Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18 detections
Filters
Last updated
All Time
Detection languages
17
1
Contributors
12
3
1
1
1
Categories
14
12
10
4
2
Platforms
17
1
Products / Services
17
14
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
12
5
IDS Protocols
15
1
1
Detects bursts (3+ in 60s) of octet-stream POSTs to URI paths ending in .cs/.go/.rs, matching Mir0Auth XOR-obfuscated C2. Path must be a single short segment and the threshold is raised to cut noise from dev/API traffic.
Detects bursts (3+ in 60s) of octet-stream POSTs to URI paths ending in .cs/.go/.rs, matching Mir0Auth XOR-obfuscated C2. Path must be a single short segment and the threshold is raised to cut noise from dev/API traffic.
Detects bursts (3+ in 60s) of octet-stream POSTs to URI paths ending in .cs/.go/.rs, matching Mir0Auth XOR-obfuscated C2. Path must be a single short segment and the threshold is raised to cut noise from dev/API traffic.
Detects bursts (3+ in 60s) of octet-stream POSTs to URI paths ending in .cs/.go/.rs, matching Mir0Auth XOR-obfuscated C2. Path must be a single short segment and the threshold is raised to cut noise from dev/API traffic.
Detects outbound HTTP POST requests destined for 'aware-cr1.com' targeting the URI '/api/beacon', which is indicative of command-and-control (C2) communication associated with the 2CLoader malware.
Detects outbound HTTP POST requests destined for 'aware-cr1.com' targeting the URI '/api/beacon', which is indicative of command-and-control (C2) communication associated with the 2CLoader malware.
Detects outbound HTTP POST requests destined for 'aware-cr1.com' targeting the URI '/api/beacon', which is indicative of command-and-control (C2) communication associated with the 2CLoader malware.
Detects outbound HTTP POST requests destined for 'aware-cr1.com' targeting the URI '/api/beacon', which is indicative of command-and-control (C2) communication associated with the 2CLoader malware.
Detects outbound HTTP POST requests directed at a known StealC command-and-control IP address. The rule identifies suspicious beaconing behavior by looking for POST requests that lack a standard User-Agent, do not utilize common HTTP content types, and contain a request body exceeding 16 bytes, suggesting custom binary protocol usage.
Detects outbound HTTP POST requests directed at a known StealC command-and-control IP address. The rule identifies suspicious beaconing behavior by looking for POST requests that lack a standard User-Agent, do not utilize common HTTP content types, and contain a request body exceeding 16 bytes, suggesting custom binary protocol usage.
This rule monitors HTTP POST requests for patterns indicative of armored malware (specifically StealC) beaconing to a Command and Control (C2) server. The rule looks for established connections that use POST requests while avoiding common patterns found in standard web traffic (like JSON, XML, or standard form data) and having a specific request body size threshold. The thresholding mechanism helps reduce noise by only alerting when multiple occurrences are observed within a short time frame, suggesting automated beaconing behavior.
Detects outbound HTTP POST requests directed at a known StealC command-and-control IP address. The rule identifies suspicious beaconing behavior by looking for POST requests that lack a standard User-Agent, do not utilize common HTTP content types, and contain a request body exceeding 16 bytes, suggesting custom binary protocol usage.
Detects outbound HTTP POST requests directed at a known StealC command-and-control IP address. The rule identifies suspicious beaconing behavior by looking for POST requests that lack a standard User-Agent, do not utilize common HTTP content types, and contain a request body exceeding 16 bytes, suggesting custom binary protocol usage.
Detects network traffic consistent with SynkLoader malware communicating with its C2 infrastructure. The rule identifies suspicious TLS SNI requests to known hardcoded domains and HTTP POST requests using the application/octet-stream content type, which are characteristic of SynkLoader C2 beaconing.
Detects CountLoader's C2 beacon sequence: an HTTP GET to /connect carrying XOR-hex-encoded host telemetry and a Bearer token, followed within an hour by a JWT-authenticated getUpdates POST from the same host/destination pair.
This rule detects HTTP traffic where the client body contains a long string (100 or more characters) composed exclusively of uppercase letters and digits 2-7, potentially followed by padding characters. This pattern is indicative of custom alphabet base encoding, often used in Command and Control (C2) communications to obfuscate data.
This rule detects HTTP traffic where the client body contains a long string of hexadecimal characters, which could indicate the use of non-standard encoding for Command and Control (C2) communication. The rule specifically looks for a hexadecimal string of at least 200 characters in the HTTP client body.
This rule detects DNS queries that contain non-standard hex-encoded data, which is often indicative of Command and Control (C2) communication. Specifically, it looks for DNS queries where the query name contains a sequence of 32 or more hexadecimal characters (0-9, a-f). This pattern is frequently used by malware to exfiltrate data or receive commands via DNS tunneling, where data is encoded into subdomains.