Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
487 detections
Filters
Last updated
All Time
Detection languages
143
130
118
29
23
Contributors
84
68
57
54
30
Categories
179
155
151
107
91
Platforms
262
161
70
34
10
Products / Services
130
120
71
69
54
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
6
5
4
2
2
IDS Classtypes
66
37
14
9
4
IDS Protocols
37
30
27
14
9
KQL Query from file: GraphRunner Recon Detection & Response
KQL Query
KQL Query from file: DPRK (Famous Chollima) use of Astrill VPN
KQL Query from file: Sentinel - Threat Hunting DNS Tunneling
KQL Query from file: DefenderXDR - Threat Hunting DNS Tunneling
KQL Query
KQL Query from file: Detecting Twill Typhoon VSCode Exploit
KQL Query from file: Check for Azure Outdated Security Protocols
KQL Query from file: Hunting Zloader DNS Tunneling
KQL Query from file: BlueAlpha GammaDrop Detection
KQL Query from file: Hunting Aqua Blizzards
This rule detects changes to the Windows Registry key that controls the Remote Desktop Protocol (RDP) port number. Specifically, it triggers when the RDP port is modified from its default value of 3389 to any other port. This activity can be indicative of an adversary attempting to evade detection, bypass network filtering, or maintain persistence by configuring RDP to listen on a non-standard port.
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects port forwarding activity via SSH.exe
Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available.
Involved domains are bin.equinox.io for download and *.ngrok.io for connections.
Involved domains are bin.equinox.io for download and *.ngrok.io for connections.
Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443
Execution of plink to perform data exfiltration and tunneling
Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
Detects Silence EmpireDNSAgent as described in the Group-IP report
Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.
Page 20 of 24