Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,151 detections
Filters
Last updated
All Time
Detection languages
2,297
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
2,854
2,017
813
521
213
Products / Services
1,334
1,144
831
576
366
MITRE Techniques
1,820
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects network connections to domains used by GrayAlpha (FIN7) for distributing malicious payloads via fake browser/software update pages, specifically targeting the 'cdnXX.click' pattern and '/download.php' endpoint. This activity is associated with the initial access phase, leading to the deployment of loaders like PowerNet or MaskBat.
Detects network connections to known malicious domains and IPs associated with the Discord Invite Loop Hole campaign, including payload hosting, C2, and data exfiltration via Discord webhooks.
Detects network connections to Cloudflared tunnels domains initiated by a process on the system.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects an executable in the Windows folder accessing github.com
Detects network connections to BTunnels domains initiated by a process on the system.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks.
In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.
In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.
'Discover all critical ports from a list having rules like 'Any' for sourceIp, which means that they are opened to everyone. Critial ports should not be opened to everyone, and should be filtered.'
Roasting
KQL
Detect Active Directory LDAP queries that search for Kerberoasting (SPNs) or accounts with Kerberos preauthentication not required from Azure ATP, and try to get the process initiated the LDAP query from MDATP.
Replace 389 on line 5 with LDAP port in your environment
Replace true on line 6 to false if you want to include Nt Authority process
This LDAP query cover Rubeus, Kerberoast, BloodHound tools
Replace 389 on line 5 with LDAP port in your environment
Replace true on line 6 to false if you want to include Nt Authority process
This LDAP query cover Rubeus, Kerberoast, BloodHound tools
Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.
Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects an executable initiating a network connection to "ngrok" domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports.
Detects "RegAsm.exe" initiating a network connection to public IP adresses
Detects network connections utilizing specific URL paths associated with Prometei botnet malware distribution and command-and-control (C2) communication.
Detects an RDP connection originating from a domain controller.
'Malware authors will sometimes hardcode user agent string values when writing the network communication component of their malware. Malformed user agents can be an indication of such malware.'
Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.
Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet)
Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.
Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.
Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe".
This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.
This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.
Page 222 of 246