Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
338 detections
Filters
Last updated
All Time
Detection languages
120
98
40
28
21
Contributors
66
66
65
53
13
Categories
148
107
105
82
53
Platforms
254
113
56
29
5
Products / Services
10,665
9,758
6,693
4,421
3,749
338
MITRE Techniques
158
96
45
41
35
CVEs
3
3
2
2
2
IDS Classtypes
17
3
3
2
2
IDS Protocols
18
4
3
2
2
This analytic detects multipart POST requests containing a PHPSESSID form field and an uploaded filename with a PHP opening tag.
When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
When observed with "PHP_SESSION_UPLOAD_PROGRESS" behavior, this may indicate an attempt to place executable PHP content into session-related data as part of PHP2Shell exploitation.
This analytic detects HTTP POST requests with a body of at least one megabyte that receive an HTTP 500 response.
Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
Large failed uploads can indicate attempts to trigger resource exhaustion or exploit vulnerable request handling, including behavior associated with PHP2Shell, but require investigation with related web and application logs.
This analytic detects multipart POST requests containing the "PHP_SESSION_UPLOAD_PROGRESS" form field and a serialized PHP structure in an uploaded filename.
This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.
This combination may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.
The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings.
It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex escape sequences or sixteen or more consecutive base64 character groups.
This activity is significant as adversaries commonly use hex or base64 encoding to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads.
It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex escape sequences or sixteen or more consecutive base64 character groups.
This activity is significant as adversaries commonly use hex or base64 encoding to obfuscate C2 communication, exfiltrate data, or deliver encoded payloads.
Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE
Detects potential data exfiltration to popular public paste-sites and code-sharing services (such as Pastebin, Paste.ee, Hastebin, Ghostbin, ControlC, Dpaste, Rentry.co, Privatebin) using HTTP POST or PUT requests based on upload frequency and volume thresholds.
The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs.
Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement.
Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement.
The following analytic detects Zeek HTTP requests using methods outside a configurable allowlist of standard and commonly used HTTP methods.
Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control traffic.
Review the method, source, destination, and URI to assess the activity.
Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control traffic.
Review the method, source, destination, and URI to assess the activity.
Detects DNS queries, HTTP host headers, and TLS SNI traffic associated with known credential-phishing domains used by the threat actor TA419. The rule monitors for communication to a specific list of domains identified as malicious or used in phishing campaigns.
Detects DNS queries, HTTP host headers, and TLS SNI traffic associated with known credential-phishing domains used by the threat actor TA419. The rule monitors for communication to a specific list of domains identified as malicious or used in phishing campaigns.
Detects DNS queries, HTTP host headers, and TLS SNI traffic associated with known credential-phishing domains used by the threat actor TA419. The rule monitors for communication to a specific list of domains identified as malicious or used in phishing campaigns.
Detects potential Cobalt Strike or Sliver command and control (C2) beaconing behavior by analyzing network proxy, firewall, and flow logs for common C2 URI patterns, known malicious JA3/JA3S TLS fingerprints, and consistent periodic communication intervals (low jitter) characteristic of automated beacons.
Detects DNS queries, HTTP host headers, and TLS SNI traffic associated with known credential-phishing domains used by the threat actor TA419. The rule monitors for communication to a specific list of domains identified as malicious or used in phishing campaigns.
Detects network traffic indicators associated with Cobalt Strike beaconing activity, specifically focusing on common default or near-default Malleable C2 HTTP profile patterns. This includes hardcoded URI paths often used in default configurations (e.g., jQuery library names, pixel gifs) and specific combinations of HTTP headers and user-agent strings commonly observed in adversary C2 frameworks.
This rule detects DNS queries for domains associated with DPRK-aligned threat actor backdoors, specifically identified in research as related to curlRAT or similar secondary-stage malware communication. Monitoring these domains can identify potential beaconing or C2 communication from compromised hosts.
Detects outbound HTTP GET requests for common AI model file formats (.pkl, .pt, .bin) from non-authorized or untrusted external domains. This activity is indicative of downloading potentially malicious pre-trained AI models, which can execute arbitrary code during the unpickling process (Supply Chain Compromise).
Detects high-entropy or unusually long encoded subdomain labels in DNS queries, which are characteristic of DNS tunneling tools like iodine, dnscat2, and dns2tcp used for command and control (C2) communication or data exfiltration over the DNS protocol.
This rule detects potential DNS tunneling activities often associated with Command and Control (C2) communication. It monitors for anomalous patterns including excessively long DNS query labels, the use of uncommon DNS record types (TXT or NULL), and high volumes of DNS traffic directed towards specific domains. These behaviors are common indicators of data exfiltration or covert beaconing attempts designed to bypass traditional network security controls.
Detects anomalous DNS traffic patterns indicative of malware Domain Generation Algorithms (DGA). The rule identifies multiple NXDOMAIN responses for domains exhibiting high-entropy character structures (high consonant-to-vowel ratios, random alphanumeric string patterns) originating from a single source IP within a short timeframe, which is a common indicator of C2 beaconing attempts.
Detects high-volume outbound network connections over port 443 with significant duration, which is indicative of staged data exfiltration activity. The rule identifies sustained transfers exceeding 50MB that last longer than 5 minutes, targeting non-local network destinations.
Detects anomalous DNS activity characterized by high-frequency IP address rotation for a single domain within a 10-minute window. This behavior is indicative of fast-flux DNS techniques used by attackers to maintain C2 infrastructure and evade domain-based blocking or IP reputation filtering.
Page 1 of 17