Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,151 detections
Filters
Last updated
All Time
Detection languages
2,297
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,445
11,833
5,875
5,151
4,864
Platforms
2,854
2,017
813
521
213
Products / Services
1,334
1,144
831
576
366
MITRE Techniques
1,820
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule identifies DNS lookups associated with common Tor proxies and services. It detects queries for domains ending in '.onion' and various Tor gateway domains (e.g., '.hiddenservice.net', '.tor2web.com', '.tor-gateways.de'). This activity can indicate the use of the Tor network for anonymization, which adversaries may leverage for command and control, data exfiltration, or to obscure their malicious activities.
Detects the execution of a packet capture command with a specific buffer size known to be used by the LINE VIPER malware on Cisco ASA devices. LINE VIPER is a sophisticated malware designed to target Cisco ASA devices, often deployed by the RayInitiator bootkit.
Detects the creation of or connection to named pipes commonly associated with PsExec activity, which is often used for lateral movement. This includes the default 'psexesvc' pipe and patterns used by impacket's psexec.py.
Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string and performs GET requests. This activity is indicative of reconnaissance or data scraping.
Detects potential LINE VIPER tasking activity via Cisco ASA WebVPN authentication requests. This involves looking for specific XML elements (<client-cert> or <client-cert-auth-signature>) containing large Base64-encoded data, which is indicative of embedded shellcode.
This detection rule identifies potential SEO poisoning activity associated with the Operation Rewrite campaign. It looks for a high volume of web requests from a single source IP where the HTTP referrer indicates the traffic originated from a search engine. This pattern can indicate a compromised host being used for malicious purposes or a user interacting with multiple poisoned search results.
Zloader Custom DNS C2
YARA-L
Detects Zloader's custom DNS tunneling protocol which uses multiple Base32 encoded subdomains for C2 communication.
This rule detects a high volume of DNS queries (over 50) from a single source IP to a limited number of destination IPs (2 or less) for non-standard domains. It excludes common legitimate domains like microsoft.com, google.com, apple.com, cloudflare.com, akamai.com, and amazonaws.com, as well as queries to private IP ranges. This pattern can indicate DNS tunneling, data exfiltration, or command and control activity.
In this case, I have been researching about the 'curve' value into AdditionalFields field of DeviceNetworkEvents table which I identified into iana.org as two groups 'Elliptic curve' and 'Diffie-Hellman groups'.
These 2 kinds of encryption groups work to secure communication over an insecure channel, are classified by Internet Assigned Numbers Authority (IANA), as if are 'recommended' and the Datagram Transport Layer Security status. In addition, to take into account, the mentioned site mention: "If an item is not marked as 'Recommended', it does not necessarily mean that it is flawed; rather, it indicates that the item either has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases"
Therefore, this KQL Query is oriented to identify if the current encryption to secure your communications is enough or if due to the level of sensitive of your information, would need to be reviewed.
These 2 kinds of encryption groups work to secure communication over an insecure channel, are classified by Internet Assigned Numbers Authority (IANA), as if are 'recommended' and the Datagram Transport Layer Security status. In addition, to take into account, the mentioned site mention: "If an item is not marked as 'Recommended', it does not necessarily mean that it is flawed; rather, it indicates that the item either has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases"
Therefore, this KQL Query is oriented to identify if the current encryption to secure your communications is enough or if due to the level of sensitive of your information, would need to be reviewed.
This analytic detects intrusion events from known threat activity using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where one or multiple Snort signatures associated with a known threat or threat actor activity have been triggered within a one-hour time window. The detection uses a lookup table (cisco_snort_ids_to_threat_mapping) to map Snort signature IDs to known threat actors and their techniques. When multiple signatures associated with the same threat actor are triggered within the time window, and the count of unique signatures matches or exceeds the expected number of signatures for that threat technique, an alert is generated. This helps identify potential coordinated threat activity in your network environment by correlating related intrusion events that occur in close temporal proximity. Currently, this detection will alert on the following threat actors or malware families as defined in the cisco_snort_ids_to_threat_mapping lookup: ArcaneDoor, Static Tundra, AgentTesla, Amadey, AsyncRAT, Chafer, DCRAT, Lumma Stealer, Nobelium, Quasar, Remcos, Snake, Xworm. To add or update threat actors, update the cisco_snort_ids_to_threat_mapping.csv lookup file with new or modified threat names and associated Snort signature IDs.
Detects network traffic to a known Command and Control (C2) server (136.243.146.46:8898) associated with the YiBackdoor malware.
This query is using the DeviceNetworkEvents table to filter by connections where there are encryption algorithms used. Then, I take a list of the encryption algorithms database from the well-known site iana.org which is an entity that monitors the global allocation of IP addresses, autonomous systems, DNS domain name root servers and other Internet Protocol resources. Finally, It list cases where there are multiple connections established using non-recommended or non-valid datagram transport layer security (DTLS), which could mean that our users are not protected against eavesdropping, tampering or message forgery.
Detects a Windows command shell executing a batch file that subsequently spawns processes for system discovery (often for AV checking) and then either executes a potential payload or performs network reconnaissance. This behavior is consistent with the initial stages of the BlockBlasters malware campaign.
This rule detects various artifacts and behaviors associated with the DeedRAT malware, also known as MicRun or SBAMRES. It identifies the execution of 'MicRun.exe', suspicious file paths like 'C:\ProgramData\MicroDefaults', and registry persistence via 'Run' keys with specific data patterns. The rule also looks for the creation of malicious services using 'sc create MicRun', known malicious SHA256 hashes for both processes and files, and suspicious filenames such as 'SBAMRES.DLL' and 'MicRun.exe'. Additionally, it detects network communication to a known DeedRAT C2 domain, 'luckybear669.kozow.com'.
Detects potential BlackLock ransomware activity where a process is launched with command-line arguments for network scanning and subsequently makes an SMB connection.
This rule hunts for various artifacts and behaviors associated with the APT28 campaign "Phantom Net Voxel", which leverages COM hijacking, steganography, and cloud services for C2. This version is specifically tailored for Azure Sentinel using only DeviceProcessEvents, DeviceFileEvents, and DeviceNetworkEvents. It detects known malicious file hashes, regsvr32 execution of a specific DLL, Office applications dropping malicious DLLs or steganographic PNGs, C2 communications to known cloud storage domains, creation of SlimAgent log files, and explorer.exe accessing steganographic PNG files indicating successful COM hijacking.
This rule detects potential malware infections and command and control activity by correlating email, endpoint file, and network events with indicators of compromise (IOCs) sourced from an external OSINT feed. It specifically looks for SHA256 hashes in email attachments, domains and URLs in email links, MD5, SHA1, and SHA256 hashes of created files on endpoints, and IP addresses and domains in network connections (both direct and HTTP inspected connections). The rule aims to identify initial access, execution, and command and control phases of an attack, potentially involving Cloudflare Tunnels as suggested by the rule's title and the OSINT source.
This rule detects network connections to known EvilGinx phishing infrastructure, identified by specific remote URLs, IP addresses, and a suspicious login URL pattern. EvilGinx is a phishing framework used for credential harvesting and session cookie theft, often employing adversary-in-the-middle techniques.
Detects BITS transfer jobs downloading files from known file-sharing or code-hosting domains often abused by adversaries for staging or delivering malicious payloads. This rule specifically looks for EventID 16403 in the BITS client logs, indicating a file transfer, and checks if the remote source domain matches a list of suspicious domains.
Detects suspicious usage of MpCmdRun.exe, the Microsoft Defender command-line utility, to potentially steal NTLM credentials. This rule specifically looks for MpCmdRun.exe being executed with parameters related to scanning or exclusion checking, combined with attempts to access remote UNC paths (\\). This behavior can indicate an adversary attempting to force NTLM authentication to a controlled server to capture hashes.
Detects network connections to the 'webhook.site' domain, which is used as an exfiltration endpoint by the 'Shai-Halud' supply chain attack campaign. The risk score is elevated if the specific malicious URL path is observed.
Page 209 of 246