Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,151 detections
Filters
Last updated
All Time
Detection languages
2,297
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,445
11,833
5,875
5,151
4,864
Platforms
2,854
2,017
813
521
213
Products / Services
1,334
1,144
831
576
366
MITRE Techniques
1,820
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects usage of the Windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack referred to as PetitPotam. The usage of this RPC function should be rare if ever used at all. Thus, any usage of this function is uncommon enough that it should warrant further investigation to determine if it is legitimate. View surrounding logs (within a few minutes before and after) from the Source IP to determine if it is legitimate. Logs from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc.
Detects the deployment or activity of the TOLLBOOTH IIS module. This is achieved by identifying the creation of its specific DLLs by the IIS worker process (w3wp.exe), or by detecting outbound C2 communication from the IIS worker process to known TOLLBOOTH infrastructure.
These domains are actively used in phishing campaigns impersonating legitimate software platforms like Homebrew, LogMeIn, and TradingView to distribute Odyssey Stealer and AMOS malware. Blocking these domains can prevent access to malicious download sites.
This rule detects suspicious sign-in activities that occur shortly after a network connection to an IP address associated with 'Lab539 Clickfix'. It correlates risky sign-in events from Azure Active Directory (AAD) with network connection logs from devices. Specifically, it looks for AAD sign-ins with a risk level of 30 or higher, from non-guest, non-compliant, and non-managed devices, where the IP address has not been seen for that user in the last 30 days. This is then joined with network connection events to IP addresses found in the 'Lab539 Clickfix' external data, ensuring the sign-in occurs after the network connection within a short timeframe. The 'Lab539 Clickfix' reference suggests a connection to a known threat or campaign, possibly related to phishing or credential compromise.
Detects network connections to the InterPlanetary File System (IPFS) where the URI contains a pattern indicative of an email address. This behavior is associated with recent phishing campaigns that leverage IPFS to host credential harvesting webpages, attempting to collect user credentials.
Detects the loading of the WinDivert driver, which is a powerful user-mode package for Windows capable of capturing, sniffing, modifying, blocking, and re-injecting network traffic. This driver can be used by adversaries for network sniffing, credential access, and defense evasion techniques.
Detects remote RPC calls to the ITaskSchedulerService interface, specifically focusing on operations that create or execute scheduled tasks. This behavior is commonly associated with lateral movement and persistence techniques. The rule leverages an RPC Firewall to monitor these specific RPC calls.
This rule detects activity associated with the OilRig APT group, as detailed in Nyotron's March 2018 report. Specifically, it looks for the creation of a scheduled task named 'SC Scheduled Scan' that executes 'autoit3.exe' from a specific path, execution of executables within a '
Windows\Temp\DB\' directory, execution of 'C:\Windows\system32\Service.exe' with specific command-line arguments, and 'autoit3.exe' spawning 'nslookup.exe' with DNS TXT query parameters. These indicators collectively point to persistence mechanisms, execution of malicious payloads, and DNS-based command and control used by OilRig.
Windows\Temp\DB\' directory, execution of 'C:\Windows\system32\Service.exe' with specific command-line arguments, and 'autoit3.exe' spawning 'nslookup.exe' with DNS TXT query parameters. These indicators collectively point to persistence mechanisms, execution of malicious payloads, and DNS-based command and control used by OilRig.
Detects HTTP requests indicative of Oyster malware C2 beaconing, including GET requests to /reg with WordPressAgent User-Agent and application/json Content-Type, GET requests to /login with FingerPrint User-Agent, and GET/POST requests to /api/kcehc or POST requests to /api/jgfnsfnuefcnegfnehjbfncejfh.
These rules detect indicators associated with a campaign where attackers compromised developer accounts and inserted malicious code into over 35 Google Chrome extensions. The first rule identifies suspicious network connections to known malicious IP addresses and command-and-control (C2) domains. The second rule identifies the presence of known malicious Chrome extension names or their corresponding extension IDs, which could indicate the presence of a hijacked extension.
Detects remote registry management attempts using the 'reg' utility originating from a workstation not designated as an administrator workstation. This could indicate an attacker attempting to query or modify the registry of a remote system from an unauthorized host.
Detects Server Message Block (SMB) server connections to administrative shares (IPC$, ADMIN$, C$) that are established without signing or encryption enabled. This activity could indicate potential lateral movement by an adversary exploiting insecure SMB configurations.
The following analytic identifies the use of Living Off the Land Binaries and Scripts (LOLBAS) with network traffic. It leverages data from the Network Traffic data model to detect when native Windows binaries, often abused by adversaries, initiate network connections. This activity is significant as LOLBAS are frequently used to download malicious payloads, enabling lateral movement, command-and-control, or data exfiltration. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to organizational security.
This rule detects when the 'notepad.exe' process initiates a network connection. This behavior is highly unusual for Notepad and can indicate malicious activity such as process injection where a beacon or other malicious code is running within the legitimate Notepad process to establish command and control. Notepad typically only initiates network communication when printing documents, which is filtered out by this rule.
Detects potential exploitation of Cisco SNMP vulnerability (CVE-2025-20352) by identifying shell command patterns within SNMP traffic, indicative of remote code execution attempts as seen in Operation Zero Disco.
The analytic detects the use of the curl command contacting suspicious remote domains, such as s3.amazonaws.com, which is indicative of Command and Control (C2) activity or downloading further implants. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs and command-line arguments. This activity is significant as it may indicate the presence of MacOS adware or other malicious software attempting to establish persistence or exfiltrate data. If confirmed malicious, this could allow attackers to maintain control over the compromised system and deploy additional payloads.
Detects suspicious outbound network connections initiated by Microsoft Sync Center (mobsync.exe) to non-private IP addresses. This activity is unusual for mobsync.exe, which typically handles offline file synchronization and should primarily communicate with internal network resources or specific cloud services, not arbitrary external IPs. Such connections could indicate compromise or malicious use of a legitimate system binary.
Detects network connections initiated by Microsoft Quick Assist (QuickAssist.exe) to its official relay server. This activity is expected for legitimate Quick Assist usage, but monitoring it can help identify unauthorized remote access or potential abuse of the tool.
Detects network connections from web browsers to domains associated with the UNC5142 EtherHiding technique, including a specific blockchain node and malicious Cloudflare Pages domains.
The following analytic detects suspicious usage of BitLockerToGo.exe, which has been observed being abused by Lumma stealer malware. The malware leverages this legitimate Windows utility to manipulate registry keys, search for cryptocurrency wallets and credentials, and exfiltrate sensitive data. This activity is significant because BitLockerToGo.exe provides functionality for viewing, copying, and writing files as well as modifying registry branches - capabilities that the Lumma stealer exploits for malicious purposes. If confirmed malicious, this could indicate an active data theft campaign targeting cryptocurrency wallets, browser credentials, and password manager archives. The detection focuses on identifying BitLockerToGo.exe execution patterns that deviate from normal system behavior.
Detects when a Microsoft Office application (Word, Excel, PowerPoint, Outlook, WordView) initiates an outbound network connection to an IP address that is not a private IP range or a known Microsoft/Akamai IP range. This rule aims to identify suspicious network activity from Office applications, potentially indicative of malware or exploitation, similar to behavior seen in CVE-2021-42292. Initial baselining and tuning are required to adapt to specific organizational environments.
Page 206 of 246