Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
667 detections
Filters
Last updated
All Time
Detection languages
304
127
82
42
35
Contributors
151
83
80
37
31
Categories
442
354
165
142
112
Platforms
398
212
86
70
20
Products / Services
184
122
103
93
65
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
5
3
3
1
1
IDS Classtypes
74
35
7
6
3
IDS Protocols
71
22
17
7
2
Kimsuky continues to evolve its espionage toolkit with stealthy, fileless techniques. Their latest JavaScript dropper, disguised as Themes.js, leverages LOLBins, C2 over legitimate domains, and scheduled task persistence — all while staying under the radar.
ET MOBILE_MALWARE Klopatra CnC Domain in DNS Lookup (guncel-tv-player-lnat .]com)
ET MOBILE_MALWARE Observed Klopatra Domain (guncel-tv-player-lnat .]com) in TLS SNI
ET MOBILE_MALWARE Observed Klopatra Domain (adsservice2 .org) in TLS SNI
Detects network connections to Command and Control (C2) servers associated with the LANDFALL Android spyware. LANDFALL communicates over HTTPS, often on non-standard ports.
Syncthing is a peer-to-peer file synchronization utility, designed to sync files between devices on a local network or between remote devices over the Internet.
This utility to exfiltrate data, has been already abused to exfiltrate data by Malicious actor.
The following KQL Query detect connections to external IPs via the mentioned software and the corresponding country.
This utility to exfiltrate data, has been already abused to exfiltrate data by Malicious actor.
The following KQL Query detect connections to external IPs via the mentioned software and the corresponding country.
ET MOBILE_MALWARE Observed Klopatra Domain (adsservices .uk) in TLS SNI
ET MOBILE_MALWARE Klopatra CnC Domain in DNS Lookup (adsservice2 .org)
ET MOBILE_MALWARE Klopatra CnC Domain in DNS Lookup (adsservices .uk)
Detects HTTP POST requests to F5 BIG-IP management or shared endpoints that contain long, base64-encoded payloads. Threat actors may use this technique to upload webshells or stage data for exfiltration.
This rule detects HTTP GET requests for PNG files from github.com with a minimal set of HTTP headers. Specifically, it looks for requests where the total size of HTTP header names is less than 30 bytes and explicitly excludes common headers like 'user-agent', 'referer', 'accept', 'x-auth', and 'cookie'. This pattern could indicate an attempt to exfiltrate data or perform other covert communication using a simplified HTTP client, potentially to evade detection by security tools that expect full browser-like headers.
ET MALWARE TA398 CurlBack_RAT CnC Activity - Upload Results
ET MALWARE TA398 CurlBack_RAT CnC Activity - Fetch Commands M2
Detects processes with names used by Qilin malware (`hosts.exe`, `dato.exe`) that are launched without a visible window and subsequently make an outbound network connection. This pattern is indicative of a hidden C2 beacon, a technique used by Qilin to evade user detection.
Detects the use of various command-line utilities like PowerShell, curl, and wget to exfiltrate data via web requests, specifically looking for POST requests containing common system information or sensitive data commands.
Yara rule that detects EggStremeFuel backdoor.
This detection identifies network connections to external DNS servers over TCP (port 53) initiated by common scripting engines like PowerShell, Python, or WScript. While DNS over TCP is a valid protocol, it is less common for standard queries and is often used by malware for command and control (C2) or data exfiltration through DNS tunneling.
Detects communication to known Command and Control (C2) servers associated with the Equation Group, as identified in the operational notes from the ShadowBrokers leak. This rule specifically looks for network connections to or from the hardcoded IP addresses linked to Equation Group C2 infrastructure.
Detects potential data exfiltration activity associated with the 'Shai-Hulud' NPM package attack. This rule specifically looks for the execution of 'curl' with command-line arguments indicating data being sent ('-d') to a known malicious webhook.site URL.
The rule `MAL_GOLANG_STEALER_QBIT` is designed to detect the Qbit Stealer malware by identifying specific branding strings, setup configurations, and error messages commonly found within its binaries. The rule looks for strings like "qBit Stealer", "TRIAL VERSION - 24 Hour Access", "Stolen Folder Name:", "Max File Size(MB):", "Targeted File Extensions:", "[+] Logged into Mega", "[+] Loaded configJs", "Failed to load configJs", "Failed to archive files", "Failed to upload files", and "Failed to get file info". It also specifies a file size range between 7MB and 9MB. The rule `HUNT_QBIT_STEALER_DEV` aims to detect other software potentially created by the same author (n1k714i) by looking for developer-related strings such as "qbit@hitler.rocks", "n1k7l4i", "N1k7", and "CrabCat".
The following KQL query focuses on detecting cases where files are created, modified, or otherwise accessed via RDP from another computer. Its main objective is to verify whether, during an RDP session, the connection has mapped a local disk or other redirected device — allowing us to easily identify potential cases of data exfiltration through RDP file transfer
Page 26 of 32