Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
1
1
1
Contributors
1
1
1
Categories
2
1
1
1
1
Platforms
2
1
Products / Services
1
1
1
1
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
IDS Classtypes
1
IDS Protocols
1
Detects outbound network connections from internal hosts to known Autonomous System Numbers (ASNs) associated with SilkParasite infrastructure, which are often used to host malicious command-and-control or staging assets.
This rule detects HTTP requests to known dedicated server rental providers (ovh.com, leaseweb.com, servermania.com) where the URI contains the word 'order'. This activity could indicate an adversary attempting to rent infrastructure for attack purposes, such as command and control servers, phishing sites, or other malicious operations.
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_babyshark.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
