Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,145 detections
Filters
Last updated
All Time
Detection languages
2,291
1,070
640
289
288
Contributors
913
814
769
696
224
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
2,848
2,017
807
515
213
Products / Services
1,334
1,144
831
576
366
MITRE Techniques
1,814
1,302
787
746
576
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects a rundll32 that communicates with public IP addresses
Detects suspicious connections from Microsoft Sync Center to non-private IPs.
Detects a network connection that is initiated by the "notepad.exe" process.
This might be a sign of process injection from a beacon process or something similar.
Notepad rarely initiates a network communication except when printing documents for example.
This might be a sign of process injection from a beacon process or something similar.
Notepad rarely initiates a network communication except when printing documents for example.
Detects a "winlogon.exe" process that initiate network communications with public IP addresses
Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.
Detects a network connection initiated by Cmstp.EXE
Its uncommon for "cmstp.exe" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.
Its uncommon for "cmstp.exe" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.
Detects a network connection initiated from a process located in the "C:\Users\Public" folder.
Attacker are known to drop their malicious payloads and malware in this directory as its writable by everyone.
Use this rule to hunt for potential suspicious or uncommon activity in your environement.
Attacker are known to drop their malicious payloads and malware in this directory as its writable by everyone.
Use this rule to hunt for potential suspicious or uncommon activity in your environement.
Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs
Detects a network connection that was initiated from a PowerShell process.
Often times malicious powershell scripts download additional payloads or communicate back to command and control channels via uncommon ports or IPs.
Use this rule as a basis for hunting for anomalies.
Often times malicious powershell scripts download additional payloads or communicate back to command and control channels via uncommon ports or IPs.
Use this rule as a basis for hunting for anomalies.
Detects suspicious "epmap" connection to a remote computer via remote procedure call (RPC)
Detects a possible remote connections to Silenttrinity c2
Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses.
This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.
This rule will require an initial baseline and tuning that is specific to your organization.
This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.
This rule will require an initial baseline and tuning that is specific to your organization.
Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors
Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.
Detects an executable that isn't dropbox but communicates with the Dropbox API
Detects a rundll32 that communicates with public IP addresses
Detects suspicious connections from Microsoft Sync Center to non-private IPs.
Detects outbound network connection initiated by Microsoft Dialer.
The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer.
This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"
The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer.
This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"
Detects a "winlogon.exe" process that initiate network communications with public IP addresses
Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.
Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports.
Page 227 of 245