Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
140 detections
Filters
Last updated
All Time
Detection languages
71
25
18
10
6
Contributors
41
29
14
12
8
Categories
80
65
36
31
25
Platforms
77
51
16
13
3
Products / Services
70
64
16
11
8
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
CVEs
1
1
IDS Classtypes
40
30
1
IDS Protocols
28
19
19
3
1
This rule detects the execution of known Vidar or SnappyClient loader processes (NeuroManag.exe or VirtualAr.exe) followed by repeated network connections to specific C2 infrastructure IP addresses or common dead-drop resolver services such as Telegram, Steam, or specific attacker-controlled domains. The rule identifies suspicious beaconing behavior following the process launch, indicating active command and control communication.
Detects encrypted WebSocket sessions over non-standard ports or TLS traffic patterns indicative of Bluekit Phishing-as-a-Service (PaaS) session token exfiltration to unauthorized command and control (C2) infrastructure.
Detects network outbound connections to known CDN domains over port 8084. This activity is often associated with the use of specific C2 frameworks (e.g., SNOWLIGHT or VSHELL) that leverage legitimate cloud infrastructure to blend malicious traffic within common CDN communication patterns.
Detects potential Browser-in-the-Middle (BitM) phishing activity by identifying a client browser that fetches the 'rrweb' session-recording library followed by a WebSocket connection to a different origin within 5 minutes. This sequence is indicative of an attacker-controlled browser streaming the victim's DOM and interaction events to a phishing infrastructure.
This rule detects outgoing HTTP POST requests that contain a payload matching the signature of Ousaban malware's custom XOR-encoded command-and-control (C2) traffic, characterized by a specific hexadecimal structure.
Latin American banking trojan using DLL side-loading and overlay attacks
This rule identifies potential Command and Control (C2) beaconing activity by detecting recurring, consistent HTTP(S) requests from internal hosts to unknown or newly seen external destinations, characterized by stable time intervals and low variance in response sizes. The detection logic filters out common User-Agents, indicating non-browser or automated traffic often associated with malware communication.
This rule detects suspicious outbound network connections to specific Fastly CDN IP addresses associated with the Kimsuky threat group's NUKESPED backdoor. The rule identifies processes attempting to communicate with these infrastructure IPs that are not part of a predefined list of trusted or common legitimate applications, indicating potential command and control (C2) activity.
Detects network traffic consistent with the Metasploit Meterpreter reverse HTTPS payload, specifically looking for the default 'CN=metasploit' certificate subject name used by the framework in SSL/TLS handshakes, or connections targeting default Meterpreter ports like 4444.
Detects outbound network communication and DNS queries to cloud service endpoints (Google Cloud Pub/Sub, Azure MQTT, AWS IoT) originated by non-browser and non-cloud processes, which is a technique used by Grandoreiro banking trojan variants that side-load modules to tunnel command-and-control traffic.
This rule detects suspicious network connections, process activity, and file events related to Node.js or systemd-userdbd, potentially indicating C2 communication or the presence of malicious tools. Specifically, it looks for outbound TCP connections to port 4444, process command lines containing shell commands or 'node-pty', and file paths/names associated with 'apintergrationpost' or 'node-pty'.
Detects DbgView.exe, DbgView64.exe, or VirtualBox.exe processes making unexpected outbound network connections to public IP addresses. This behavior is associated with Backdoor.Turn, which is known to inject into these trusted processes via DLL sideloading to communicate with C2 servers, potentially routing traffic through Microsoft Teams TURN relays.
This rule detects processes generating network connections to multiple known malicious ports (4444, 7211, 8000, 8001, 8002, 10000) within a 30-minute window. This behavior is indicative of command and control (C2) beaconing, where a compromised system periodically communicates with a C2 server. The rule is designed to identify a pattern of C2 activity that might be used across different threat campaigns, leveraging ports commonly associated with various C2 frameworks or custom C2 implementations.
Tracks communication from ScreenConnect to attacker infrastructure over non-standard ports (5443/8041). This rule specifically looks for network connections initiated by 'ScreenConnect.ClientService.exe' to remote ports 5443 or 8041, which are associated with the SilentCanvas campaign's encrypted command-and-control communication.
Detects serialized system metadata being transmitted on port 8443 by MsBuild.
This rule detects the creation of the 'class-wc-subscription-diagnostics.php' backdoor file followed by a network connection to the command and control (C2) domain 'generate.2faplugin.org' within a 30-minute window on the same device. This correlation indicates a potential supply chain compromise targeting ShapedPlugin, where backdoored pro plugins are distributed via official channels, leading to 2FA exfiltration.
This rule detects consecutive TLS application data records with 32-byte encrypted payloads. This specific record pattern has been observed during AsyncRAT encrypted communication. The rule is port-independent and serves as a supporting indicator for AsyncRAT activity, rather than a standalone high-confidence signature.
This rule detects network connections initiated by 'bun.exe' to specific IP address ranges (94.154.172.0/24 or 91.195.240.0/24) that have been identified as malicious command and control (C2) infrastructure. This indicates potential compromise of a system where 'bun.exe' is being used for malicious communication.
Detects large HTTPS uploads used for data exfiltration over encrypted channels
This rule detects unusual network beaconing activity from processes. It identifies processes that make more than 50 network connections within a 15-minute window to distinct remote IP addresses and ports, excluding common legitimate processes like svchost.exe, chrome.exe, msedge.exe, and explorer.exe. The rule then enriches this information with the last seen time of the process.
This rule detects suspicious TLS certificates that are self-signed and potentially used for Command and Control (C2) communication. Specifically, it looks for TLS certificates where both the issuer and subject country codes are 'US' and the common name (CN) in the subject field consists of 8 or more hexadecimal characters. This pattern is often observed in malware using dynamically generated self-signed certificates for C2.
Page 5 of 7