Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,259 detections
Filters
Last updated
All Time
Detection languages
1,550
1,190
352
288
225
Contributors
792
520
494
354
298
Categories
1,717
1,495
401
382
376
Platforms
3,058
530
334
314
258
Products / Services
778
656
633
283
238
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
4,259
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
This rule detects the wmRAT backdoor by identifying specific byte patterns associated with its core functionalities. These functionalities include connecting to a command and control (C2) server, finding and exfiltrating files, receiving data and writing it to files, and gathering system information. The rule looks for a combination of these distinct byte patterns to minimize false positives.
Yara rule that detects GobRAT backdoor.
Yara rule that detects wmRAT backdoor.
Detects the execution of 'netscan.exe' from SoftPerfect, a network scanning application. This tool is frequently used by threat actors for network reconnaissance to map out network architecture within compromised environments.
Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network. This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT.
Detects the execution of Notepad to open a file that has the string "password" in its name and a common extension (txt, csv, doc, xls). This activity may indicate unauthorized access to credentials or suspicious reconnaissance.
This YARA rule detects the MiyaRAT backdoor by identifying specific byte patterns associated with its functionalities. The rule looks for distinct code sequences related to obtaining disk information, gathering operating system details, and taking screenshots. The presence of all these patterns within a single executable indicates the presence of MiyaRAT.
This rule detects the enumeration of members within groups in Microsoft Entra ID (formerly Azure AD) via the Microsoft Graph API. Specifically, it looks for GET requests to the `/v1.0/groups/*/members` endpoint, which is indicative of an attempt to list group members. The rule's description notes that it is based on the behavior of the GraphRunner tool's `Get-SecurityGroups` function, suggesting it targets a specific method of enumeration.
This rule detects attempts to retrieve the Microsoft Graph authorization policy, specifically targeting the `/policies/authorizationPolicy` endpoint. This policy contains sensitive information about who can create applications, invite guest users, and other critical settings within Entra ID (formerly Azure AD). Such requests are typically made by administrators for review or modification, and unexpected calls to this endpoint could indicate reconnaissance or unauthorized access attempts. The rule filters for successful GET requests (HTTP 200) and excludes known Azure IP ranges to reduce false positives.
This rule detects the enumeration of applications and service principals within Microsoft Entra ID (formerly Azure AD) via the Microsoft Graph API. Specifically, it looks for two sequential GET requests: one to the `/v1.0/applications` endpoint and another to the `/v1.0/servicePrincipals(appId='<GUID>')/appRoleAssignedTo` endpoint. This activity is indicative of tools like GraphRunner's Invoke-DumpApps function, which collects information about applications, external applications, and users who have consented to permissions within those applications. The rule correlates these events by IP address and session ID within a 5-minute window.
This rule identifies enumeration of user inboxes within an Entra ID tenant via the Microsoft Graph API. It specifically looks for multiple GET requests to the `/v1.0/users/*/mailFolders/Inbox/messages` endpoint from a single IP address and session within a 5-minute window. The detection is based on the behavior of tools like Invoke-GraphOpenInboxFinder in GraphRunner, but is applicable to any tool performing similar inbox scanning. The rule provides outcomes detailing the number of scanned users, successful accesses (HTTP 200), forbidden accesses (HTTP 403), and not found inboxes (HTTP 404).
This rule detects the use of the GraphRunner tool's Invoke-GraphRecon command to enumerate permissions and conditional access data within the Microsoft Graph API. It specifically looks for a sequence of three API calls: 'estimateAccess', '/me', and 'policies/authorizationPolicy' originating from the same IP address and within a 5-minute window. This activity is indicative of an attacker or red teamer performing reconnaissance on an Azure AD environment.
Detects when mail items are accessed via API through an Entra ID application that is not explicitly approved. This rule specifically looks for 'MailItemsAccessed' events in Office 365 where the accessing application's ClientAppId does not match known legitimate Microsoft applications like Exchange Online, Substrate Context Service, or Microsoft Office. This could indicate unauthorized access to mailboxes by a suspicious application.
This rule detects API requests to the Microsoft Graph search/query endpoint. This endpoint can be used by adversaries to enumerate items such as SharePoint site URLs, which is a common technique used by tools like GraphRunner's Get-SharePointSiteURLs function. The detection specifically looks for successful POST requests to 'https://graph.microsoft.com/v1.0/search/query'.
This rule detects requests to the Microsoft Graph API endpoint for listing applications (https://graph.microsoft.com/v1.0/applications). This activity can be indicative of reconnaissance by an attacker attempting to enumerate applications within an Entra ID (Azure AD) environment. The rule specifically looks for successful GET requests (HTTP 200 response code) to this endpoint.
This rule detects calls to the undocumented 'Estimate Access' API in Microsoft Graph. This API is used by tools like GraphRunner for reconnaissance purposes, specifically to determine what actions a user can perform. While not inherently malicious, its use can indicate an adversary attempting to enumerate permissions or discover accessible resources within an Azure environment. The rule filters for successful POST requests to the specific beta endpoint and excludes certain Microsoft IP ranges to reduce false positives.
This rule detects the enumeration of both users and group members within an Entra ID (formerly Azure Active Directory) tenant via the Microsoft Graph API. It specifically looks for two distinct HTTP GET requests originating from the same IP address and within a 15-minute window: one targeting the `/v1.0/users` endpoint and another targeting the `/v1.0/groups/*/members` endpoint. This activity is often associated with reconnaissance efforts, such as those performed by tools like GraphRunner, to map out an organization's user and group structure.
This rule detects attempts to enumerate updatable groups within Microsoft Entra ID (formerly Azure Active Directory) using the Microsoft Graph API. Specifically, it looks for a combination of a GET request to the `/v1.0/groups` endpoint and a POST request to the `/beta/roleManagement/directory/estimateAccess` endpoint within a 5-minute window from the same IP address and session. This activity is indicative of tools like GraphRunner's `Get-UpdatableGroups` function, which adversaries might use to identify groups they can modify for privilege escalation or persistence.
This rule detects requests to the Microsoft Graph API's '/v1.0/users' endpoint with a GET method and a successful 200 response code. This API call is used to enumerate users within an Azure Active Directory environment. The rule is designed to identify potential reconnaissance activities where an attacker might be collecting a listing of users. It notes that this can be a 'chatty' API call, meaning it might generate a high volume of legitimate traffic.
Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.
Detects command line patterns associated with the use of Pnscan for sending and receiving binary data across the network.
This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT
This behavior has been identified in a Linux malware campaign targeting Docker, Apache Hadoop, Redis, and Confluence and was previously used by the threat actor known as TeamTNT
Page 179 of 203