Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
This rule detects network traffic patterns associated with the RatHat Android malware. Specifically, it monitors for HTTP requests targeting the '/api/sapp' or '/api/bapp' URIs, which are used by this malware for C2 evasion or to retrieve its block list.
This rule detects network traffic indicative of the HEAVYGRAM malware beaconing to Telegram's API. It identifies HTTP requests to api.telegram.org containing specific URI strings and parameters, which suggests the bot is performing check-in activities or sending status updates via a Telegram bot channel.
Detects network activity associated with the HEAVYGRAM PowerShell implant, specifically identifying outbound traffic to the Telegram Bot API (api.telegram.org). The rule looks for established connections and HTTP requests containing Telegram bot-specific URI patterns ('/bot', '/getUpdates') coupled with a 'WindowsPowerShell' user agent, indicating an automated beaconing mechanism used for command and control.
This rule detects potential exfiltration of sensitive files, specifically 'cert.pem' and 'private.key', via HTTP POST requests to the '/api/adbk/upload' endpoint. This pattern is characteristic of the RatHat malware attempting to exfiltrate device credentials to a Command and Control (C2) server.
This rule detects SQL injection attempts targeting the BuddyBoss members REST endpoint, specifically identifying exploitation patterns associated with the 'sqlmap' tool. The rule monitors for specific URL parameters including 'member_type', 'search_terms', and 'scope' in combination with an 'sqlmap' user-agent, indicating an automated exploitation attempt against the application.
Detects outbound network traffic consistent with the Chisel proxy/tunneling tool establishing a connection to an external VPS associated with the Miku threat actor. The rule monitors for established TCP connections to a specific remote IP address on port 443, utilizing a threshold to reduce noise by ensuring multiple connection attempts occur.
Detects the initialization of an FRP (Fast Reverse Proxy) protocol connection, characterized by a specific 3-byte null sequence followed by the 'frp' string marker in the packet header. This pattern is often associated with the RatHat malware using FRP to establish covert reverse tunnels for command-and-control communication.
This rule detects potential credential exfiltration by the RatHat malware, which attempts to upload 'cert.pem' and 'private.key' files to a remote server using a POST request to '/api/adbk/upload'.
Detects network traffic containing configuration parameters associated with RatHat Android malware (FrpsAddr, FrpsPort, FrpsToken), indicating an attempt to establish a reverse tunnel to a Command and Control server for remote access or proxying.
Detects HTTP GET requests associated with the MovieReaper loader, specifically targeting shellcode fragment fetches from the deadhub.org domain, a specific fallback IP address, or requests to identifiable decoy asset paths used by the malware for staging or C2 communication.
Detects network beaconing and command-and-control (C2) communication patterns consistent with the HEAVYGRAM backdoor, which utilizes the Telegram Bot API for remote interaction. This rule monitors for encrypted SNI traffic directed at api.telegram.org, as well as specific HTTP polling and command execution patterns (e.g., /getUpdates, /bot<token>/) indicating automated interaction with a Telegram bot controlled by an adversary.
This rule detects outbound TLS connections from server-role assets to 'devtunnels.ms', a service that facilitates temporary public tunnels to internal services. This behavior is flagged as a potential indicator of unauthorized command-and-control (C2) tunneling, particularly when originating from critical infrastructure like Domain Controllers or Exchange OWA servers.
This rule detects HTTP requests directed at Microsoft Exchange Outlook Web Access (OWA) that contain suspicious 'fakePath' and 'fakePageName' parameters in the URI. These parameters are indicators of the 'GhostContainer' malware attempting to establish a socket forwarding proxy through the web server to facilitate command and control communications.
Detects anomalous MS_T120 channel binding and MCS handshake patterns characteristic of the BlueKeep (CVE-2019-0708) remote code execution vulnerability in Microsoft RDP services.
Detection rules identifying malformed RDP MCS Connect Initial PDUs and unusual service crashes following RDP connection attempts, both indicative of exploitation attempts against the CVE-2019-0708 (BlueKeep) vulnerability.
Detection of suspicious network traffic directed toward Slack APIs, characterized by the use of hardcoded Slack bot tokens and specific communication patterns associated with the 'indexed-btree' npm malware family, indicating potential C2 communication or data exfiltration.
Detects network traffic associated with the malicious npm package 'indexed-btree', which uses the Telegram Bot API to exfiltrate data. The rules monitor for connections to api.telegram.org via HTTPS and identify specific hardcoded bot tokens and chat IDs associated with the malicious campaign.
Detects network traffic on non-standard ports (excluding port 443) where the TLS Server Name Indication (SNI) field contains 'dl.google.com'. This pattern is frequently observed as a method for C2 tunneling tools like Xray-core to disguise malicious command and control traffic by masquerading as legitimate Google service traffic.
Detects DNS queries, TLS SNI headers, or HTTP Host headers containing patterns consistent with IT-support-themed vishing lure domains, specifically 'helpdesk-support-office-#.com'. Such domains are often used to impersonate technical support services to facilitate social engineering, credential harvesting, or malware delivery.
Detects network traffic attempting to use 'dl.google.com' as the TLS Server Name Indication (SNI) header, which is a common indicator of Xray-core C2 tunneling or obfuscation. This rule identifies traffic attempting to masquerade as legitimate Google traffic and should be correlated with endpoint process information to confirm the initiating process is not a browser or authorized Google-related application.
Detects DNS queries and TLS SNI traffic associated with known authentication-themed lure domains often used in phishing campaigns. These domains mimic multi-factor authentication (MFA) registration or SSO setup processes to deceive users into credential theft.
Page 62 of 124