Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,686 detections
Filters
Last updated
All Time
Detection languages
1,342
389
264
219
197
Contributors
620
506
358
209
102
Categories
20,443
11,831
5,875
5,151
4,864
2,686
Platforms
1,168
638
452
382
359
Products / Services
593
445
403
264
229
MITRE Techniques
1,884
787
525
521
510
CVEs
11
5
5
5
3
IDS Classtypes
189
133
34
10
7
IDS Protocols
243
58
33
22
12
Detects network connections to Devtunnels domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse this feature to establish a reverse shell, persistence, or exfiltrate data from a compromised machine.
Detects potential Raven Stealer activity by identifying known artifacts such as specific file paths, created filenames, command-line arguments, network connections, and file hashes.
Detects when a non-browser process initiates network communication with the Telegram API. This activity is suspicious as it could indicate the use of Telegram for covert command and control (C2) or data exfiltration by malware, bypassing typical browser-based interactions.
Ngrok is a legitimate tool that creates secure tunnels to localhost servers through NAT/firewalls, often used by developers.
Additionally, Ngrok tunnels have been used by Iranian APT groups, among others, to support their operations particularly for Command and Control (C2), data exfiltration, and initial access staging.
Additionally, Ngrok tunnels have been used by Iranian APT groups, among others, to support their operations particularly for Command and Control (C2), data exfiltration, and initial access staging.
This detection identifies outbound NTLM authentication attempts to remote SMB servers with suspicious characteristics consistent with the use of impacket-smbserver, a tool commonly used by adversaries for lateral movement and data exfiltration. The detection looks for RemotePort 445 traffic where:
- The server version is the anomalous string 255.255 65535 255
- Server identity fields (DNS and NetBIOS names) are exactly 8 characters long, which is typical for randomly generated names by impacket-smbserver
This pattern strongly indicates impersonation or malicious SMB hosting by an attacker within the network.
- The server version is the anomalous string 255.255 65535 255
- Server identity fields (DNS and NetBIOS names) are exactly 8 characters long, which is typical for randomly generated names by impacket-smbserver
This pattern strongly indicates impersonation or malicious SMB hosting by an attacker within the network.
Detects PowerShell scripts leveraging the "Invoke-WebRequest" or "Invoke-RestMethod" cmdlets to send data using either the "PUT" or "POST" HTTP method. This behavior can indicate an attempt to exfiltrate data from the system.
This detection identifies outbound SSL connections where the certificate issuer or subject matches suspicious strings associated with PureRAT infrastructure.
This detection identifies when Microsoft Teams applications send messages to groups / users in your organization's tenant. It utilizes the 'BotAddedToTeam' and 'AppInstalled' action types from CloudAppEvents to collect all Teams applications created in the specified timeframe and then joins on MessageEvents, matching events where SenderObjectId equals AppGuid.
This activity is significant as it may uncover unverified applications being added to teams channels and communicating with users in your tenant. Teams application security, compliance, and permissions can be reviewed in the Microsoft Teams Admin portal -
https://admin.teams.microsoft.com/policies/manage-apps/
This activity is significant as it may uncover unverified applications being added to teams channels and communicating with users in your tenant. Teams application security, compliance, and permissions can be reviewed in the Microsoft Teams Admin portal -
https://admin.teams.microsoft.com/policies/manage-apps/
Detects the HazyBeacon backdoor, which leverages AWS Lambda URLs for C2 communication and uses custom tools for data exfiltration. The rule identifies known malicious file hashes, suspicious tool drops in C:\ProgramData, specific service creation commands for persistence, and network connections from the sideloaded host process (mscorsvw.exe) to AWS Lambda URLs.
This detection identifies the use of a remote tool to download virtual machine disk files from a datastore. The NFC protocol is used by management tools to transfer files to and from ESXi hosts, but it can also be abused by attackers or insiders to exfiltrate full virtual disk images.
DefenderXDR Custom Detection
Detects PowerShell activity associated with the Kimsuky threat actor, where system information is collected and exfiltrated to a private GitHub repository, or where other IOCs related to this campaign are observed. This technique was observed in a campaign distributing the XenoRAT malware.
This query identifies when a suspicious SVG file, linked to known threat intelligence, is downloaded via a browser. This technique is often used for SVG smuggling, where attackers embed malicious JavaScript or links within the SVG's structure to bypass traditional content filters or sandboxing. Once rendered in the browser, the embedded content may redirect the victim to a malicious site or initiate further malicious activity.
Detects TTPs associated with the HazyBeacon backdoor, used by the threat cluster CL-STA-1020. This rule identifies the creation of a specific persistence service and the execution of custom exfiltration tools from the C:\ProgramData directory. This threat also uses C2 communication via AWS Lambda URLs (e.g., *.lambda-url.*.on.aws) from the mscorsvw.exe process, which should be monitored via network logs.
This rule is designed to identify any non-bot user accessing an unusually high number of repositories in a short time window (30 mins), which may indicate credential abuse or insider threat activity.
Detects Odyssey Infostealer, a macOS malware known for stealing sensitive data and establishing persistence. This rule identifies specific strings related to its C2 communication, data theft, and persistence mechanisms.
This analytic detects outbound connections from Cisco Secure Firewall Threat Defense to commonly abused file sharing and pastebin-style hosting domains. It specifically looks for allowed connections where the URL matches a predefined list of known data hosting or temporary storage services. These platforms are frequently used by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads. Identifying such connections can indicate potential abuse of legitimate infrastructure as part of an attacker's kill chain, suggesting tool staging, credential dumping, or outbound data leaks over HTTP(S).
Generic rule content from file: LOLBAS - Execution - Outbound Traffic to Suspicious TLD
KQL Query from file: NauthNRPC Detection
KQL Query
Page 113 of 128