Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,151 detections
Filters
Last updated
All Time
Detection languages
2,297
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,440
11,829
5,874
5,151
4,864
Platforms
2,854
2,017
813
521
213
Products / Services
1,334
1,144
831
576
366
MITRE Techniques
1,820
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
The following analytic identifies the use of cleartext protocols that risk leaking sensitive information. It detects network traffic on legacy protocols such as Telnet (port 23), POP3 (port 110), IMAP (port 143), and non-anonymous FTP (port 21). The detection leverages the Network_Traffic data model to identify TCP traffic on these ports. Monitoring this activity is crucial as it can expose credentials and other sensitive data to interception. If confirmed malicious, attackers could capture authentication details, leading to unauthorized access and potential data breaches.
Detects remote RPC calls that perform remote DCOM operations, which can be abused for lateral movement via DCOM or WMI. The rule specifically looks for RPC Firewall events with EventID 3 and a set of Interface UUIDs associated with DCOM and WMI activities.
This rule detects network connections initiated by a file whose SHA256 hash is known, via VirusTotal relationships, to contact a specific IP address. It correlates network connection events with VirusTotal intelligence to identify potentially malicious communication.
This rule detects remote procedure calls (RPC) targeting the MS-SRVS interface (UUID: 4b324fc8-1670-01d3-1278-5a47bf6ee188) which is associated with the Server Service. Abuse of this service can be used for lateral movement within a network, potentially for creating remote shares or other administrative functions. The detection relies on logs from an RPC Firewall.
Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR. This rule specifically looks for EventID 3 in the RPCFW EventLog, indicating a blocked or audited RPC call, and targets the InterfaceUUIDs associated with the Encrypting File System Remote (EFSR) protocol.
Detects remote RPC calls to get event log information via the EVEN or EVEN6 interfaces, which can be indicative of reconnaissance activity by an attacker. This rule specifically targets RPC Firewall logs for these interface UUIDs.
This rule detects remote procedure call (RPC) activity related to the Print System Remote Protocol (MS-RPRN) and Print System Asynchronous Remote Protocol (MS-PAR) interfaces. Specifically, it looks for RPC Firewall events (EventLog: RPCFW, EventID: 3) where the InterfaceUuid matches known UUIDs associated with these printing protocols. This activity can indicate an attempt to abuse remote printing services for lateral movement within a network, potentially exploiting vulnerabilities like CVE-2021-34527 (PrintNightmare).
This rule detects when a file is downloaded from an IP address and subsequently created on a system, where both the file hash and the IP address are identified by VirusTotal Relationships as being associated with each other, specifically through a 'DOWNLOADED_FROM' relationship. This indicates that the downloaded file is known to have been served from that particular IP address, potentially flagging malicious file distribution.
Detects remote RPC calls to potentially abuse the Encrypting File System Remote (EFSR) protocol for lateral movement. This rule specifically looks for events from the RPC Firewall with a particular InterfaceUuid associated with MS-EFSR, indicating an attempt to interact with this service remotely.
This rule detects remote procedure calls (RPC) specifically targeting the Remote Registry Protocol (MS-RRP) interface (UUID: 338cd001-2244-31f1-aaaa-900038001003) for information collection. It filters out common administrative operations (OpNum 6, 7, 8, 13, 18, 19, 21, 22, 23, 35) to reduce false positives, focusing on suspicious reconnaissance activities against the registry from a remote system.
This rule detects when a known malicious file, identified by its SHA256 hash through VirusTotal relationships, attempts to contact a domain that VirusTotal also associates with that file. It correlates DNS query events with VirusTotal intelligence to identify suspicious network communications originating from potentially compromised systems.
This rule detects remote RPC calls specifically targeting the Task Scheduler service (SASec) to read information about scheduled tasks. This activity is often associated with reconnaissance by adversaries attempting to understand the environment's scheduled jobs.
This rule detects DNS queries to domains identified as Command and Control (C2) infrastructure within a Threat Intelligence (TI) feed, specifically MISP. It correlates DNS events with MISP data where the entity type is 'DOMAIN_NAME' and the threat summary indicates 'C2 domains'. The rule is designed to identify potential C2 communications from internal hosts.
Detects remote RPC calls to read information about scheduled tasks via AtScv. This activity can indicate an adversary performing reconnaissance to understand the environment and identify potential lateral movement opportunities.
Detects uncommon network connections to the Active Directory Web Services (ADWS) on port 9389 from processes not typically associated with ADWS management. This can indicate an adversary performing discovery of Active Directory information.
This rule detects web traffic to a recently expired domain followed by the creation of an executable (.exe) file on the same host. It correlates network access events with WHOIS data to identify expired domains and then looks for subsequent file creation events where the file path ends with '.exe'. The file creation must occur after the network access event on the same principal hostname.
This rule detects when a network connection is made to a domain that has expired. It leverages WHOIS data to identify domains whose expiration time is before the event timestamp. The rule specifically looks for HTTP network events and joins them with WHOIS information to identify access to recently expired domains. This could indicate access to potentially malicious infrastructure, as expired domains can be re-registered by threat actors for nefarious purposes.
This rule detects when a file, identified by its SHA256 hash, initiates a network connection to an IP address that is identified as a Tor exit node. The rule leverages VirusTotal relationships to link the file hash to the contacted IP address and Google Cloud Threat Intelligence (GCTI) Feed to identify Tor exit nodes. The risk score is increased if the Tor IP's geolocation is in certain countries (Cuba, Iran, North Korea, Russia, Syria).
This rule detects remote RPC calls made to query information about scheduled tasks. Specifically, it monitors for RPC Firewall events (EventID 3) with a specific InterfaceUuid (86d35949-83c9-4044-b424-db363231fd0c) which corresponds to the ITaskSchedulerService. The rule filters out common operational numbers (OpNum 1, 3, 4, 10, 11, 12, 13, 14, 15) to reduce false positives, focusing on less common or potentially malicious reconnaissance activities related to scheduled tasks.
This rule detects the use of the 'net use' command to connect to Windows administrative shares (C$, ADMIN$, IPC$) by users who are members of the 'Domain Admins' group. It specifically looks for process launch events where the command line contains 'net use' followed by one of the administrative share names. The rule correlates this activity with user entity data to identify if the executing user is part of the 'Domain Admins' group, indicating potential lateral movement or administrative activity.
Detects an initiated network connection by a non-browser process on the system to "azurewebsites.net". This domain has been frequently used by threat actors for malware hosting and data exfiltration. The rule filters out connections made by common web browsers and other legitimate applications to reduce false positives.
Page 232 of 246