Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,588 detections
Filters
Last updated
All Time
Detection languages
1,194
459
310
204
161
Contributors
487
455
323
171
123
Categories
1,884
937
415
400
360
Platforms
1,349
560
343
329
257
Products / Services
601
314
306
286
271
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
2,588
CVEs
9
5
5
5
2
IDS Classtypes
142
96
49
11
6
IDS Protocols
177
49
44
17
4
Detects the export of the target Registry key to a file.
This rule detects HTTP GET requests for PNG files from github.com with a minimal set of HTTP headers. Specifically, it looks for requests where the total size of HTTP header names is less than 30 bytes and explicitly excludes common headers like 'user-agent', 'referer', 'accept', 'x-auth', and 'cookie'. This pattern could indicate an attempt to exfiltrate data or perform other covert communication using a simplified HTTP client, potentially to evade detection by security tools that expect full browser-like headers.
ET MALWARE TA398 CurlBack_RAT CnC Activity - Upload Results
ET MALWARE TA398 CurlBack_RAT CnC Activity - Fetch Commands M2
NTDS theft
KQL
Microsoft has observed compromises related to Bazacall resulting in theft of the Active Directory database using ntdsutil.exe.
To detect sensitive or confidential information sent by email from our users, I discovered that DefenderXDR is registering events when some user or services is reading files tagged or marked as sensitive. Basically, it has a "SensitiveFileRead" ActionType in the DeviceFileEvents table which indicates that a process on the monitored device has accessed a file classified as sensitive. This could include files with personally identifiable information (PII), intellectual property, or other data deemed sensitive based on the organization’s data protection policies or Microsoft’s predefined rules. This event type is essential for tracking access to sensitive data, helping to identify potential data leakage or unauthorized access attempts.
Detects when the policy allowing forks of private and internal repositories is changed (enabled or cleared) within a GitHub enterprise environment. This action can indicate an attempt to exfiltrate data by creating copies of sensitive repositories or a change in security posture.
Detects processes with names used by Qilin malware (`hosts.exe`, `dato.exe`) that are launched without a visible window and subsequently make an outbound network connection. This pattern is indicative of a hidden C2 beacon, a technique used by Qilin to evade user detection.
Detects when a GitHub Pages site of a repository is made public. This action, while potentially part of a legitimate publishing process, could also indicate an adversary attempting to expose sensitive information or code publicly. Monitoring this activity helps identify potential unauthorized data exposure.
Detects when a GitHub repository or an organization is transferred to another location. This activity can indicate an attempt to exfiltrate sensitive data, establish persistence in a new location, or disrupt operations by moving critical assets. The rule specifically monitors GitHub audit logs for actions such as 'migration.create' (creation of a migration file for data transfer), 'org.transfer_outgoing' or 'org.transfer' (transfer of an organization between enterprise accounts), and 'repo.transfer_outgoing' (transfer of a repository to another network).
This detection monitors the CommonSecurityLog (which adheres to the Common Event Format - CEF) for indications of malicious network activity. Specifically, it flags outgoing HTTP requests originating from system utilities such as curl, wget, and PowerShell. These requests are often leveraged by attackers for data theft (exfiltration) or establishing command-and-control channels.
Review the full user agent string and destination hostname. Investigate the source IP and user context. Check whether the tool usage aligns with expected behavior for the host or user. Correlate with other indicators such as unusual process execution, file access, or authentication anomalies. Escalate if the destination is unknown or suspicious. Remove the KQL summarise line to view more details.
UA_Check and SafeHosts will require tuning for your specific environment setup and traffic.
Review the full user agent string and destination hostname. Investigate the source IP and user context. Check whether the tool usage aligns with expected behavior for the host or user. Correlate with other indicators such as unusual process execution, file access, or authentication anomalies. Escalate if the destination is unknown or suspicious. Remove the KQL summarise line to view more details.
UA_Check and SafeHosts will require tuning for your specific environment setup and traffic.
Detects Airstalk malware, used by the CL-STA-1009 threat cluster. This rule identifies both PowerShell and .NET variants that misuse the AirWatch MDM API for C2 and data exfiltration.
Detects a suspicious Salesforce OAuth login followed by high-volume data exfiltration activity within a short period. This pattern is associated with the threat actor UNC6040, which uses malicious or compromised OAuth applications to steal data.
This rule detects a sequence of events indicative of a potential macOS ClickFix attack. It looks for a base64 encoded command executed by 'bash' or 'zsh', immediately followed (within 10 seconds) by a 'curl' command that initiates a network connection to a URL. The rule specifically excludes a whitelisted curl command to reduce false positives. The correlation of base64 execution, a subsequent curl command, and a successful network connection to the domain extracted from the curl command suggests an attempt to download and execute malicious content, possibly after decoding it.
Detects the use of various command-line utilities like PowerShell, curl, and wget to exfiltrate data via web requests, specifically looking for POST requests containing common system information or sensitive data commands.
Yara rule that detects EggStremeFuel backdoor.
This rule detects the execution of Python web servers via the command line interface (CLI) on Linux systems. Adversaries often use Python's built-in HTTP server modules (like `http.server` or `SimpleHTTPServer`) in post-exploitation scenarios to quickly establish a web server without needing to install additional software. This allows them to easily transfer files between a compromised host and attacker-controlled systems, facilitating data exfiltration or further payload delivery.
This detection identifies network connections to external DNS servers over TCP (port 53) initiated by common scripting engines like PowerShell, Python, or WScript. While DNS over TCP is a valid protocol, it is less common for standard queries and is often used by malware for command and control (C2) or data exfiltration through DNS tunneling.
Detects a copy command or a copy utility execution to or from an Admin share or remote
Detects when an Azure Blob Storage container's access level is changed to allow public access, or when a long-lived, highly privileged Shared Access Signature (SAS) token is created. Threat actors can use these methods for persistence and data exfiltration.
Detects communication to known Command and Control (C2) servers associated with the Equation Group, as identified in the operational notes from the ShadowBrokers leak. This rule specifically looks for network connections to or from the hardcoded IP addresses linked to Equation Group C2 infrastructure.
Page 94 of 124