Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
72 detections
Filters
Last updated
All Time
Detection languages
41
16
9
2
2
Contributors
16
12
10
7
4
Categories
33
28
22
15
14
Platforms
47
18
5
4
3
Products / Services
37
18
8
6
5
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
15
14
11
1
IDS Protocols
24
11
4
1
This rule detects network communication associated with the REVSTEALER 'EtherHiding' technique. It monitors for POST requests to Polygon network RPC endpoints containing specific contract interaction signatures ('eth_call' with '0x4965e13f' and a specific contract address), as well as TLS connections to known malicious domains and fallback RPC providers used to resolve C2 instructions from blockchain data.
This rule detects network communication associated with the REVSTEALER 'EtherHiding' technique. It monitors for POST requests to Polygon network RPC endpoints containing specific contract interaction signatures ('eth_call' with '0x4965e13f' and a specific contract address), as well as TLS connections to known malicious domains and fallback RPC providers used to resolve C2 instructions from blockchain data.
Detects network activity related to the Beamglea/ClickFix framework using api.keyval.org as a dead-drop resolver. The rule monitors for DNS resolutions, TLS SNI requests, and HTTP GET/PUT requests to the identified C2 infrastructure, which is used for retrieving and storing obfuscated redirect values.
This rule detects command and control (C2) communication patterns utilized by the GoCaracal malware family, specifically its fallback mechanism which leverages Ethereum blockchain RPC calls (eth_getStorageAt) to interact with known malicious smart contracts or wallet addresses.
Detects TLS sessions to Sapphire Sleet/UNC1069 Hostwinds C2 infrastructure presenting the exact self-signed certificate issuer string linked to the Mastra/axios campaigns.
Detects a DNS query for diagrtrack.com, a typosquat of Windows DiagTrack registered to serve as this backdoor's C2 infrastructure (dormant since early 2021).
Detects Abyssos RAT C2 traffic via its literal HELLO|...|v2.4F registration banner combined with an AES-GCM-sized payload to two known hardcoded C2 IPs.
TLS beaconing to disposable AMOS distribution/redirector domain
Detects DeviceManager DNS TXT/A tunneling traffic occurring within 60 seconds after an eth_call blockchain RPC request from the same host, consistent with DeviceManager resolving C2 via EtherHiding before tunneling.
Detects DeviceManager's EtherHiding C2 resolution: an eth_call JSON-RPC request using get_data_selector 0x1dcf296b against the known-malicious contract address 0xc027490af56a9d7050fc259ecd03da1580b84aae, excluding requests with a browser-like User-Agent.
Detects high-volume DNS TXT/A queries from a single internal host to a domain containing "microsoft" or "telemetry" keywords, indicative of DeviceManager RAT DNS tunneling C2 channel abuse designed to mimic legitimate Microsoft telemetry traffic.
Campaign converting compromised FortiGate firewalls into credential stealers
Detects network connections resolving to specific domains or UUID-based API endpoints used by Lorem Ipsum's primary C2 cluster following the late-May ClickFix pivot. This rule identifies known command and control (C2) infrastructure by matching specific domain names and a UUID-based API endpoint pattern in network connection URLs.
Detects high-entropy algorithmically generated domain names used for C2
This rule detects registry interactions involving the HKCU\Software\Creeper registry key, which is associated with BeepRAT. The malware utilizes this registry path to dynamically retrieve or update its command-and-control (C2) server infrastructure, allowing the attacker to change infrastructure without modifying the embedded implant code.
A node/python/pip-driven package install resolves a domain that Palo Alto classifies as newly-registered within seconds of the install. This signals a potential malicious dependency or compromised package beaconing to attacker infrastructure (supply-chain compromise / install-time C2).
Detects outbound network traffic to specific Hong Kong backend fleet subnets (AS398478) identified as being utilized by the 'Borrowed Trust' threat actor. This infrastructure is used to manage redirection and affiliate attribution for their SEO poisoning campaign.
This rule detects a pattern of dynamic DNS queries that could indicate Command and Control (C2) activity. Specifically, it triggers an alert if a single source IP address makes 50 or more DNS queries within a 60-second window. This high frequency of DNS lookups from a single source is often characteristic of malware attempting to resolve dynamically generated C2 domains.
Detects script engines (wscript.exe, mshta.exe, cscript.exe) making outbound network connections to Cloudflare Workers domains (*.workers.dev). This is a primary C2 channel utilized by Gamaredon for GammaLoad payload delivery and beaconing.
This rule detects DNS queries made to a list of known malicious domains. These domains are often associated with malware command and control (C2) infrastructure or other malicious activities. Monitoring such queries can help identify compromised systems attempting to communicate with adversary-controlled resources.
Detects download of certain file types from hosts with dynamic DNS names (selected list)
Page 2 of 4