Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
77 detections
Filters
Last updated
All Time
Detection languages
44
18
7
3
2
Contributors
35
14
4
4
4
Categories
52
41
24
22
17
Platforms
44
23
5
4
4
Products / Services
44
41
8
6
5
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
25
19
IDS Protocols
21
19
3
1
Detects Sauron Loader C2 registration/polling: an HTTPS POST whose URI path matches the malware's exact <prefix>/v<1-9>/<action><Resource> structure (action = set|get; resource = one of the 10 known config/task resource names) combined with the malware's hardcoded Windows-10 Edge/Chrome 143 user agent. Narrowing the URI regex from a generic '/api/v1/anything' wildcard to the exact action+resource vocabulary eliminates matches against ordinary versioned REST API traffic, which was the dominant false-positive source.
Detects Sauron Loader C2 registration/polling: an HTTPS POST whose URI path matches the malware's exact <prefix>/v<1-9>/<action><Resource> structure (action = set|get; resource = one of the 10 known config/task resource names) combined with the malware's hardcoded Windows-10 Edge/Chrome 143 user agent. Narrowing the URI regex from a generic '/api/v1/anything' wildcard to the exact action+resource vocabulary eliminates matches against ordinary versioned REST API traffic, which was the dominant false-positive source.
Detects outbound network traffic matching known SectopRAT C2 patterns. The rule monitors for established TCP connections to a specific malicious IP address with a payload size exceeding 300 bytes, consistent with the exfiltration of AES-encrypted JSON credential or wallet data. It includes threshold logic to limit alerts to once per source IP every 60 seconds.
Detects outbound network traffic matching known SectopRAT C2 patterns. The rule monitors for established TCP connections to a specific malicious IP address with a payload size exceeding 300 bytes, consistent with the exfiltration of AES-encrypted JSON credential or wallet data. It includes threshold logic to limit alerts to once per source IP every 60 seconds.
Detects outbound network traffic matching known SectopRAT C2 patterns. The rule monitors for established TCP connections to a specific malicious IP address with a payload size exceeding 300 bytes, consistent with the exfiltration of AES-encrypted JSON credential or wallet data. It includes threshold logic to limit alerts to once per source IP every 60 seconds.
Detects outbound network traffic matching known SectopRAT C2 patterns. The rule monitors for established TCP connections to a specific malicious IP address with a payload size exceeding 300 bytes, consistent with the exfiltration of AES-encrypted JSON credential or wallet data. It includes threshold logic to limit alerts to once per source IP every 60 seconds.
Detects outbound HTTP POST requests directed at a known StealC command-and-control IP address. The rule identifies suspicious beaconing behavior by looking for POST requests that lack a standard User-Agent, do not utilize common HTTP content types, and contain a request body exceeding 16 bytes, suggesting custom binary protocol usage.
Detects outbound HTTP POST requests directed at a known StealC command-and-control IP address. The rule identifies suspicious beaconing behavior by looking for POST requests that lack a standard User-Agent, do not utilize common HTTP content types, and contain a request body exceeding 16 bytes, suggesting custom binary protocol usage.
Detects Koktevrat Stage 2 Android RAT component (com.kowo.ciligeci) that unpacks the RC4-encrypted uoN.css/uoN.apk payload using the RC4 key iOZ
Detects Koktevrat Stage 2 Android RAT component (com.kowo.ciligeci) that unpacks the RC4-encrypted uoN.css/uoN.apk payload using the RC4 key iOZ
This rule detects network traffic containing the 'HCENC1' signature prefix within the payload, which is associated with the RUSTYSHADE malware family. This pattern indicates an encrypted communication channel used for command and control (C2) purposes.
This rule detects network traffic containing the 'HCENC1' signature prefix within the payload, which is associated with the RUSTYSHADE malware family. This pattern indicates an encrypted communication channel used for command and control (C2) purposes.
Detects Koktevrat Stage 2 Android RAT component (com.kowo.ciligeci) that unpacks the RC4-encrypted uoN.css/uoN.apk payload using the RC4 key iOZ
Detects outbound HTTP POST requests directed at a known StealC command-and-control IP address. The rule identifies suspicious beaconing behavior by looking for POST requests that lack a standard User-Agent, do not utilize common HTTP content types, and contain a request body exceeding 16 bytes, suggesting custom binary protocol usage.
Detects outbound HTTP POST requests directed at a known StealC command-and-control IP address. The rule identifies suspicious beaconing behavior by looking for POST requests that lack a standard User-Agent, do not utilize common HTTP content types, and contain a request body exceeding 16 bytes, suggesting custom binary protocol usage.
Detects network traffic between internal hosts and a known malicious IP address on port 5556, characteristic of Go_RAT (hVNC) command and control communication. This rule monitors for established TCP connections to identify potential C2 beaconing or active remote management sessions by the GapiUpdate campaign.
Detects established raw-TCP C2 communication sessions associated with the GapiUpdate Go-based RAT, identifying both known malicious infrastructure and behavioral anomalies characteristic of long-lived, encrypted C2 persistence.
Detects established raw-TCP C2 communication sessions associated with the GapiUpdate Go-based RAT, identifying both known malicious infrastructure and behavioral anomalies characteristic of long-lived, encrypted C2 persistence.
Detects Koktevrat Stage 2 Android RAT component (com.kowo.ciligeci) that unpacks the RC4-encrypted uoN.css/uoN.apk payload using the RC4 key iOZ
Detects network traffic between internal hosts and a known malicious IP address on port 5556, characteristic of Go_RAT (hVNC) command and control communication. This rule monitors for established TCP connections to identify potential C2 beaconing or active remote management sessions by the GapiUpdate campaign.
Detects network traffic between internal hosts and a known malicious IP address on port 5556, characteristic of Go_RAT (hVNC) command and control communication. This rule monitors for established TCP connections to identify potential C2 beaconing or active remote management sessions by the GapiUpdate campaign.
Page 2 of 4