Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
140 detections
Filters
Last updated
All Time
Detection languages
41
40
21
13
9
Contributors
36
22
20
9
8
Categories
91
45
32
19
16
Platforms
67
53
21
11
3
Products / Services
39
34
30
18
11
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
1
IDS Classtypes
19
16
4
1
1
IDS Protocols
25
8
6
1
1
Detects network connections to the primary C2 IP and port (103.106.67.63:1244) used across all modules of the StegaBin infostealer toolkit. This specific IP and port combination is highly indicative of StegaBin activity.
Detects the creation of the covert socket file '/home/runtime/tmp/.logsrv', which is used by the RESURGE malware as a communication bridge between its hooked 'web' process and its 'dsmdm' SSH component on Ivanti Connect Secure devices.
This rule detects suspicious processes (e.g., powershell.exe, cmd.exe, mshta.exe) making outbound network connections to public IP addresses on non-standard ports. This behavior can indicate command and control (C2) communication or data exfiltration attempts, as adversaries often use non-standard ports to evade detection.
This detection identifies outbound network traffic to domains, IP addresses, or a specific port known to be associated with the PHALT#BLYX campaign's infrastructure. The campaign uses these for malware delivery and DCRat command and control (C2). The rule specifically looks for connections to known malicious IPs or domains, or connections on port 3535 (used by DCRat) originating from processes associated with the malware (staxs.exe, tybd7.exe, aspnet_compiler.exe).
Detects outbound network connections to a known PCPcat C2 server IP address on specific ports used for API communication, reverse tunneling, and payload distribution. This rule identifies potential command and control activity and data exfiltration attempts by monitoring network traffic to a hardcoded malicious IP and associated non-standard ports.
This rule detects the use of common file transfer and remote access protocols (SSH, FTP, SMB, TELNET, FTPS, SMB.v3) communicating over non-standard ports. Adversaries often use non-standard ports to bypass firewall rules, evade detection, or obscure their command and control (C2) traffic. The rule specifically excludes the standard ports for these protocols to focus on anomalous behavior.
This detection identifies Command and Control (C2) communication associated with the FormBook RAT, specifically targeting connections to a known malicious IP address and dynamic DNS domain on an unusual port. Detecting C2 activity is crucial for identifying active compromises and preventing data exfiltration or further malicious commands.
This rule is a valid AWS Network Firewall configuration enforcing standard port/protocol usage for SSH traffic to maintain network hygiene and detect anomalies.
This rule enforces standard port/protocol alignment for TLS traffic to detect anomalies and maintain network hygiene using AWS Network Firewall. The rule is valid.
This rule enforces port/protocol alignment for HTTP traffic using AWS Network Firewall, blocking TCP port 80 traffic that is not HTTP and vice versa, to maintain network hygiene and detect anomalies. The rule is valid.
The analytic detects outbound network connections from an endpoint process to suspicious or non-standard ports. It uses Cisco Network Visibility Module flow data to identify processes communicating over ports like 4444, 2222, or 51820, which are commonly associated with tools such as Metasploit, SliverC2, other penetration testing tools, red team activities, or malware. These connections warrant further investigation, especially when initiated by unexpected or non-network-native binaries.
Detects the RustDoor malware for macOS. This backdoor, written in Rust, is used by North Korean threat actors to target software developers in the cryptocurrency sector. It often masquerades as a legitimate software update or component.
The following analytic detects modifications to the registry that enable RDP on a machine using a non-default port number. It leverages data from the Endpoint.Registry data model, specifically monitoring changes to the registry path "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" and the "PortNumber" value. This activity is significant as attackers often modify RDP settings to facilitate lateral movement and maintain remote access to compromised systems. If confirmed malicious, this could allow attackers to bypass network defenses, gain persistent access, and potentially control the compromised machine.
KQL Query from file: Mitigating security risks in MCP implementations
SPL Query from file: Beavertail Exfiltration over TCP
'Identifies patterns in the time deltas of contacts between internal and external IPs in Fortinet network data that are consistent with beaconing.
Accounts for randomness (jitter) and seasonality such as working hours that may have been introduced into the beacon pattern.
The lookback is set to 1d, the minimum granularity in time deltas is set to 60 seconds and the minimum number of beacons required to emit a detection is set to 4.
Increase the lookback period to capture beacons with larger periodicities.
The jitter tolerance is set to 0.2 - This means we account for an overall 20% deviation from the infered beacon periodicity. Seasonality is dealt with automatically using series_outliers.
Note: In large environments it may be necessary to reduce the lookback period to get fast query times.'
Accounts for randomness (jitter) and seasonality such as working hours that may have been introduced into the beacon pattern.
The lookback is set to 1d, the minimum granularity in time deltas is set to 60 seconds and the minimum number of beacons required to emit a detection is set to 4.
Increase the lookback period to capture beacons with larger periodicities.
The jitter tolerance is set to 0.2 - This means we account for an overall 20% deviation from the infered beacon periodicity. Seasonality is dealt with automatically using series_outliers.
Note: In large environments it may be necessary to reduce the lookback period to get fast query times.'
In this detection,we hunt for any sign-in attempt from a non-managed, non-compliant, untrusted device.
Detects programs that connect to uncommon destination ports
Adversaries may communicate using a protocol and port paring that are typically not associated.
For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443.
For example, HTTPS over port 8088(Citation: Symantec Elfin Mar 2019) or port 587(Citation: Fortinet Agent Tesla April 2018) as opposed to the traditional port 443.
Adversaries can migrate cobalt strike/metasploit/C2 beacons on compromised systems to legitimate werfault.exe process to avoid detection.
Detects programs that connect to uncommon destination ports
Page 6 of 7