Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
168 detections
Filters
Last updated
All Time
Detection languages
87
52
26
1
1
Contributors
44
38
21
15
10
Categories
88
69
30
24
19
Platforms
106
35
24
4
4
Products / Services
10,660
9,755
6,689
4,418
3,748
MITRE Techniques
59
49
36
35
24
CVEs
3
2
2
2
1
Detects HTTP requests to URIs ending with the ".class" extension. This can indicate attempts to download Java classes, potentially as part of exploitation attacks such as Log4shell against Log4j vulnerabilities. This rule is useful for threat hunting to identify such activities.
Detects potential Command and Control (C2) communication associated with the Small Sieve malware. This rule specifically looks for HTTP GET requests to 'api.telegram.org' with a specific chat_id and 'text=com/' in the URI, which are indicators of Small Sieve's use of the Telegram Bot API for C2.
This rule detects HTTP POST requests that exhibit characteristics commonly associated with the Empire post-exploitation framework. Specifically, it looks for a combination of a distinct user-agent string ('Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko') and specific URI paths ('/admin/get.php', '/news.php', '/login/process.php'). This pattern is indicative of an Empire agent communicating with its command and control server.
This rule detects Cobalt Strike Malleable C2 profile patterns by analyzing HTTP proxy logs. It looks for specific User-Agent strings, HTTP methods (GET/POST), URIs, and hostnames that are characteristic of known Cobalt Strike profiles, including those mimicking Amazon, generic browsers, OCSP, and OneDrive traffic. The rule aims to identify command and control communications attempting to blend in with legitimate web traffic.
Detects potential command and control (C2) beaconing activity to domains identified as being used in the 'Operation Triangulation' campaign, which targeted iOS devices with 0-day exploits. This rule specifically looks for connections to a list of known malicious domains via proxy logs.
This rule detects suspicious user agent strings commonly associated with cryptocurrency miners (XMRig and CCMiner) in proxy logs. The presence of these user agents indicates that a system on the network might be infected with mining malware and is attempting to communicate with mining pools or command and control servers.
This rule detects the use of Background Intelligent Transfer Service (BITS) to connect to IP addresses directly, rather than fully qualified domain names (FQDNs). This behavior can be indicative of malicious activity, as adversaries often use BITS for command and control or data transfer, and connecting to IP addresses can be a way to bypass DNS-based security controls or to obscure the true destination.
This rule detects direct access to raw content hosted on various paste services. Adversaries often use these services to host malicious code (e.g., encrypted or encoded payloads) that is downloaded in subsequent stages of an attack, leveraging the services for command and control or defense evasion.
Detects HTTP requests with an empty user agent string in proxy logs. This can indicate an uncommon or potentially malicious request method, as legitimate browsers and many applications typically send a user agent. PowerShell's `(New-Object Net.WebClient).DownloadString` is one example of a tool that might generate such a request.
This rule detects suspicious network requests to the Telegram API (api.telegram.org) that do not include a standard 'Telegram' or 'Bot' user-agent string. This behavior is often indicative of malware or custom tools attempting to use Telegram's API for command and control or data exfiltration without revealing their identity as a legitimate Telegram client or bot.
This rule detects HTTP requests where the User-Agent header contains ' WindowsPowerShell/'. This pattern is indicative of PowerShell making web requests, potentially for downloading files, interacting with web services, or command and control activities. This can be a legitimate administrative activity but is also frequently abused by adversaries.
Detects the default communication pattern used by the BabyShark C2 framework, specifically looking for the 'momyshark?key=' string within the URI of proxy requests. This pattern is indicative of BabyShark malware attempting to communicate with its command and control server.
Detects the use of rclone, a command-line program to manage files on cloud storage, by identifying its default user-agent string in proxy logs. This activity can indicate data exfiltration to cloud storage services.
Detects a unique URL marker '/MSHTML_C7/' used in GET requests, which has been associated with RomCom exploitation attempts, potentially leveraging CVE-2023-36884. This marker is indicative of command and control communication or initial access related to the exploit.
Detects potential C2 communication related to Devil Bait malware by identifying specific URI patterns in GET requests. The rule looks for URIs containing '/cross.php?op=', '&dt=', and '&uid=' which are indicative of Devil Bait's communication with its command and control server.
Detects potential malicious .ICO files downloaded from a compromised 3CXDesktopApp via web requests to a malicious GitHub repository, indicative of the SmoothOperator campaign.
This rule detects a specific HTTP GET request pattern associated with potential exploitation of CVE-2023-36884 by the RomCom threat group. The pattern involves a URI containing '/MSHTML_C7/' and a query parameter 'd' followed by an IPv4 address.
Detects HTTP GET requests for specific file paths associated with the RomCom threat actor, potentially exploiting CVE-2023-36884. These file paths include various file types such as .url, .search-ms, .vbs, .mht, and .asp, which are likely used for initial access or further stages of the attack.
Detects network requests to '/pwndrop/' URI paths, which are indicative of communication with a PwnDrp web server. PwnDrp is a tool developed for red team testing and is also known to be used for malicious activities, typically for command and control or data exfiltration.
Detects HTTP User-Agent strings that end with an equal sign, which can be an indicator of Base64 encoding. This technique is often used by malware to obfuscate C2 communications.
This rule detects potential Command and Control (C2) communication associated with the Goofy Guineapig backdoor. It specifically looks for HTTP/S requests originating from a user agent string characteristic of the malware ('Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36') communicating with the domain 'static.tcplog.com'. This combination of user agent and destination domain is indicative of Goofy Guineapig C2 activity.
Page 8 of 8