Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
77 detections
Filters
Last updated
All Time
Detection languages
44
18
7
3
2
Contributors
35
14
4
4
4
Categories
52
41
24
22
17
Platforms
44
23
5
4
4
Products / Services
44
41
8
6
5
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
25
19
IDS Protocols
21
19
3
1
Detects anomalous network communication patterns and file system changes indicative of SoftEther VPN usage, particularly when linked to processes masquerading as VMware or communicating with known malicious C2 infrastructure. The rule monitors for network connections on common SoftEther ports, connections to specific command-and-control IP addresses, and the creation of SoftEther configuration files like 'hamcore.se2' or 'vpn_bridge.config'.
This rule detects potential command and control (C2) communication over TCP that uses AES encryption with a hardcoded key pattern. It specifically looks for the byte sequence "41 45 53" (which corresponds to the ASCII string "AES") within the payload of a TCP flow from the internal network to any external destination. The rule further refines detection by checking for a payload size between 100 and 500 bytes and applies a threshold of 20 occurrences within 60 seconds from the same source IP to reduce false positives. This pattern is indicative of certain malware families that use predictable AES keying for their C2 channels.
This rule detects HTTP POST requests with a client body that appears to be RC4 symmetric encrypted C2 beacon traffic. It specifically looks for HTTP traffic flowing to the server, with a client body between 100 and 500 bytes in size, and whose content matches a PCRE regex for base64 encoded strings. The rule is thresholded to trigger if 20 such events occur from the same source IP within 60 seconds, indicating potential beaconing activity.
Detects instances of the openssl command-line tool being used to encrypt data with AES-256-CBC and RSA OAEP padding. This specific sequence matches the credential encryption pattern observed in the Linux/macOS payload of the malicious telnyx PyPI package attributed to TeamPCP.
Detects the specific OpenSSL command line arguments used by TeamPCP (Trivy compromise) to encrypt stolen credentials before exfiltration using a hybrid AES-256-CBC scheme. This rule looks for the 'openssl' executable being run with 'enc -aes-256-cbc' or 'enc -aes-256' and a passphrase specified via a file using '-pass file:'.
Detects Sinobi Ransomware (suspected Lynx rebrand) payloads based on specific command-line arguments, help menu strings, ransom note URLs, and references to Curve-25519 and AES-128-CTR encryption routines.
This rule detects attempts to use outdated or weak cryptographic algorithms and protocols by monitoring command-line arguments of common network and cryptographic utilities. Specifically, it looks for the use of RC4, DES, 3DES, RSA1024, MD5 ciphers, or TLS 1.0, TLS 1.1, and SSL 3.0 protocols, as well as the '--insecure' flag, when executed by applications like openssl, gpg, ssh, or curl. This could indicate an adversary attempting to downgrade cryptographic protections to facilitate eavesdropping or other attacks.
Pulsar RAT is a derivative of Quasar RAT with extensive functionality including keylogging, cryptocurrency wallet clipping, credential theft, file management, remote shell execution, and data exfiltration capabilities. As a modular, open-source remote administration tool designed for Windows systems, Pulsar introduces significant enhancements over its predecessor.
Detects the unique User-Agent string "A WinHTTP Example Program/1.0" used by the MuddyViper backdoor for C2 communications, as reported in the MuddyWater campaign.
SesameOP Uses OpenAI Assistants API as a mechanism for command-and-control (C2) communications. Instead of relying on more traditional methods, the threat actor behind this backdoor abuses OpenAI as a C2 channel as a way to stealthily communicate and orchestrate malicious activities within the compromised environment. To do this, a component of the backdoor uses the OpenAI Assistants API as a storage or relay mechanism to fetch commands, which the malware then runs.
This rule detects the Cruloader malware based on specific strings found within its binaries. The first rule, 'Loader_Cruloader_Strings', identifies the malware by looking for an RC4 key, a ROT13 charset, and the string "cruloader" itself. The second rule, 'Loader_Cruloader_Crypto', identifies the malware by looking for specific byte patterns indicative of its cryptographic routines, likely related to its RC4 implementation.
KQL Query from file: Check for Entra Legacy TLS Login
This query checks for network connection failures to Microsoft Defender for Endpoint URLs.
The output includes any device with 1+ connectivity failures, a list of the domains they
failed to connect to (including the number of failures), as well as the overall number of
failures in the time period. Results are sorted by the total number of connection failures
by the device.
The output includes any device with 1+ connectivity failures, a list of the domains they
failed to connect to (including the number of failures), as well as the overall number of
failures in the time period. Results are sorted by the total number of connection failures
by the device.
This rule detects the Voldemort backdoor by identifying specific byte patterns related to its configuration decryption, general decryption algorithm, access token request mechanism, network communication routines, and data download functions from its command and control (C2) server. The rule looks for a combination of these distinct code segments within a Windows executable (MZ header).
Page 4 of 4