Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
10
8
3
3
Contributors
8
6
4
2
1
Categories
12
9
9
9
7
Platforms
13
12
3
1
1
Products / Services
10
9
5
4
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
8
2
IDS Protocols
5
3
1
1
Detects network patterns associated with NeedyMantis-style command-and-control (C2) activity. This includes specific HTTP GET requests with hardcoded User-Agent strings, cookie-based binary data transfer in server responses, and WebSocket communication attempting to establish binary protocol channels.
Detects command-line activity indicative of DNS tunneling, often used by OilRig (APT34) for C2 communication via BONDUPDATER. The rule monitors PowerShell or nslookup commands executing DNS TXT record queries paired with long, base64-encoded subdomains, a technique used for exfiltrating data or receiving commands.
This rule detects network activity associated with the Sauron Loader malware. It monitors for TLS connections to known hardcoded C2 domains and identifies HTTP requests following a specific pattern of randomized command and control (C2) paths combined with suspicious User-Agent headers (Windows NT with Edge/Edg).
This rule detects periodic network beaconing patterns consistent with BabylonRAT malware. It flags established TCP connections to external networks that occur at a frequency exceeding 5 connections within a 300-second window, which may indicate a C2 check-in mechanism. Due to the heuristic nature of this detection, it is recommended to tune the threshold and correlate with payload analysis or entropy inspection to reduce noise.
This rule detects periodic network beaconing patterns consistent with BabylonRAT malware. It flags established TCP connections to external networks that occur at a frequency exceeding 5 connections within a 300-second window, which may indicate a C2 check-in mechanism. Due to the heuristic nature of this detection, it is recommended to tune the threshold and correlate with payload analysis or entropy inspection to reduce noise.
This rule detects periodic network beaconing patterns consistent with BabylonRAT malware. It flags established TCP connections to external networks that occur at a frequency exceeding 5 connections within a 300-second window, which may indicate a C2 check-in mechanism. Due to the heuristic nature of this detection, it is recommended to tune the threshold and correlate with payload analysis or entropy inspection to reduce noise.
This rule detects periodic network beaconing patterns consistent with BabylonRAT malware. It flags established TCP connections to external networks that occur at a frequency exceeding 5 connections within a 300-second window, which may indicate a C2 check-in mechanism. Due to the heuristic nature of this detection, it is recommended to tune the threshold and correlate with payload analysis or entropy inspection to reduce noise.
Detects outbound HTTP POST requests to a known StealC malware command-and-control (C2) endpoint. This rule monitors for established TCP connections and HTTP traffic directed towards a specific IP address associated with malicious exfiltration activity.
Detects outbound HTTP POST beaconing behavior to a known C2 IP address associated with the StealC malware and ClickFix campaign. This rule monitors for established connections to the hardcoded infrastructure used for exfiltrating data or receiving commands.
Detects periodic (beaconing) HTTP POST requests directed to '/api/beacon' from endpoints. The detection logic monitors for consecutive connections occurring within a 3-second interval, specifically searching for JSON payloads containing identification fields (id, user, host, pid) characteristic of C2Looper backdoor traffic.
This rule detects potential command and control (C2) beaconing activity associated with the OilRig threat group's BONDUPDATER/ALMA Communicator malware. It identifies suspicious, highly regular DNS TXT record queries (QueryType 16) originating from common system tools like nslookup.exe, powershell.exe, or cmd.exe. The detection logic calculates the statistical regularity of query intervals to identify automated beaconing patterns, which is a hallmark of C2 communication using DNS tunneling or data exfiltration via DNS.
This rule detects potential command and control (C2) beaconing activity associated with the OilRig threat group's BONDUPDATER/ALMA Communicator malware. It identifies suspicious, highly regular DNS TXT record queries (QueryType 16) originating from common system tools like nslookup.exe, powershell.exe, or cmd.exe. The detection logic calculates the statistical regularity of query intervals to identify automated beaconing patterns, which is a hallmark of C2 communication using DNS tunneling or data exfiltration via DNS.
This rule detects potential command and control (C2) beaconing activity associated with the OilRig threat group's BONDUPDATER/ALMA Communicator malware. It identifies suspicious, highly regular DNS TXT record queries (QueryType 16) originating from common system tools like nslookup.exe, powershell.exe, or cmd.exe. The detection logic calculates the statistical regularity of query intervals to identify automated beaconing patterns, which is a hallmark of C2 communication using DNS tunneling or data exfiltration via DNS.
This rule detects outgoing HTTP POST requests that contain a payload matching the signature of Ousaban malware's custom XOR-encoded command-and-control (C2) traffic, characterized by a specific hexadecimal structure.
This rule detects DNS TXT record responses containing a Base64 encoded payload of at least 60 characters. This pattern is often used by malware for command and control (C2) communication or data exfiltration, leveraging DNS tunneling to evade detection.
Detects the execution of suspicious commands often used in Command and Control (C2) activities, as identified in Florian Roth's 'Best Practice Auditd Configuration'. These commands include `wget`, `curl`, `base64`, `nc`, `netcat`, `ncat`, `ssh`, `socat`, `wireshark`, `rawshark`, `rdesktop`, and `nmap`. These tools can be leveraged for various adversarial techniques such as data transfer, remote access, network discovery, and data encoding.
Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'.
This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap.
These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)
This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap.
These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)
This rule detects attempts to phish user credentials by identifying Base64 encoded User Principal Names (UPNs) or their domains within URLs clicked by users. Adversaries often encode sensitive information like UPNs in malicious URLs to bypass security controls or to make the links appear less suspicious. The rule specifically looks for partial Base64 encoded strings of the user's UPN or domain within the 'UrlChain' field of URL click events.
'This rule identifies a web request with a user agent header known to belong PowerShell. <br>You can add custom Powershell indicating User-Agent headers using a watchlist, for more information refer to the [UnusualUserAgents Watchlist](https://aka.ms/ASimUnusualUserAgentsWatchlist).<br><br>
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM WebSession schema (ASIM WebSession Schema)'
'This detection will identify network requests in HTTP proxy data that contains Base64 encoded IP addresses. After identifying candidates the query joins with DeviceNetworkEvents to idnetify any machine within the network using that IP address. Alerts indicate that the IP address of a machine within your network was seen with it's IP address base64 encoded in an outbound web request. This method of egressing the IP was seen used in POLONIUM's RunningRAT tool, however the detection is generic.'
This query was originally published in the threat analytics report, Ryuk ransomware. There is also a related blog.
Ryuk is human-operated ransomware. Much like DoppelPaymer ransomware, Ryuk is spread manually, often on networks that are already infected with Trickbot.
During the earliest stages of a Ryuk infection, an operator downloads Cobalt Strike, a penetration testing kit that is also used by malicious actors. Cobalt Strike is used by Ryuk operators to explore the network before deploying the Ryuk payload. This malicious behavior is often obscured by Base64 encoding and other tricks.
The following query detects possible invocation of Cobalt Strike using Windows Management Instrumentation (WMI).
The See also section below lists links to other queries associated with Ryuk ransomware.
References:
https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Ryuk&threatId=-2147232689
https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
https://www.cobaltstrike.com/
https://docs.microsoft.com/windows/win32/wmisdk/wmi-start-page
Ryuk is human-operated ransomware. Much like DoppelPaymer ransomware, Ryuk is spread manually, often on networks that are already infected with Trickbot.
During the earliest stages of a Ryuk infection, an operator downloads Cobalt Strike, a penetration testing kit that is also used by malicious actors. Cobalt Strike is used by Ryuk operators to explore the network before deploying the Ryuk payload. This malicious behavior is often obscured by Base64 encoding and other tricks.
The following query detects possible invocation of Cobalt Strike using Windows Management Instrumentation (WMI).
The See also section below lists links to other queries associated with Ryuk ransomware.
References:
https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/Ryuk&threatId=-2147232689
https://www.microsoft.com/security/blog/2020/03/05/human-operated-ransomware-attacks-a-preventable-disaster/
https://www.cobaltstrike.com/
https://docs.microsoft.com/windows/win32/wmisdk/wmi-start-page
Page 1 of 2