Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
737 detections
Filters
Last updated
All Time
Detection languages
363
124
60
58
36
Contributors
222
123
75
46
32
Categories
336
254
143
140
102
Platforms
526
385
292
80
34
Products / Services
161
158
114
72
47
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
737
CVEs
4
3
3
2
2
IDS Classtypes
17
2
1
1
IDS Protocols
15
2
2
1
Detects potential malicious .ICO files downloaded from a compromised 3CXDesktopApp via web requests to a malicious GitHub repository, indicative of the SmoothOperator campaign.
Detects the 3CXDesktopApp updater downloading a known compromised version of the 3CXDesktopApp software. This rule specifically looks for the 'update.exe' process within the 3CXDesktopApp directory being executed with command-line arguments indicating an update operation for version '18.12' via HTTP, which was associated with the supply chain compromise.
Page 36 of 36