Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,773
6,705
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
This rule monitors outgoing HTTP traffic for a specific numeric URI path pattern ( /49890878) which is characteristic of beaconing behavior to a command-and-control (C2) server. Such static, non-descriptive URI paths are frequently used by malware to maintain consistent connectivity to an adversary-controlled infrastructure.
Detects DNS queries containing high-entropy domain labels that exhibit patterns common to Domain Generation Algorithms (DGA). The rule triggers when a threshold of such suspicious queries is exceeded from a single source within a 60-second window, which is a common indicator of malware beaconing or C2 communication.
This rule detects potential command-and-control (C2) activity from the TWINLOOT malware, which utilizes Microsoft Teams TURN relay infrastructure to establish a reverse SOCKS5 tunnel. The detection identifies connections to 'worldaz-msit.relay.teams.microsoft.com' followed immediately by a SOCKS5 handshake pattern (05 01 00), indicating encapsulated tunneling within the relay communication.
This rule detects suspicious network connections to GitHub and Postimg where specific assets are retrieved by a non-browser User Agent. This behavior is associated with the TWINLOOT campaign, where a Python-based implant retrieves fake loading-screen assets as part of a C2 communication sequence, utilizing legitimate image and video hosting services as dead-drop resolvers.
This rule detects two components of a malicious campaign using Google Sites to host fake OpenAI Codex installer lures. The first rule detects when a response body from an external server contains an iframe pointing to the domain 'bright-links.com'. The second rule detects client-side requests to Google Sites paths containing 'codex', indicating a user is navigating to the lure page.
Detects outbound network traffic from internal hosts to known command-and-control (C2) server IP addresses associated with C2Looper malware on port 8888.
Detects periodic beaconing and configuration polling by the TWINLOOT implant using Azure Blob Storage as a dead-drop mechanism. The rules identify specific TLS SNI patterns and HTTP requests for 'cfg.json' files hosted on Azure Blob storage using non-browser user-agents.
This rule detects the outbound transmission of the Remote Framebuffer (RFB) protocol handshake, which is used by Virtual Network Computing (VNC) software. This is often indicative of unauthorized remote access tools or screen sharing being initiated from a host within the protected network to an external destination.
Detects network traffic indicating potential Command and Control (C2) tasking communication via Microsoft SharePoint. The rule monitors for requests to specific SharePoint paths associated with the TWINLOOT campaign, which leverages legitimate cloud infrastructure for malicious command delivery.
Detects outbound HTTP POST requests to a URI path '/api/beacon' containing a specific JSON structure ('id', 'user', 'host', 'pid'), which is characteristic of the C2Looper beaconing behavior.
This rule detects network traffic patterns associated with the msaRAT remote access trojan (RAT) as it initializes WebRTC communication. It identifies the initial POST request to a token service and the subsequent response containing Twilio TURN and Google STUN relay server configurations, which are used by the malware to establish peer-to-peer tunnels for command-and-control communication.
Detects outbound network traffic from internal hosts to known malicious IP addresses associated with AdaptixC2 infrastructure. This rule identifies both general TCP connections and HTTP beaconing activity to these C2 servers, which are used for command and control purposes.
Detects anomalous, non-browser process activity interacting with Microsoft Teams APIs associated with the TWINLOOT threat campaign. The rules identify suspicious token retrieval requests and unauthorized authentication headers from processes that do not identify as legitimate browser or Teams application agents, indicating potential abuse of application access tokens and authentication flows.
Detects outbound TCP traffic to known PurpleDelta-associated infrastructure IP addresses on common remote-access/web ports (80, 443, 3389), indicating potential communication with North Korean IT-worker facilitator infrastructure. Scope is limited to static IP indicators from Appendix A; does not cover Astrill VPN egress ranges or shell-company recruitment domains (minicursor[.]com), which would require separate signatures.
Detects DNS queries for suspicious subdomains on known Mirage2FA phishing kit domains ('cheacker.store' and 'volatilesour.store'). The rule identifies queries where the subdomain is Base64-encoded and decodes into an email-like format, which is a technique used by this phishing kit to track or validate victim-specific session tokens or email addresses.
This rule detects outbound TLS connections from the local network to an external destination where the server provides a self-signed certificate. Self-signed certificates are often used by malware for command-and-control (C2) communication or by data exfiltration tools to establish encrypted channels while avoiding the need for legitimate, verifiable PKI infrastructure.
Detects network activity associated with the TWINLOOT malware, identifying command-and-control communication through TLS ALPN, custom HTTP User-Agent strings, and specific SNI values for known C2 infrastructure.
Detects HTTP GET requests to known Mirage2FA phishing infrastructure domains and specific URI patterns associated with the retrieval of JavaScript loaders. This rule monitors for specific URL paths ('/xls/') and naming conventions (e.g., 'a1p2i.js') characteristic of the Mirage2FA phishing kit, which is used to harvest 2FA tokens.
This rule detects HTTP requests directed towards known malvertising domains that serve trojanized MSI installers. The rule identifies specific suspicious hostnames and a common URL pattern used for payload delivery.
Detects network activity associated with the BumbleBee malware, including domain-generation algorithm (DGA) pattern matches within TLS Server Name Indication (SNI) fields and direct connections to known C2 infrastructure IP addresses over HTTPS.
Detects HTTP GET requests to a specific Cloudflare Workers domain ('is-01-ast.ols-img-12.workers.dev') used for msaRAT WebRTC signaling, characterized by the presence of spoofed 'Origin' and 'Referer' headers pointing to 'microsoft.com' alongside a 'HeadlessChrome' user agent, indicating malicious command-and-control behavior.
Page 92 of 124