Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,875 detections
Filters
Last updated
All Time
Detection languages
2,950
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,743
1,857
1,076
782
160
Products / Services
2,237
1,434
1,273
746
582
MITRE Techniques
2,448
2,147
1,128
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account. This could potentially indicates a remote PowerShell connection.
Detects network web access to a low prevalence domain
Alert on downloading a known file hash from a known IP with VT Relationships.
Detects a process setting the RunOnce registry key and making suspicious network connections associated with DarkCloud Stealer.
IOC IP Target
YARA-L
Detect network events that indicate communication to a watchlisted IP address
Detect network connection to an ip address that was only seen for the first time in the past 24 hours
Alert on known Hash querying a known hostname with VT Relationships
Alert on downloading a known file hash from a known IP with VT Relationships.
Example usage of WHOIS data, detecting an executable file download from a domain that's recently expired
Executable downloaded by Microsoft Excel by user with GCP entity relationship
GCTI Tor Exit Nodes
YARA-L
Alert traffic destined for known Tor exit nodes
Alert on known Hash contacting Tor IP with VT Relationships.
This analytic detects Lumma Stealer outbound connection attempts using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signatures with specific IDs have been triggered. If confirmed malicious, this behavior could indicate an active infection of Lumma Stealer.
Detects uncommon outbound network activity via Kerberos default port (88) indicating possible lateral movement or initial privilege escalation through delegation. The rule specifically filters out common legitimate processes like LSASS, Chrome, Firefox, and Tomcat that might generate similar network activity, aiming to reduce false positives.
Alert on Benign Binary contacting a TOR IP
A malicious file contacting a known Tor Exit Node.
IP Target Prevalence
YARA-L
Detect events that are communicating to IP addresses that have a low rolling max prevalence.
Alert on known Hash contacting known IP with VT Relationships
Detects outbound network connections initiated by `dialer.exe`, an outdated Microsoft utility. This process is known to be targeted by info-stealers for process injection and used to establish command and control (C2) connections, with Rhadamanthys being a common example. The rule filters out connections to common local and private IP ranges to reduce false positives.
This rule detects suspicious PowerShell invocations characterized by specific command parameters often used in malicious activities. It looks for combinations of parameters like '-nop', '-w hidden', '-c', and '[Convert]::FromBase64String' for base64 encoded commands; '-w hidden', '-noni', '-nop', '-c', 'iex', and 'New-Object' for obfuscated execution; '-w hidden', '-ep bypass', and '-Enc' for encoded command execution; PowerShell commands interacting with 'reg add' to modify 'Run' keys for persistence; and PowerShell using 'New-Object System.Net.WebClient' with '.Download' for downloading content from the internet, often with 'bypass' and 'hidden' window styles. These patterns are commonly associated with malware, post-exploitation frameworks, and adversary tradecraft.
Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.
Page 278 of 280