Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
18
8
8
2
1
Contributors
9
7
6
5
3
Categories
15
11
9
8
7
Platforms
24
11
1
1
1
Products / Services
5
5
5
4
4
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
2
IDS Classtypes
6
1
IDS Protocols
6
1
1
The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings.
It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex escape sequences or sixteen or more consecutive base64 character groups.
This activity is significant as adversaries commonly use hex or base64 encoding to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads.
It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex escape sequences or sixteen or more consecutive base64 character groups.
This activity is significant as adversaries commonly use hex or base64 encoding to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads.
Detects anomalous POST requests to the RubyGems webhook API endpoint (/api/v1/web_hooks) containing specific indicators ('A000' or 'ZZEND') in the request body, which suggests the misuse of legitimate webhooks for chunked data exfiltration.
Detects HTTP POST exfiltration patterns characteristic of the RevStealer malware. The rule identifies suspicious POST requests to a /cdn/ URI path with specific internal file naming, utilizing a spoofed Chrome 147 User-Agent and specific header indicators (_fbp, _sid).
Detects attempts of decoding a base64 Gzip archive in a PowerShell script. This technique is often used as a method to load malicious content into memory afterward.
Detects HTTP POST tasking check-ins to /version/check.php using the backdoor's hardcoded, obsolete Chrome 78.0.3904.108 user-agent string.
Detects the UNC5142 DeviceManager RAT's DNS-based C2 channel: raw malformed/non-resolver UDP/53 packets and Base64-chunked o-/e-/r- prefixed query names to 91.92.240.100, plus microsoft.com-suffixed decoy queries.
This rule detects the multi-stage execution pattern characteristic of the AMOS stealer on macOS, where a terminal session is used to execute a base64-encoded payload piped into a shell interpreter. The rule specifically monitors for processes like curl, openssl, base64, and zsh being launched from a Terminal or shell parent, often involving specific command-line indicators or malicious URLs associated with the stealer's toolkit.
CaptiveCrunch ChocoShell disguised C2 URI pattern to known Storm-2945 C2 IP (/t/event, /t/pixel.gif, polyfill payload)
Detects the mrmustard stealer's base64+XOR C2 endpoint deobfuscation routine, keyed on the 'tf_compat_v2' string combined with its decode-call markers.
Detects outbound HTTP POST requests to a /gallery URI endpoint, which is associated with Cavern Manticore C2 beacons. The detection logic inspects the HTTP request body for a specific Base64-encoded pattern following XOR 0x48 encoding, indicating potential command-and-control communication.
Detects HTTP POST requests directed at a specific suspicious endpoint (/service/save.php) on a known malicious host (83.138.53.110), consistent with the exfiltration behavior of the FortiBleed EKZ stealer malware. The rule identifies potential credential theft and exfiltration over standard web protocols.
Detects outbound network connections to known blockchain API endpoints originating from developer scripting runtimes (e.g., node.exe, python.exe). This pattern is consistent with attackers using blockchain transactions as a dead-drop mechanism for retrieving encrypted second-stage payloads, a technique observed in supply chain attacks targeting developers.
This rule detects DNS TXT record responses containing a Base64 encoded payload of at least 60 characters. This pattern is often used by malware for command and control (C2) communication or data exfiltration, leveraging DNS tunneling to evade detection.
This rule detects PowerShell commands used to encode data (like hostnames) into hexadecimal strings and exfiltrate it via DNS queries to known Out-of-Band Application Security Testing (OAST) domains. This technique is used by attackers to bypass egress filtering and confirm system compromise, as seen in the exploitation of CVE-2026-1731.
Detects DNS queries to known OAST (Out-of-Band Application Security Testing) domains like oastify.com, oast.pro, and oast.fun where the subdomain is unusually long (over 50 characters). Long subdomains may indicate encoded data exfiltration, a technique observed in the exploitation of vulnerabilities like CVE-2026-1731 to bypass egress filtering.
The analytic detects suspicious PowerShell execution indicative of PowerShell-Empire activity. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze commands sent to PowerShell, specifically looking for patterns involving `system.net.webclient` and base64 encoding. This behavior is significant as it often represents initial stagers used by PowerShell-Empire, a known post-exploitation framework. If confirmed malicious, this activity could allow attackers to download and execute additional payloads, leading to potential code execution, data exfiltration, or further compromise of the affected system.
Base64 Website Access
YARA-L
Detects a user accessing multiple websites commonly used for Base64 encoding and decoding within a short time frame. This activity could be a precursor to data exfiltration or an attempt to obfuscate malicious commands.
This rule detects attempts to phish user credentials by identifying Base64 encoded User Principal Names (UPNs) or their domains within URLs clicked by users. Adversaries often encode sensitive information like UPNs in malicious URLs to bypass security controls or to make the links appear less suspicious. The rule specifically looks for partial Base64 encoded strings of the user's UPN or domain within the 'UrlChain' field of URL click events.
Well-known DNS Exfiltration tools execution
Well-known DNS Exfiltration tools execution
Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward.
Page 1 of 2