Application Layer Protocol detection rulesT1071

Detects suspicious DNS queries known from Cobalt Strike beacons

dns

Detects Baby Shark C2 Framework default communication patterns

proxy

Detects OilRig activity as reported by Nyotron in their March 2018 report

windows · process_creation

Detects OilRig registry persistence as reported by Nyotron in their March 2018 report

windows · registry_event

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

windows

Detects OilRig schedule task persistence as reported by Nyotron in their March 2018 report

windows

Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity

proxy

Detects Silence EmpireDNSAgent as described in the Group-IP report

windows · ps_script

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

windows

Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons

windows · dns_query

Detects Ursnif C2 traffic.

proxy

Detects suspicious user agent strings used in APT malware in proxy logs

proxy

Detects suspicious user agent string of APT40 Dropbox tool

proxy

Detects DNS queries for the malicious C2 domain associated with the plain-crypto-js/Axios npm package supply chain compromise. On March 30, 2026, malicious versions (1.14.1, 0.30.4) were published to npm, injecting a dependency (plain-crypto-js@4.2.1) that executed a postinstall script as a cross-platform RAT dropper. This detection detects endpoints attempting to resolve the attacker's C2 domain (sfrclak.com) used for command and control communication.

dns

Detects Bitsadmin connections to IP addresses instead of FQDN names

proxy

Detects Bitsadmin connections to domains with uncommon TLDs

proxy

Detects HTTP request used by Chafer malware to receive data from its C2.

proxy

Detects Turla ComRAT network communication.

proxy

Detects suspicious user agent strings used by crypto miners in proxy logs

proxy

Well-known DNS Exfiltration tools execution

windows · process_creation

Detects DNS queries made by the finger utility, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server. Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion. Investigating such DNS queries can also help identify potential malicious infrastructure used by threat actors for command and control (C2) communication.

windows · dns_query

Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.

windows · dns_query

Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.

dns

Detects strings used in command execution in DNS TXT Answer

dns

Detects suspicious user agent strings used by exploit / pentest frameworks like Metasploit in proxy logs

proxy

Detects artefacts associated with activity group GALLIUM - Microsoft Threat Intelligence Center indicators released in December 2019.

windows

Detects artifacts associated with GALLIUM cyber espionage group as reported by Microsoft Threat Intelligence Center in the December 2019 report.

windows · process_creation

Detects cobalt strike malleable profiles patterns (URI, User-Agents, Methods).

proxy

Detects user agent and URI paths used by empire agents

proxy

Detects SILENTTRINITY stager dll loading activity

windows · image_load

Detects SILENTTRINITY stager use via PE metadata

windows · process_creation

Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.

windows · process_creation

Detects network connections with a suspicious user-agent string containing "katz-ontop", which may indicate Katz Stealer activity.

zeek

Detects suspicious user agent strings used by malware in proxy logs

proxy

Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for execution on Windows devices. In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server. Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion. Investigating such network connections can also help identify potential malicious infrastructure used by threat actors

windows · network_connection

Detects outbound network connection initiated by Microsoft Dialer. The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer. This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"

windows · network_connection

Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form

proxy

Detects renamed Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

windows · process_creation

Detects suspicious malformed user agent strings in proxy logs

proxy

Detects download of Ursnif malware done by dropper documents.

proxy

Detects wannacry killswitch domain dns queries

dns

Detects WebDav DownloadCradle

proxy

Adversaries may communicate using application layer protocols associated with web traffic to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.

windows · ps_script

Detects DNS requests to Cloudflared tunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

windows · dns_query

Detects execution of curl.exe with custom useragent options

windows · process_creation

Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners. These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc. Such DNS activity can indicate potential delivery or command-and-control communication attempts.

windows · dns_query

Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

windows · dns_query

Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.

windows · dns_query

Detects GitHub self-hosted runners executing workflows on local infrastructure that could be abused for persistence and code execution. Shai-Hulud is an npm supply chain worm targeting CI/CD environments. It installs runners on compromised systems to maintain access after credential theft, leveraging their access to secrets and internal networks.

windows · process_creation

Detects a potentially suspicious empty user agent strings in proxy log. Could potentially indicate an uncommon request method.

proxy

Detects DNS queries to domains within known low reputation eTLDs. This rule uses AlphaSOC's threat intelligence data and is updated on a monthly basis.

dns

Detects User Agent strings that end with an equal sign, which can be a sign of base64 encoding.

proxy

Detects the execution of rundll32.exe with the oledb32.dll library to open a UDL file. Threat actors can abuse this technique as a phishing vector to capture authentication credentials or other sensitive data.

windows · process_creation

Detects suspicious encoded User-Agent strings, as seen used by some malware.

proxy

Detects a suspicious curl process start on linux with set useragent options

linux · process_creation

Detects suspicious DNS queries using base64 encoding

dns

Detects the execution of suspicious child processes from macOS installer package parent process. This includes osascript, JXA, curl and wget amongst other interpreters

macos · process_creation

Detects DNS queries to attacker-controlled infrastructure used by the Mini Shai-Hulud campaign targeting TanStack npm packages along with other packages such as mistralai, uipath and so on. The domain git-tanstack.com (registered May 9, 2026) hosted secondary payloads including transformers.pyz. The filev2.getsession.org endpoint was used for credential exfiltration via the Session protocol.

windows · dns_query

Detects suspicious requests to Telegram API without the usual Telegram User-Agent

proxy

Detects the execution of well known tools that can be abused for data exfiltration and tunneling.

windows · process_creation

Detects Visual Studio Code tunnel execution. Attackers can abuse this functionality to establish a C2 channel

windows · process_creation

Detects the installation of VsCode tunnel (code-tunnel) as a service.

windows · process_creation

Detects the execution of a shell (powershell, bash, wsl...) via Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system.

windows · process_creation

Detects Windows PowerShell Web Access

proxy

Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.

windows · dns_query