Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
140 detections
Filters
Last updated
All Time
Detection languages
71
25
18
10
6
Contributors
41
29
14
12
8
Categories
80
65
36
31
25
Platforms
77
51
16
13
3
Products / Services
70
64
16
11
8
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
1
1
IDS Classtypes
40
30
1
IDS Protocols
28
19
19
3
1
This detection identifies outbound IPv4 and IPv6 network connections to non-standard ports that may indicate suspicious network activity, unauthorized communication, or potential command-and-control (C2) traffic.
It excludes commonly used ports for DNS (53), HTTP (80), HTTPS (443), and alternate web services (8000, 8080), along with private, loopback, link-local, multicast, and documentation-only IP ranges to reduce noise.
It excludes commonly used ports for DNS (53), HTTP (80), HTTPS (443), and alternate web services (8000, 8080), along with private, loopback, link-local, multicast, and documentation-only IP ranges to reduce noise.
Detects potential Cobalt Strike or Sliver command and control (C2) beaconing behavior by analyzing network proxy, firewall, and flow logs for common C2 URI patterns, known malicious JA3/JA3S TLS fingerprints, and consistent periodic communication intervals (low jitter) characteristic of automated beacons.
Detects periodic network connection patterns indicative of Cobalt Strike beaconing. The rule identifies low-variance jittered traffic, where the communication interval remains relatively consistent over a defined period, consistent with default Cobalt Strike malleable C2 profiles.
Detects network activity associated with the NeedyMantis malware command and control (C2), including DNS queries for the domain corp.tripswithengine.com, TLS SNI identification, and specific HTTP beaconing patterns to /library/zip/ with a hardcoded user agent.
Detects network activity associated with SectopRAT malware. The rule identifies C2 beaconing behavior on a non-standard port using a custom protocol with a specific 5-byte length header and 16-byte initialization vector, filtering out standard HTTP/TLS traffic.
Detects outbound network traffic exhibiting the default self-signed TLS certificate subject and issuer fields 'O=Cobalt Strike' combined with the known default JA3 fingerprint '72a589da586844d7f0818ce684948eea' associated with Cobalt Strike C2 communication.
Detects the NeedyMantis main-component handshake: an HTTP GET to port 443 with a User-Agent that is EXACTLY the hard-coded literal 'firefox/21.0' (anchored start+end) and an explicit 'Upgrade: websocket' header, marking the HTTPS-to-WebSocket protocol switch used before the RC4 key exchange. Restricting to port 443 and requiring an exact (not substring) UA match removes generic WebSocket apps and any traffic where 'firefox/21.0' merely appears inside a real, longer browser UA string.
Detects the NeedyMantis main-component handshake: an HTTP GET to port 443 with a User-Agent that is EXACTLY the hard-coded literal 'firefox/21.0' (anchored start+end) and an explicit 'Upgrade: websocket' header, marking the HTTPS-to-WebSocket protocol switch used before the RC4 key exchange. Restricting to port 443 and requiring an exact (not substring) UA match removes generic WebSocket apps and any traffic where 'firefox/21.0' merely appears inside a real, longer browser UA string.
Detects the NeedyMantis main-component handshake: an HTTP GET to port 443 with a User-Agent that is EXACTLY the hard-coded literal 'firefox/21.0' (anchored start+end) and an explicit 'Upgrade: websocket' header, marking the HTTPS-to-WebSocket protocol switch used before the RC4 key exchange. Restricting to port 443 and requiring an exact (not substring) UA match removes generic WebSocket apps and any traffic where 'firefox/21.0' merely appears inside a real, longer browser UA string.
Detects network activity (DNS, TLS, HTTP) associated with suspected C2 infrastructure hosted on Cloudflare Workers, specifically identifying patterns consistent with trojanized authentication pages acting as browser-based C2 relays or WebRTC/WebSocket signaling channels.
Detects the creation or connection of named pipes that match known default and common malleable C2 profile patterns used by the Cobalt Strike post-exploitation framework. These named pipes are frequently utilized by Cobalt Strike beacons for inter-process communication, SMB/TCP beacon functionality, and staging during post-exploitation activities.
Detects anomalous HTTP POST requests to a suspected C2 endpoint ('/beacon/pre-register') on a typosquatted domain ('thecovnresation') characterized by an application/octet-stream content type, which is indicative of encrypted C2 beacon registration activity.
Detects instances where PowerShell scripts perform Base64-encoded operations related to cryptographic functions and shortly thereafter establish network connections to known or suspect domains associated with C2 activity.
Detects network beaconing and command-and-control (C2) communication patterns associated with the RatHat Android malware family. The rule identifies registration, shell command check-ins, heartbeat signals, and task fetching activity over HTTP. It uses stateful inspection (flowbits) to correlate device registration with subsequent heartbeat behavior to improve detection fidelity.
Detects Xray-core C2 tunnel traffic where the TLS SNI is spoofed to appear as 'dl.google.com'. The detection specifically looks for this behavior originating from non-browser processes such as 'wkspbroker.exe' or 'radcui.dll', which is indicative of malicious tunneling activity.
Detects the NeedyMantis main-component handshake: an HTTP GET to port 443 with a User-Agent that is EXACTLY the hard-coded literal 'firefox/21.0' (anchored start+end) and an explicit 'Upgrade: websocket' header, marking the HTTPS-to-WebSocket protocol switch used before the RC4 key exchange. Restricting to port 443 and requiring an exact (not substring) UA match removes generic WebSocket apps and any traffic where 'firefox/21.0' merely appears inside a real, longer browser UA string.
Detects network communication associated with the SectopRAT/ArechClient2 remote access trojan, specifically identifying its characteristic length-prefixed, AES-encrypted command-and-control handshake on non-standard ports. The rule matches traffic containing a specific length-prefixed packet structure starting with null bytes, typically seen during C2 check-in.
This rule detects network traffic patterns indicative of Xray-core C2 tunnels using a spoofed 'dl.google.com' TLS SNI value. This activity is associated with the Aur0ra/Black Basta playbook, where Xray-core is sideloaded into legitimate processes to exfiltrate or tunnel traffic while mimicking Chrome browser TLS behavior.
Detects network traffic consistent with PIVOTPIPE command-and-control activity and potential Cobalt Strike beaconing to known malicious infrastructure on specific ports.
Detects outbound TCP traffic originating from the internal network destined for a known malicious IP associated with Meterpreter Java payload retrieval and post-exploitation Command and Control (C2) activity, potentially related to PaperCut vulnerability exploitation.
Detects network beaconing activity associated with the Sauron Loader malware. The rule monitors HTTPS traffic for specific domain patterns and suspicious TLV (Type-Length-Value) protocol structures, as well as recurring beaconing cadence to identified C2 infrastructure.
Page 1 of 7