Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,872 detections
Filters
Last updated
All Time
Detection languages
2,949
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,438
11,829
5,872
5,150
4,864
Platforms
3,742
1,857
1,074
780
160
Products / Services
2,237
1,434
1,273
746
582
MITRE Techniques
2,448
2,144
1,128
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects outbound Network File System (NFS) connections originating from an internal network IP address to a public IP address. This activity is highly unusual for legitimate NFS usage and could indicate an attempt to download malware, exfiltrate data, or establish command and control, as observed with malware like RapperBot.
Detects outbound API calls to api.github.com for repository creation or file uploads matching patterns used in the s1ngularity supply chain attack.
This rule detects the presence of potentially malicious or unwanted browser extensions and outbound network connections to known adware or tracking domains. It correlates extension presence with network behavior to identify threats.
This rule detects the installation of potentially unwanted or suspicious applications, specifically looking for a sponsored version of FileZilla. It then correlates this installation with outbound network activity to public IP addresses, which could indicate telemetry, beaconing, data exfiltration, or command and control (C2) behavior.
This rule identifies devices connected to Wi-Fi networks with public IP addresses and correlates those connections with outbound network events. It aims to provide process-level context for connections originating from such network configurations, including geolocation of both local and remote IPs. This could indicate unusual or unauthorized network activity, potentially related to command and control or data exfiltration from devices on less secure network segments.
Detects potential Command and Control (C2) communication patterns based on ASIM-normalized network session data in Microsoft Sentinel. This detection covers three primary patterns:
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
Detects a process launching from a common user-writable directory that subsequently makes an external network connection. This behavior is consistent with malware, such as the Mythic agent used by RomCom, that performs an execution guardrail check (e.g., verifying the host's domain name) before initiating command and control communications.
The following analytic detects the execution of known remote access software within the environment. It leverages network logs mapped to the Web data model, identifying specific URLs and user agents associated with remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these utilities to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or further compromise the network, posing a severe security risk.
This rule detects PowerShell scripts that utilize web request cmdlets (Invoke-WebRequest, Invoke-RestMethod, irm, iwr) along with the '-UserAgent' parameter. Adversaries often modify user agents to mimic legitimate traffic or specific applications, blending in with normal network activity to evade detection while communicating with command and control servers or exfiltrating data.
This rule identifies network traffic to known Command and Control (C2) infrastructure associated with the Katz Stealer malware family. It uses a list of hardcoded IP addresses and domains from threat intelligence to detect suspicious outbound connections.
This detection identifies network traffic to or from IP addresses known to be associated with command and control (C2) infrastructure or active exploitation in recent SharePoint vulnerability campaigns. Communication with these IPs is a strong indicator of either an attempted attack or an existing compromise.
This analytic detects outbound connections from Cisco Secure Firewall Threat Defense to commonly abused file sharing and pastebin-style hosting domains. It specifically looks for allowed connections where the URL matches a predefined list of known data hosting or temporary storage services. These platforms are frequently used by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads. Identifying such connections can indicate potential abuse of legitimate infrastructure as part of an attacker's kill chain, suggesting tool staging, credential dumping, or outbound data leaks over HTTP(S).
This analytic detects outbound network connections initiated by command-line tools such as `curl` or `wget` as observed in Cisco Secure Firewall Threat Defense logs. It specifically looks for allowed connections where the `EVE_Process` or `ClientApplication` fields indicate the use of these utilities. While these tools have legitimate uses, adversaries frequently abuse them to download malicious payloads, retrieve additional tools, or establish staging infrastructure on compromised systems. Detection of this activity may indicate the download phase of an attack chain or the retrieval of command-and-control utilities.
The following analytic detects the use of the Background Intelligent Transfer Service (BITS) client application in allowed outbound connections. It leverages logs from Cisco Secure Firewall Threat Defense devices and identifies instances where BITS is used to initiate downloads from non-standard or unexpected domains. While BITS is a legitimate Windows service used for downloading updates, it is also commonly abused by adversaries to stealthily retrieve payloads or tools. This analytic filters out known Microsoft Edge update URLs and focuses on connections that may indicate suspicious or unauthorized file transfers. If confirmed malicious, this could represent a command and control (C2) channel or a download of malware or tooling as part of an attack chain.
Generic rule content from file: LOLBAS - Execution - Outbound Traffic to Suspicious TLD
KQL Query from file: Malicious NPM Package post install script
KQL Query
KQL Query from file: Social Engineering Attack Detection
KQL Query
KQL Query
KQL Query from file: External connection to High Risk Countries
Page 267 of 280