Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,151 detections
Filters
Last updated
All Time
Detection languages
2,297
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,439
11,829
5,873
5,151
4,864
Platforms
2,854
2,017
813
521
213
Products / Services
1,334
1,144
831
576
366
MITRE Techniques
1,820
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects exploitation attempts using the JNDI-Exploit-Kit by looking for specific URI patterns in web server logs. These patterns are indicative of various JNDI injection payloads designed to achieve remote code execution, reverse shells, or memory shell deployments on vulnerable applications like Tomcat, Jetty, Weblogic, JBoss, Websphere, and Spring.
This rule detects a suspicious command sequence often associated with the JexBoss exploitation tool. Specifically, it looks for the execution of 'bash -c /bin/bash' followed by a network connection attempt using '&/dev/tcp/'. This combination indicates an attempt to establish a reverse shell or exfiltrate data over TCP.
Detects reconnaissance activities targeting privileged Active Directory users or groups by monitoring Windows Security Event ID 4661. The rule specifically looks for access attempts to objects identified as privileged users or groups based on their Security Identifier (SID) suffixes or names containing 'admin'. It filters out activity from machine accounts to reduce false positives.
Detects remote service activity by monitoring access to the 'svcctl' named pipe via the IPC$ share. This activity is indicative of an attacker attempting to interact with services on a remote system, often as part of lateral movement or persistence efforts.
This rule detects potential Command and Control (C2) communication associated with the Goofy Guineapig backdoor. It specifically looks for HTTP/S requests originating from a user agent string characteristic of the malware ('Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/54.0.2840.71 Safari/537.36') communicating with the domain 'static.tcplog.com'. This combination of user agent and destination domain is indicative of Goofy Guineapig C2 activity.
Detects a network connection initiated by the "hh.exe" process to HTTP destination ports (80 or 443). This activity could indicate the execution or download of remotely hosted Compiled HTML (.chm) files, which can be abused by adversaries to conceal and execute malicious code. This technique is often used for defense evasion and can bypass application controls.
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. This rule detects suspicious outbound SMTP connections by looking for connections to common SMTP ports (25, 587, 465, 2525) from processes that are not common mail client applications like Thunderbird or Outlook, or Microsoft Exchange Server processes.
This rule detects the execution of the `nslookup` command specifically querying for LDAP service records (`_ldap._tcp.dc._msdcs.`). This type of query is often used during the reconnaissance phase by attackers to discover Active Directory domain controllers and their associated services within a network. This activity can indicate an adversary attempting to map out the network infrastructure.
Detects the use of 'nltest.exe' with command-line arguments indicative of reconnaissance activity, specifically targeting domain trust discovery and domain controller enumeration. Adversaries often use 'nltest.exe' to gather information about the network environment, which can aid in lateral movement and privilege escalation within Windows domains.
Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicate a remote PowerShell connection, often associated with Windows Remote Management (WinRM). The rule filters out connections from common network service accounts and localhost to reduce false positives.
This rule detects the usage of the PowerShell cmdlet `Test-NetConnection` to probe network connectivity to a specified computer name and port, specifically looking for connections to ports other than the commonly used 80 or 443. This behavior can indicate an adversary attempting to establish or test communication channels over non-standard ports, potentially to bypass network defenses or obscure command and control activities.
This rule detects outbound network connections initiated by the `cmstp.exe` process. `cmstp.exe` is the Microsoft Connection Manager Profile Installer, and it is uncommon for this legitimate binary to initiate outbound network connections. Such activity could indicate an adversary is abusing `cmstp.exe` to proxy execution of malicious code, potentially for defense evasion or UAC bypass, by loading malicious INF files or scriptlets from remote servers.
Detects network connections to the Notion API (api.notion.com) from processes that are not recognized legitimate Notion applications or common web browsers. This rule aims to identify potential covert command and control (C2) channels, specifically referencing tools like "OffensiveNotion C2" which leverage Notion's infrastructure for malicious communication.
Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects suspicious network connections initiated by specific Windows binaries (regsvr32.exe, rundll32.exe, dllhost.exe) when they are executed without any command-line parameters. This behavior can indicate an attempt to evade detection by leveraging legitimate system binaries for malicious network communication, potentially associated with malware like Raspberry Robin.
This rule detects PowerShell scripts that add a Name Resolution Policy Table (NRPT) rule. An NRPT rule can be used to bypass the default DNS server and force DNS queries for specific namespaces to a different, specified DNS server. This technique can be used by adversaries to redirect traffic, potentially for command and control, data exfiltration, or to evade network filtering.
Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases. This rule identifies outbound network connections to a specific list of destination ports that have been historically associated with malware command and control (C2) communications. It filters out connections to local IP ranges and common system directories to reduce false positives.
Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe". This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.
This rule detects when the `IMEWDBLD.exe` process initiates a network connection. This behavior is suspicious because `IMEWDBLD.exe` is a legitimate Microsoft Windows component (Input Method Editor Word Dictionary Builder) that is not typically expected to make outbound network connections. Adversaries may abuse this utility as a Living Off The Land Binary (LOLBIN) to download additional payloads or exfiltrate data, leveraging its trusted status to evade detection. The detection focuses on the initiation of any network connection by this specific executable.
This rule detects instances where 'rundll32.exe' initiates an outbound network connection to a public IP address. It filters out connections to common local, private, and Microsoft-owned IP ranges, as well as specific legitimate command lines and Azure internal hostnames, to reduce false positives. The rule aims to identify suspicious network activity originating from rundll32.exe, which is often abused by malware for defense evasion and execution.
Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and make network connections. This rule specifically looks for wuauclt.exe making network connections with the '/RunHandlerComServer' command-line argument, while filtering out common internal IP ranges and known Microsoft update server IP ranges to reduce false positives. It also filters out specific command-line patterns related to legitimate Windows Update deployments.
Page 241 of 246