Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,151 detections
Filters
Last updated
All Time
Detection languages
2,297
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,445
11,833
5,875
5,151
4,864
Platforms
2,854
2,017
813
521
213
Products / Services
1,334
1,144
831
576
366
MITRE Techniques
1,820
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
New KSMBD DoS (CVE-2025-38501) can exhaust SMB connections via half-open TCP handshakes — patch to Linux 6.1.15+ or rate-limit TCP/445 to mitigate.
This KQL query helps to hunt for connection attempts to port 445 across Linux endpoints in Defender XDR:
This KQL query helps to hunt for connection attempts to port 445 across Linux endpoints in Defender XDR:
The analytic detects headless browser activity accessing mockbin.org or mocky.io. It identifies processes with the "--headless" and "--disable-gpu" command line arguments, along with references to mockbin.org or mocky.io. This behavior is significant as headless browsers are often used for automated tasks, including malicious activities like web scraping or automated attacks. If confirmed malicious, this activity could indicate an attempt to bypass traditional browser security measures, potentially leading to data exfiltration or further exploitation of web applications.
Detects network traffic consistent with XWorm malware using the Telegram API for Command and Control (C2) or data exfiltration. This rule specifically looks for HTTP requests to 'api.telegram.org' with URL patterns indicative of sending messages or files via the Telegram Bot API (e.g., /bot<token>/sendMessage, /bot<token>/sendDocument, /bot<token>/sendPhoto).
Detects DNS resolution of an .onion address related to Tor routing networks
This KQL Query is oriented to extract the different bits of TCP Flags which helps to review the different state of the connections and identify possible threats associated.
In addition, it allows to filter by specific TCP Flag to detect specific threats based on every case.
In addition, it allows to filter by specific TCP Flag to detect specific threats based on every case.
Detects network connections to known malicious AnyDesk-related URLs and IP addresses, as well as the presence of specific malicious file hashes and filenames associated with AnyDesk-themed phishing or malware. This rule aims to identify potential compromise attempts or active infections involving remote access tools often abused by adversaries.
Detects network connections to known XWorm Command and Control (C2) infrastructure (IPs and domains) and the creation of processes with filenames associated with XWorm malware. This rule combines network and process-based indicators to identify potential XWorm infections.
Detects indicators associated with a supply chain attack compromising popular NPM packages like 'chalk' and 'debug'. The rule identifies network connections to known malicious domains and command-line activity related to the installation of compromised packages.
This KQL query is designed to identify potentially unauthorized communications with popular AI services and large language models (LLMs) from organizational endpoints.
The following query is oriented to extend information about the potential threats associated with distinct HTTP status code. This allows me to quickly work with other KQL queries to identify potential threats. Consider this KQL query as a "Pivot Table" for multiple queries that can be triggered based on your criteria.
This rule detects various activities associated with the NotDoor malware, including the copying of malicious files to Outlook macro folders, C2 beaconing attempts using nslookup or curl to suspicious domains, registry modifications to disable Outlook macro security or enable macro loading on boot, and the creation of staging files in temporary directories for potential exfiltration. These behaviors are indicative of NotDoor installation, persistence, defense evasion, and data staging.
This rule detects attempts to download known malicious NPM packages from the public npm registry (registry.npmjs.org) by monitoring network connection logs. It specifically looks for tarball (.tgz) downloads of packages and versions that have been identified as compromised or malicious. The rule extracts the package name and version from the download URL and compares it against a predefined list of malicious packages for high-fidelity detection.
Detects HijackLoader attempting to perform anti-virtual machine (VM) checks by querying for VirtualBox-specific registry keys from a PowerShell process that also initiates a network connection. This combination of behaviors is indicative of sandbox evasion.
This rule detects network connections to known dynamic DNS (DDNS) subdomains. Adversaries often use dynamic DNS services to maintain persistent command and control (C2) communication channels, as these services allow them to frequently change the IP address associated with a static hostname, making it harder for defenders to block or track their infrastructure. These providers also have established domain reputation, and provide legitimate services making blanket IOC rules impossible. The rule identifies connections to specific DDNS providers such as DuckDNS, No-IP, PublicVM, and others.
Detecting networks shared by phones with key words in their Names such as "FREE", "AIRPORT" "OPEN", can be potential cases of Evil Twin Attack where malicious actors can intercept network traffic, steal login credentials, capture sensitive data, or launch further attacks like Man-in-the-Middle (MitM) attacks.
This KQL Query helps to identify when a connection is shared by an IPhone device and for that we can use a default Gateway assigned when a connection is shared from these Apple phones which is "172.20.10.1".
This KQL Query helps to identify when a connection is shared by an IPhone device and for that we can use a default Gateway assigned when a connection is shared from these Apple phones which is "172.20.10.1".
Detects the initial PowerShell download cradle associated with ClickFix/CORNFLAKE.V3 campaigns. This activity is often the result of a user being tricked into pasting and running a command from a malicious website.
This rule detects the creation of Scalable Vector Graphics (SVG) files on a system, particularly those initiated by common applications like Outlook, web browsers, or archive utilities. It then correlates this file creation with subsequent network activity from a browser process within a 5-minute window. The network activity is further scrutinized for suspicious URLs, specifically those using Cloudflare Workers domains with a specific pattern or URLs containing an '@' symbol, which can indicate obfuscation or malicious redirection attempts. This behavior is indicative of SVG smuggling techniques used to deliver malicious payloads or redirect users to phishing sites.
This analytic detects changes to SNMP community strings on Cisco devices, which could indicate an attacker establishing persistence or attempting to extract credentials. After gaining initial access to network devices, threat actors like Static Tundra often modify SNMP configurations to enable unauthorized monitoring and data collection. This detection specifically looks for the configuration of SNMP community strings with read-write (rw) or read-only (ro) permissions, as well as the configuration of SNMP hosts that may be used to exfiltrate data. These activities are particularly concerning as they may represent attempts to establish persistent access or extract sensitive information from compromised devices.
This analytic detects system binaries that are commonly abused in process injection techniques but are observed without any command-line arguments. It leverages Cisco Network Visibility Module (NVM) flow data and process arguments to identify outbound connections initiated by these processes. Binaries such as `rundll32.exe`, `regsvr32.exe`, `dllhost.exe`, `svchost.exe`, and others are legitimate Windows processes that are often injected into by malware or post-exploitation frameworks (e.g., Cobalt Strike) to hide execution. When these processes are seen initiating a network connection with an empty or missing command line, it can indicate potential injection and communication with a command and control server.
Base64 Website Access
YARA-L
Detects a user accessing multiple websites commonly used for Base64 encoding and decoding within a short time frame. This activity could be a precursor to data exfiltration or an attempt to obfuscate malicious commands.
This analytic identifies the use of `msxsl.exe` initiating a network connection to a non-private IP address. Although `msxsl.exe` is a legitimate Microsoft utility used to apply XSLT transformations, adversaries can abuse it to execute arbitrary code or load external resources in an evasive manner. This detection leverages Cisco NVM telemetry to identify potentially malicious use of `msxsl.exe` making network connections that may indicate command and control (C2) or data exfiltration activity.
Page 210 of 246