Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
88 detections
Filters
Last updated
All Time
Detection languages
52
15
8
5
3
Contributors
17
11
10
10
7
Categories
71
35
24
24
19
Platforms
48
25
10
9
9
Products / Services
30
16
14
13
10
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
1
IDS Classtypes
7
5
3
IDS Protocols
12
3
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
This rule detects unusual network connections from processes to legitimate service endpoints that are commonly abused for Command and Control (C2) activities (LOLC2). It specifically looks for connections to services like Telegram, Slack, Discord, GitHub, Google APIs, Pastebin, Dropbox, and others, originating from processes that are not recognized as legitimate applications for those services, and not from common system processes or standard program file paths. This helps identify potential adversary communication channels masquerading as legitimate traffic.
Detects HTTP/HTTPS traffic where the User-Agent string is explicitly set to 'MicroStealer/1.0', which is used by the malware when communicating with Discord webhooks or its C2.
This rule detects network connections to a specific Discord webhook URL and another suspicious domain (78smp.com/m/). This pattern is often associated with malware attempting to exfiltrate data or establish command and control (C2) via Discord webhooks, or other suspicious domains.
This rule set detects various stages of activity related to the 'OpenClaw' malware family and associated campaigns. It includes detection for OpenClaw process execution, exposure of a specific administrative port, execution of shell commands via curl (ClawHavoc delivery), outbound webhook exfiltration, and infostealer access to OpenClaw configuration files.
This rule detects HTTP network connections to the Telegram bot API (api.telegram.org/bot). This pattern is often associated with infostealers exfiltrating data to attacker-controlled Telegram bots. The rule specifically looks for the 'NETWORK_HTTP' event type and a URL containing '/api.telegram.org/bot' (case-insensitive).
Detects the creation or modification of repository webhooks in GitHub. Attackers can use webhooks for real-time data exfiltration of code pushes, pull request comments, and workflow data. Once a webhook is established, it operates independently of the creating user; revoking the creator's credentials will NOT stop the data flow. Only deleting the webhook itself terminates the exfiltration.
Detects network connections to Discord webhook URLs from non-standard processes. This technique is often used by malware, such as Phantom Stealer, to exfiltrate stolen data.
Detects network connections to a specific webhook.site URL known to be used by the Shai-Hulud worm for data exfiltration. The rule specifically looks for the URI path 'bb8ca5f6-4175-45d2-b042-fc9ebb8170b7' on webhook.site, which is a strong indicator of this particular threat.
This search detects network connections to a specific webhook.site URL known to be used by the Shai-Hulud 2.0 worm for data exfiltration.
Detects potential data exfiltration activity associated with the 'Shai-Hulud' NPM package attack. This rule specifically looks for the execution of 'curl' with command-line arguments indicating data being sent ('-d') to a known malicious webhook.site URL.
Detects network connections to the 'webhook.site' domain, which is used as an exfiltration endpoint by the 'Shai-Halud' supply chain attack campaign. The risk score is elevated if the specific malicious URL path is observed.
This rule detects the creation of new Microsoft Power Automate flows that are configured to use connectors capable of exfiltrating data via email or collaboration platforms like Microsoft Teams. It specifically looks for flows created with connectors which could indicate an attempt to send sensitive information outside the organization.
KQL Query
KQL Query from file: Data Exfiltration via Microsoft Teams
KQL Query
KQL Query from file: Hunting Malicious Copilot Agent
Page 3 of 5