Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
75 detections
Filters
Last updated
All Time
Detection languages
31
24
6
5
5
Contributors
20
10
9
7
6
Categories
40
29
27
25
10
Platforms
40
30
7
6
2
Products / Services
30
27
16
6
4
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
16
15
IDS Protocols
19
5
3
2
1
The following analytic detects the use of known suspicious SSL certificates in any observed event where the SSL_CertFingerprint field is present. It leverages Cisco Secure Firewall logs and compares the SSL certificate SHA1 fingerprint against a blacklist of certificates associated with malware distribution, command and control (C2) infrastructure, or phishing campaigns. This activity is significant as adversaries often reuse or self-sign certificates across malicious infrastructure, allowing defenders to track and detect encrypted sessions even when domains or IPs change. If confirmed malicious, this may indicate beaconing, malware download, or data exfiltration over TLS/SSL.
This analytic detects intrusion events from known threat activity using Cisco Secure Firewall Intrusion Events.
It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where one or multiple Snort signatures
associated with a known threat or threat actor activity have been triggered within a one-hour time window. The detection uses a
lookup table (cisco_snort_ids_to_threat_mapping) to map Snort signature IDs to known threat actors and their techniques.
When multiple signatures associated with the same threat actor are triggered within the time window, and the count of
unique signatures matches or exceeds the expected number of signatures for that threat technique, an alert is generated.
This helps identify potential coordinated threat activity in your network environment by correlating related intrusion
events that occur in close temporal proximity.
Currently, this detection will alert on the following threat actors or malware families as defined in the cisco_snort_ids_to_threat_mapping lookup:
* AgentTesla
* Amadey
* ArcaneDoor
* AsyncRAT
* CastleRAT
* Chafer
* DCRAT
* LokiBot
* Lumma Stealer
* Nobelium
* Quasar
* Remcos
* Snake
* Static Tundra
* Xworm
To add or update threat actors, update the cisco_snort_ids_to_threat_mapping.csv lookup file with new or modified threat names and associated Snort signature IDs.
It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where one or multiple Snort signatures
associated with a known threat or threat actor activity have been triggered within a one-hour time window. The detection uses a
lookup table (cisco_snort_ids_to_threat_mapping) to map Snort signature IDs to known threat actors and their techniques.
When multiple signatures associated with the same threat actor are triggered within the time window, and the count of
unique signatures matches or exceeds the expected number of signatures for that threat technique, an alert is generated.
This helps identify potential coordinated threat activity in your network environment by correlating related intrusion
events that occur in close temporal proximity.
Currently, this detection will alert on the following threat actors or malware families as defined in the cisco_snort_ids_to_threat_mapping lookup:
* AgentTesla
* Amadey
* ArcaneDoor
* AsyncRAT
* CastleRAT
* Chafer
* DCRAT
* LokiBot
* Lumma Stealer
* Nobelium
* Quasar
* Remcos
* Snake
* Static Tundra
* Xworm
To add or update threat actors, update the cisco_snort_ids_to_threat_mapping.csv lookup file with new or modified threat names and associated Snort signature IDs.
Detects incoming TLS traffic from an external network where the TLS server certificate's Subject Common Name (CN) field matches 'AsyncRAT Server'. This pattern is a known indicator of a beaconing session initiated by AsyncRAT remote access trojan servers.
Detects network connections originating from or connecting to hosts that utilize known Cobalt Strike default JA3 or JA3S TLS fingerprints. These fingerprints are indicative of Cobalt Strike's default beacon communication patterns.
This rule detects network communication (DNS queries and TLS connections) to known actor-controlled Slack workspace subdomains, as well as the presence of a specific hardcoded public key in Slack API traffic, suggesting the use of Slack as a Command and Control (C2) channel.
Detects DNS lookup queries and HTTP POST beaconing attempts directed at known Sauron Loader C2 fallback infrastructure. The rule tracks specific domains associated with the malware's encrypted registration and command-and-control behavior.
Detects DNS lookup queries and HTTP POST beaconing attempts directed at known Sauron Loader C2 fallback infrastructure. The rule tracks specific domains associated with the malware's encrypted registration and command-and-control behavior.
Detects DNS queries and TLS SNI traffic directed towards known domain names associated with the Sauron Loader command-and-control infrastructure. This rule identifies outbound communication attempts using hardcoded beaconing domains.
Detects outbound network traffic from internal hosts to known domains associated with the Sauron Loader malware family. These alerts monitor for TLS connections where the Server Name Indication (SNI) matches domains identified as part of the malware's C2 infrastructure.
Detects the presence of a hardcoded X25519 public key associated with the 'indexed-btree' npm malware loader. This loader uses the key for ECDH key derivation to decrypt secondary payloads retrieved from an Ethereum smart contract, a technique used by malicious packages to hide their functionality.
Detects Sauron Loader C2 registration/polling: an HTTPS POST whose URI path matches the malware's exact <prefix>/v<1-9>/<action><Resource> structure (action = set|get; resource = one of the 10 known config/task resource names) combined with the malware's hardcoded Windows-10 Edge/Chrome 143 user agent. Narrowing the URI regex from a generic '/api/v1/anything' wildcard to the exact action+resource vocabulary eliminates matches against ordinary versioned REST API traffic, which was the dominant false-positive source.
Detects Sauron Loader C2 registration/polling: an HTTPS POST whose URI path matches the malware's exact <prefix>/v<1-9>/<action><Resource> structure (action = set|get; resource = one of the 10 known config/task resource names) combined with the malware's hardcoded Windows-10 Edge/Chrome 143 user agent. Narrowing the URI regex from a generic '/api/v1/anything' wildcard to the exact action+resource vocabulary eliminates matches against ordinary versioned REST API traffic, which was the dominant false-positive source.
Detects Sauron Loader C2 registration/polling: an HTTPS POST whose URI path matches the malware's exact <prefix>/v<1-9>/<action><Resource> structure (action = set|get; resource = one of the 10 known config/task resource names) combined with the malware's hardcoded Windows-10 Edge/Chrome 143 user agent. Narrowing the URI regex from a generic '/api/v1/anything' wildcard to the exact action+resource vocabulary eliminates matches against ordinary versioned REST API traffic, which was the dominant false-positive source.
Detects Sauron Loader C2 registration/polling: an HTTPS POST whose URI path matches the malware's exact <prefix>/v<1-9>/<action><Resource> structure (action = set|get; resource = one of the 10 known config/task resource names) combined with the malware's hardcoded Windows-10 Edge/Chrome 143 user agent. Narrowing the URI regex from a generic '/api/v1/anything' wildcard to the exact action+resource vocabulary eliminates matches against ordinary versioned REST API traffic, which was the dominant false-positive source.
Detects network traffic attempting to impersonate the Uzbekistan railway authority via suspicious TLS certificates. The rules identify specific SNI domains, certificate subjects, and issuers associated with the 'SilkParasite' campaign, which uses Chinese state-affiliated certificate authorities to facilitate C2 communications.
Detects network activity associated with the SilkParasite C2 infrastructure (used by SpiceRAT and NodeEdgeRAT malware). The rule monitors for specific impersonated TLS certificates, known malicious IP addresses, and unique JA4X TLS fingerprints associated with these threat actors.
Detects network activity associated with the QUICAgent backdoor, including QUIC C2 traffic using a self-signed 'RAT System' certificate, direct connections to a known C2 IP address (104.64.211.22), and DNS queries for the hardcoded C2 domain 'register.mediumser.com'.
Detects command-and-control (C2) communication patterns associated with the Graphalgo framework, which utilizes the Arbitrum Sepolia blockchain for dead-drop resolution and task orchestration. The rules monitor for specific JSON-RPC method calls ('eth_call', 'setCPubKey') and repeated polling of contract functions ('serviceData') characteristic of this threat actor's network behavior.
Detects network traffic attempting to use 'dl.google.com' as the TLS Server Name Indication (SNI) header, which is a common indicator of Xray-core C2 tunneling or obfuscation. This rule identifies traffic attempting to masquerade as legitimate Google traffic and should be correlated with endpoint process information to confirm the initiating process is not a browser or authorized Google-related application.
Detects outbound network traffic (TCP and TLS) from internal hosts to known command and control (C2) infrastructure associated with the FamousSparrow threat actor and their SparroWocky malware suite.
Detects network communication to known malicious infrastructure associated with the SparroWocky malware, often used by the FamousSparrow threat actor. The rule monitors for established TCP or TLS-encrypted connections on ports 443 and 8080 directed toward specific IP addresses identified as part of the C2 infrastructure.
Page 1 of 4