Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects phishing emails with malicious HTML attachments designed to harvest credentials and exfiltrate them via the Telegram Bot API. The detection looks for specific attachment filenames (e.g., RFQ, INQUIRY) or content patterns indicative of this threat.
A composite detection rule that identifies multiple techniques, tactics, and procedures (TTPs) associated with the RansomHub intrusion detailed in "The DFIR Report". This rule focuses on process creation events and flags the execution of specific credential dumping tools, network scanners, defense evasion commands, ransomware behaviors, and exfiltration tool chains. An alert from this rule indicates a high probability of malicious activity consistent with this threat actor's methodology.
ET MOBILE_MALWARE Klopatra CnC Domain in DNS Lookup (guncel-tv-player-lnat .]com)
ET MOBILE_MALWARE Observed Klopatra Domain (guncel-tv-player-lnat .]com) in TLS SNI
ET MOBILE_MALWARE Observed Klopatra Domain (adsservice2 .org) in TLS SNI
Detects network connections to Command and Control (C2) servers associated with the LANDFALL Android spyware. LANDFALL communicates over HTTPS, often on non-standard ports.
Detects network traffic to Large Language Model (LLM) providers that have not implemented mitigations for the Whisper Leak side-channel attack. Communication with these providers is more susceptible to topic inference attacks.
Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations
Detects execution of RClone utility for exfiltration as used by various ransomwares strains like REvil, Conti, FiveHands, etc
Syncthing is a peer-to-peer file synchronization utility, designed to sync files between devices on a local network or between remote devices over the Internet.
This utility to exfiltrate data, has been already abused to exfiltrate data by Malicious actor.
The following KQL Query detect connections to external IPs via the mentioned software and the corresponding country.
This utility to exfiltrate data, has been already abused to exfiltrate data by Malicious actor.
The following KQL Query detect connections to external IPs via the mentioned software and the corresponding country.
ET MOBILE_MALWARE Observed Klopatra Domain (adsservices .uk) in TLS SNI
ET MOBILE_MALWARE Klopatra CnC Domain in DNS Lookup (adsservice2 .org)
ET MOBILE_MALWARE Android/TrickMo.Banker POST Request
ET MOBILE_MALWARE Klopatra CnC Domain in DNS Lookup (adsservices .uk)
Detects HTTP POST requests to F5 BIG-IP management or shared endpoints that contain long, base64-encoded payloads. Threat actors may use this technique to upload webshells or stage data for exfiltration.
Cisco Stage Data
Sigma
Various protocols maybe used to put data on the device for exfil or infil
DNS TOR Proxies
Sigma
Identifies IPs performing DNS lookups associated with common Tor proxies.
Detects the use of rclone, a command-line program to manage files on cloud storage, via its default user-agent string
Detects usage of the powerShell New-MailboxExportRequest Cmdlet to exports a mailbox to a remote or local share, as used in ProxyShell exploitations
Detects when a user performs data exfiltration by using DataSvcUtil.exe
Detects the export of a crital Registry key to a file.
Page 93 of 124