Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,875 detections
Filters
Last updated
All Time
Detection languages
2,950
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,743
1,857
1,076
782
160
Products / Services
2,237
1,434
1,273
746
582
MITRE Techniques
2,448
2,147
1,128
937
787
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
This analytic identifies unexpected Active Directory replication traffic originating from non-domain controller sources. It specifically looks for network traffic associated with AD replication protocols (ms-dc-replication, drsr, ad drs). Such traffic should typically only occur between legitimate domain controllers. Detection of this activity from other sources may indicate malicious activities like DCSync or DCShadow, which are commonly used for credential dumping and could lead to unauthorized access and potential domain-wide compromise.
The analytic detects potential reverse shell activity by identifying connections involving ports commonly associated with remote access tools, shell listeners, or tunneling utilities. It leverages Cisco Secure Firewall Threat Defense logs and monitors destination ports against a list of non-standard, high-risk port values often used in post-exploitation scenarios. Adversaries frequently configure tools like netcat, Meterpreter, or other backdoors to listen or connect over uncommon ports such as 4444, 2222, or 51820 to bypass standard monitoring and firewall rules. If confirmed malicious, this activity may represent command and control (C2) tunneling, lateral movement, or unauthorized remote access.
This analytic detects file transfers flagged as malware that occurred over non-standard ports (other than 80 and 443) from Cisco Secure Firewall Threat Defense logs. Adversaries may attempt to bypass protocol-based detection or use alternate ports to blend in with other traffic. This analytic identifies these non-conventional flows and surfaces potential evasion techniques. If confirmed malicious, this indicates potential malware delivery or other nefarious activity.
The analytic detects the use of the `curl` command with proxy-related arguments such as `-x`, `socks`, `--preproxy`, and `--proxy`. This activity is significant as it may indicate an adversary attempting to use a proxy to evade network monitoring and obscure their actions. If confirmed malicious, this behavior could allow attackers to bypass security controls, making it difficult to track their activities and potentially leading to unauthorized data access or exfiltration.
The analytic detects outbound network connections from Java processes to default ports used by LDAP and RMI protocols, which may indicate exploitation of the CVE-2021-44228 Log4j vulnerability. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and network traffic logs. Monitoring this activity is crucial as it can signify an attacker’s attempt to perform JNDI lookups and retrieve malicious payloads. If confirmed malicious, this activity could lead to remote code execution and further compromise of the affected server.
This analytic detects Log4Shell JNDI payload injections via outbound connections. It identifies suspicious LDAP lookup functions in web logs, such as `${jndi:ldap://PAYLOAD_INJECTED}`, and correlates them with network traffic to known malicious IP addresses. This detection leverages web and network traffic data to identify attempts to exploit the Log4j vulnerability (CVE-2021-44228), which could lead to remote code execution and system compromise.
The following analytic identifies a non-lsass.exe process making an outbound connection on port 88, which is typically used by the Kerberos authentication protocol. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and network traffic logs. This activity is significant because, under normal circumstances, only the lsass.exe process should interact with the Kerberos Distribution Center. If confirmed malicious, this behavior could indicate an adversary attempting to abuse the Kerberos protocol, potentially leading to unauthorized access or lateral movement within the network.
Detects programs that connect to known malware callback ports based on threat intelligence reports. This rule specifically targets Linux systems and filters out connections to common local IP ranges to reduce false positives.
This rule detects the wmRAT backdoor by identifying specific byte patterns associated with its core functionalities. These functionalities include connecting to a command and control (C2) server, finding and exfiltrating files, receiving data and writing it to files, and gathering system information. The rule looks for a combination of these distinct byte patterns to minimize false positives.
Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet). The rule specifically looks for connections to Google API domains from processes that are not common web browsers or Google-related applications, aiming to identify potentially malicious command and control activity.
Estimate Access is an undocumented API in MS Graph and is used in the following GraphRunner functions Get-UpdatableGroups, Get-DynamicGroups and Invoke-GraphRecon. Although not inherently malicious, it does submit an action and then determines if the user can perform it
Detects network connections initiated by 'dfsvc.exe', which is responsible for handling ClickOnce applications, to non-local IP addresses. This activity can be indicative of malicious ClickOnce abuse for trusted code execution, especially when connecting to external or unexpected destinations.
This rule detects Denial of Service (DoS) activity originating from an Amazon EC2 instance, as identified by AWS GuardDuty. It specifically looks for GuardDuty findings where the product event type indicates a DenialOfService event and filters out any sample findings.
This rule identifies outbound network connections to Autonomous System Numbers (ASNs) that are present in a predefined watchlist named 'suspicious_asn'. It leverages geo-IP enrichment to extract the ASN of the target IP address and compares it against the watchlist. The rule is designed to detect communication with potentially malicious or suspicious network infrastructure.
This rule detects when an Amazon EC2 instance or a container attempts to communicate with a black hole IP address, as reported by AWS GuardDuty. Black hole IP addresses are typically used to sinkhole malicious traffic or are unroutable, indicating potentially suspicious or misconfigured outbound communication from a compromised or misbehaving resource.
This rule identifies outbound network connections to a specific Autonomous System Number (ASN). The rule is designed to detect suspicious network traffic that might indicate command and control activity, data exfiltration, or other malicious communications originating from the monitored environment to an ASN that has been deemed suspicious. The specific ASN to monitor is configured within the rule.
This rule detects activity associated with the Tor network within an AWS account, as identified by AWS GuardDuty. It specifically looks for GuardDuty findings related to TorIPCaller, TorRelay, or TorClient, indicating potential use of Tor for anonymization or command and control.
This rule identifies outbound network connections where the destination IP address is geo-located to a specific country, which is configured as 'France' in this instance. It can be adapted to monitor traffic to any country of interest. The rule itself does not specify malicious behavior but flags network communication to a particular geographic region. This could be indicative of potential data exfiltration, command and control (C2) communication, or unauthorized access attempts if the country is considered high-risk or unusual for the organization's normal operations.
DNS query to a recently created domain
Suspicious ASN Watchlist
YARA-L
Identify any network connections to a list of ASNs
Identify network traffic based on target country
Page 279 of 280