Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
77 detections
Filters
Last updated
All Time
Detection languages
44
18
7
3
2
Contributors
35
14
4
4
4
Categories
52
41
24
22
17
Platforms
44
23
5
4
4
Products / Services
44
41
8
6
5
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
25
19
IDS Protocols
21
19
3
1
Detects network traffic between internal hosts and a known malicious IP address on port 5556, characteristic of Go_RAT (hVNC) command and control communication. This rule monitors for established TCP connections to identify potential C2 beaconing or active remote management sessions by the GapiUpdate campaign.
Detects established raw-TCP C2 communication sessions associated with the GapiUpdate Go-based RAT, identifying both known malicious infrastructure and behavioral anomalies characteristic of long-lived, encrypted C2 persistence.
Detects established raw-TCP C2 communication sessions associated with the GapiUpdate Go-based RAT, identifying both known malicious infrastructure and behavioral anomalies characteristic of long-lived, encrypted C2 persistence.
This rule detects network communication associated with the REVSTEALER 'EtherHiding' technique. It monitors for POST requests to Polygon network RPC endpoints containing specific contract interaction signatures ('eth_call' with '0x4965e13f' and a specific contract address), as well as TLS connections to known malicious domains and fallback RPC providers used to resolve C2 instructions from blockchain data.
This rule detects network communication associated with the REVSTEALER 'EtherHiding' technique. It monitors for POST requests to Polygon network RPC endpoints containing specific contract interaction signatures ('eth_call' with '0x4965e13f' and a specific contract address), as well as TLS connections to known malicious domains and fallback RPC providers used to resolve C2 instructions from blockchain data.
Detects outbound HTTP POST requests characterized by an 'application/octet-stream' content type, a specific URI structure consisting of three components (20-40 characters, alpha-numeric, 20-40 characters), and an encrypted payload. This behavioral pattern is associated with SynkLoader malware command-and-control (C2) communications.
This rule detects QUIC network traffic where the TLS certificate subject and issuer match specific patterns associated with 'RAT System' and 'RAT CA'. This signature indicates potential command-and-control (C2) communication utilizing self-signed certificates for authentication pinning in an attempt to masquerade or secure malicious traffic.
Detects the loading of the msaRAT 'lib.dll' malicious module into Google Chrome or Microsoft Edge browser processes. This DLL is used to facilitate encrypted C2 communication, specifically performing ECDH key exchange and ChaCha-Poly1305 encryption on top of WebRTC DataChannel traffic.
Detects network traffic consistent with SynkLoader malware communicating with its C2 infrastructure. The rule identifies suspicious TLS SNI requests to known hardcoded domains and HTTP POST requests using the application/octet-stream content type, which are characteristic of SynkLoader C2 beaconing.
Detects endpoint network connections to the JWR phishing framework's static WebSocket path and worker script, used to carry AES-256-CTR encrypted exfiltration payloads via the JwrCrypto module.
This rule detects potential command and control (C2) beaconing activity associated with the AdaptixC2 framework. It identifies HTTP requests containing a specific 'X-Beacon-Id' header combined with known C2 URI patterns and a specific User-Agent string commonly observed in AdaptixC2 traffic.
This rule detects the initial WebSocket handshake request used by the INTERLOCK NodeSnake RAT for beaconing. It looks for a GET request containing a 'Sec-WebSocket-Key' header and a specific URI pattern (?v=n;) common to the RAT's communication profile.
Detects HTTP POST requests directed to the 'avenger-sync.live' domain by the PamStealer malware. The rule identifies specific C2 or exfiltration traffic patterns, including the '/api/sync' URI and a specific JSON-formatted data envelope in the request body, commonly used by the malware for communication.
Detects outbound network traffic from internal hosts to the domain 'avenger-sync.live' over TLS port 443, which is associated with PamStealer stage-two command and control communication.
Detects the initial handshake communication pattern associated with AsyncRAT, characterized by a specific base64-encoded configuration blob sent to external non-standard ports (6606, 7707, 8808) as identified by the Snort rule logic.
Detects outbound WebSocket connections on common web ports initiated by node.exe that do not originate from standard Node.js installation directories. This behavior is characteristic of the TONResolver RAT, which utilizes AES-256-CBC encrypted communication over WebSockets with a 20-second keepalive interval.
Detects anomalous network communication patterns and file system changes indicative of SoftEther VPN usage, particularly when linked to processes masquerading as VMware or communicating with known malicious C2 infrastructure. The rule monitors for network connections on common SoftEther ports, connections to specific command-and-control IP addresses, and the creation of SoftEther configuration files like 'hamcore.se2' or 'vpn_bridge.config'.
Detects use of export-grade cipher suites to reduce key strength
This rule detects network activity associated with the StealC information stealer, specifically focusing on HTTP POST requests made to known command-and-control (C2) domains. It identifies characteristic URL patterns, such as randomly generated 16-character PHP files or specific index.php structures, which are used for bot registration and communication. The detection includes patterns indicative of RC4-encrypted payloads and behavior mimicking Amadey bot status checks.
Detects the initial handshake communication pattern associated with AsyncRAT, characterized by a specific base64-encoded configuration blob sent to external non-standard ports (6606, 7707, 8808) as identified by the Snort rule logic.
Hunts for PowerShell commands setting up the RijndaelManaged API in ECB mode, a cryptographic pattern used by AsyncRAT for C2 packet encryption.
Page 3 of 4