Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
404 detections
Filters
Last updated
All Time
Detection languages
193
104
95
4
3
Contributors
90
77
62
50
22
Categories
231
151
101
83
77
Platforms
270
109
39
18
9
Products / Services
10,665
9,773
6,704
4,421
3,749
404
MITRE Techniques
138
119
74
64
47
CVEs
4
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
This rule detects HTTP POST requests that exhibit characteristics commonly associated with the Empire post-exploitation framework. Specifically, it looks for a combination of a distinct user-agent string ('Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko') and specific URI paths ('/admin/get.php', '/news.php', '/login/process.php'). This pattern is indicative of an Empire agent communicating with its command and control server.
This rule detects Cobalt Strike Malleable C2 profile patterns by analyzing HTTP proxy logs. It looks for specific User-Agent strings, HTTP methods (GET/POST), URIs, and hostnames that are characteristic of known Cobalt Strike profiles, including those mimicking Amazon, generic browsers, OCSP, and OneDrive traffic. The rule aims to identify command and control communications attempting to blend in with legitimate web traffic.
Detects potential command and control (C2) beaconing activity to domains identified as being used in the 'Operation Triangulation' campaign, which targeted iOS devices with 0-day exploits. This rule specifically looks for connections to a list of known malicious domains via proxy logs.
This rule detects suspicious user agent strings commonly associated with cryptocurrency miners (XMRig and CCMiner) in proxy logs. The presence of these user agents indicates that a system on the network might be infected with mining malware and is attempting to communicate with mining pools or command and control servers.
Detects the download of potentially malicious file types (executables, scripts, documents, archives, etc.) from domains using suspicious or commonly abused Top-Level Domains (TLDs). This rule aims to identify initial access attempts often associated with phishing or drive-by download campaigns.
This rule detects the use of Background Intelligent Transfer Service (BITS) to connect to IP addresses directly, rather than fully qualified domain names (FQDNs). This behavior can be indicative of malicious activity, as adversaries often use BITS for command and control or data transfer, and connecting to IP addresses can be a way to bypass DNS-based security controls or to obscure the true destination.
This rule detects direct access to raw content hosted on various paste services. Adversaries often use these services to host malicious code (e.g., encrypted or encoded payloads) that is downloaded in subsequent stages of an attack, leveraging the services for command and control or defense evasion.
Detects HTTP requests with an empty user agent string in proxy logs. This can indicate an uncommon or potentially malicious request method, as legitimate browsers and many applications typically send a user agent. PowerShell's `(New-Object Net.WebClient).DownloadString` is one example of a tool that might generate such a request.
This rule detects suspicious network requests to the Telegram API (api.telegram.org) that do not include a standard 'Telegram' or 'Bot' user-agent string. This behavior is often indicative of malware or custom tools attempting to use Telegram's API for command and control or data exfiltration without revealing their identity as a legitimate Telegram client or bot.
This rule detects HTTP requests where the User-Agent header contains ' WindowsPowerShell/'. This pattern is indicative of PowerShell making web requests, potentially for downloading files, interacting with web services, or command and control activities. This can be a legitimate administrative activity but is also frequently abused by adversaries.
Detects the default communication pattern used by the BabyShark C2 framework, specifically looking for the 'momyshark?key=' string within the URI of proxy requests. This pattern is indicative of BabyShark malware attempting to communicate with its command and control server.
Detects the use of rclone, a command-line program to manage files on cloud storage, by identifying its default user-agent string in proxy logs. This activity can indicate data exfiltration to cloud storage services.
Detects a unique URL marker '/MSHTML_C7/' used in GET requests, which has been associated with RomCom exploitation attempts, potentially leveraging CVE-2023-36884. This marker is indicative of command and control communication or initial access related to the exploit.
Detects potential C2 communication related to Devil Bait malware by identifying specific URI patterns in GET requests. The rule looks for URIs containing '/cross.php?op=', '&dt=', and '&uid=' which are indicative of Devil Bait's communication with its command and control server.
Detects potential malicious .ICO files downloaded from a compromised 3CXDesktopApp via web requests to a malicious GitHub repository, indicative of the SmoothOperator campaign.
Detects downloads of potentially malicious file types (executables, scripts, documents, archives) from domains that are not common Top-Level Domains (TLDs). This rule aims to identify suspicious file transfers that bypass typical, trusted sources.
This rule detects a specific HTTP GET request pattern associated with potential exploitation of CVE-2023-36884 by the RomCom threat group. The pattern involves a URI containing '/MSHTML_C7/' and a query parameter 'd' followed by an IPv4 address.
Detects potential beaconing activity to known malicious domains associated with the 3CXDesktopApp supply chain compromise. This rule specifically looks for connections through a proxy to a list of hardcoded domains identified as indicators of compromise (IOCs) during the 3CXDesktopApp incident.
Detects a specific URL pattern containing a specific extension and parameters pointing to an IP address. This pattern was seen being used by RomCOM potentially exploiting CVE-2023-36884. The rule looks for GET requests where the URI contains a file extension like .zip, .asp, .htm, .url, .xml, .chm, .mht, .vbs, or .search-ms, followed by '?d=' and an IPv4 address.
Detects HTTP GET requests for specific file paths associated with the RomCom threat actor, potentially exploiting CVE-2023-36884. These file paths include various file types such as .url, .search-ms, .vbs, .mht, and .asp, which are likely used for initial access or further stages of the attack.
Detects the download of executable, script, archive, and document file types from hosts associated with dynamic DNS services. These services are often abused by adversaries for command and control or for hosting malicious content due to their ability to frequently change IP addresses, making them harder to track and block.
Page 19 of 20