Bot API. It specifically looks for HTTP traffic where the host is 'api.telegram.org' and the URI contains '/bot'. A threshold of 10 occurrences within 60 seconds from the same source IP is set to reduce false positives.
This rule detects potential bidirectional command and control (C2) activity leveraging Discord webhooks. It specifically looks for HTTP POST requests to 'discord.com' with the URI containing '/api/webhooks/'. A threshold of 5 such requests within 60 seconds from the same source IP is set to reduce false positives and indicate sustained communication, characteristic of C2.
Detects outbound network connections from web server processes to steamcommunity.com, which is used by this malware to fetch steganographically encoded C2 payloads from profile comments.
Detects a specific combination of HTTP GET, POST, and PUT requests to the GitHub API (api.github.com) within a short timeframe. This sequence matches the behavior of the AdaptixC2 custom listener used by Tropic Trooper, which uses GitHub issues for beaconing/task polling and the contents API for data exfiltration. The detection has been refined to look for specific AdaptixC2 operational keywords ('beat', 'upload', 'download') to reduce noise.
Telegram API Access
Sigma
Detects suspicious requests to Telegram API without the usual Telegram User-Agent
Detects DNS queries to Solana RPC endpoints associated with GlassWorm/ForceMemo blockchain-based C2. The malware queries up to 9 Solana RPC endpoints to retrieve C2 instructions from on-chain transaction memos. A Python process resolving any of these domains is anomalous outside of cryptocurrency development environments.
Detects command and control (C2) communication to a specific Telegram Bot API endpoint hardcoded in the LampoRAT malware. This activity is associated with the Boggy Serpens (MuddyWater) threat actor.
Detects outbound network connections to AWS Lambda function URLs which may indicate HazyBeacon backdoor or similar cloud-based C2
Detects network connections to Google Sheets API endpoints indicative of Living Off Trusted Services C2 technique
This rule set detects components of the StegaBin supply-chain attack targeting npm packages. The first rule, 'stegabin_npm_loader', identifies malicious JavaScript loaders that utilize Pastebin for steganography and Vercel API paths for command and control. It looks for specific strings indicating Pastebin usage, Vercel API endpoints, and unique markers related to the steganographic decoding or payload. The second rule, 'StegaBin_VSCode_Tasks_Persistence', focuses on persistence mechanisms within VSCode's tasks.json files. It detects configurations that automatically execute malicious code upon folder opening, specifically looking for the 'runOn': 'folderOpen' property and references to the 'ext-checkdin.vercel.app' domain and associated API paths. Together, these rules aim to identify both the initial loader and the persistence mechanism used by the StegaBin campaign.
Detects non-browser processes making outbound connections to specific Google Sheets API endpoints used by the GRIDTIDE backdoor for command and control. This activity is indicative of the malware using legitimate cloud services to disguise its C2 traffic.
Page 7 of 9