Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
486 detections
Filters
Last updated
All Time
Detection languages
142
130
119
29
22
Contributors
84
68
57
54
30
Categories
179
153
150
107
91
Platforms
263
161
69
33
10
Products / Services
130
120
72
70
54
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
6
5
4
2
2
IDS Classtypes
66
37
14
9
4
IDS Protocols
37
30
27
14
9
Detects svchost.exe initiating an outbound network connection on TCP port 3389 (RDP) to a loopback address (127.0.0.0/8 or ::1/128). This behavior is indicative of RDP traffic being tunneled, potentially via a reverse SSH tunnel, to bypass network restrictions or for covert remote access.
This rule detects outbound network connections to ngrok tunneling service endpoints. Ngrok is a legitimate tool that can be used to expose local servers to the internet, but it is also frequently leveraged by malicious actors for data exfiltration, command and control, and bypassing network restrictions. Detection of communication to these specific ngrok domains could indicate unauthorized use of the service for malicious purposes.
Detects instances where the svchost.exe process, specifically hosting the RDP terminal services, initiates outbound network connections to target systems on standard HTTP (TCP port 80) or HTTPS (TCP port 443) ports. This behavior is indicative of RDP tunneling, where RDP traffic is encapsulated within web protocols to bypass network restrictions or evade detection.
This rule detects the execution of 'ssh.exe' with command-line arguments indicating RDP port forwarding (tunneling). Specifically, it looks for the presence of ':3389' in the command line, which is the default port for RDP. This activity can be used by adversaries to establish a tunnel for remote access, bypassing network restrictions and potentially exfiltrating data.
Detects the execution of '3proxy.exe', a tiny free proxy server, based on its image name, description, or specific command-line parameters. This tool can be used by adversaries for command and control activities, specifically for proxying network traffic.
Detects the execution of known tunneling and exfiltration tools such as httptunnel, plink, socat, and stunnel. These tools can be abused by adversaries to establish covert communication channels, bypass network restrictions, and exfiltrate data from compromised systems.
Detects the presence of Silence EmpireDNSAgent by looking for specific PowerShell script block text patterns associated with both the Empire post-exploitation framework and Dnscat2 tunneling. The rule combines keywords related to system shutdown/reboot, process manipulation, and DNS tunneling techniques used by this malware.
This rule detects the execution of 'plink.exe' with command-line arguments indicative of RDP tunneling. Specifically, it looks for 'plink.exe' combined with ':127.0.0.1:3389' or ':3389' along with '-P 443' or '-P 22'. This activity suggests an adversary is using Plink to establish a tunnel, potentially to exfiltrate data or maintain covert access to a remote desktop session.
This rule detects the potential use of an SSH utility to establish Remote Desktop Protocol (RDP) over a reverse SSH Tunnel. Attackers commonly use this technique to enable routing of network packets that would otherwise not reach their intended destination, bypassing network segmentation or firewalls. The detection logic looks for command-line arguments containing the RDP port ':3389' in conjunction with common SSH tunneling switches such as '-L', '-P', '-R', '-pw', or '-ssh'.
This rule detects the installation of a TAP (Tunnel Adapter) driver, specifically looking for 'tap0901' in the service's ImagePath. TAP drivers are commonly used by VPN software like OpenVPN to create virtual network interfaces, which can be leveraged for tunneling and data exfiltration. The detection aims to identify potential preparation for data exfiltration using tunneling techniques.
Detects the use of Plink (PuTTY Link) for suspicious remote port forwarding to a local port. This technique can be used by adversaries to bypass network restrictions and establish tunnels for command and control or data exfiltration.
Detects the execution of Ngrok, a legitimate utility often abused by threat actors for port forwarding and tunneling. This allows them to expose local services to the internet, bypassing firewalls and network restrictions. The rule specifically looks for common command-line arguments used with Ngrok, such as those for tunneling specific TCP ports (e.g., 139, 445, 3389, 5985, 5986), HTTP services, or configuration file usage.
Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
This rule detects the execution of the `netsh.exe` utility to configure a port forwarding rule specifically for RDP (port 3389). This technique can be used by adversaries to bypass network restrictions and establish RDP tunnels for lateral movement or command and control.
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects suspicious Plink tunnel port forwarding to a local port
Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443
Detects Silence EmpireDNSAgent as described in the Group-IP report
Execution of plink to perform data exfiltration and tunneling
Page 23 of 24