Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,231 detections
Filters
Last updated
All Time
Detection languages
2,425
1,435
704
406
354
Contributors
1,092
1,080
584
397
348
Categories
2,148
1,822
1,780
1,305
888
Platforms
4,254
1,450
904
584
182
Products / Services
1,573
855
774
655
512
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects an initiated network connection by a non-browser process on the system to "azurewebsites.net". This domain has been frequently used by threat actors for malware hosting and data exfiltration. The rule filters out connections made by common web browsers and other legitimate applications to reduce false positives.
Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.
Detects a Mesh Agent service installation. Mesh Agent is used to remotely manage computers
Detects a TacticalRMM service installation. Tactical RMM is a remote monitoring & management tool.
Detects a DNS query by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.
Detects DNS queries to a TeamViewer domain only resolved by a TeamViewer client by an image that isn't named TeamViewer (sometimes used by threat actors for obfuscation)
Detects the creation of file with specific names used by RemoteKrbRelay SMB Relay attack module.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects the creation of log files during a TeamViewer remote session
Detects incoming connections to AnyDesk. This could indicate a potential remote attacker trying to connect to a listening instance of AnyDesk and use it as potential command and control channel.
Detects potential RDP connection via Mstsc using a local ".rdp" file located in suspicious locations.
Detects the execution of Microsoft Quick Assist tool "QuickAssist.exe". This utility can be used by attackers to gain remote access.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects a tscon.exe start as LOCAL SYSTEM
Detects DNS queries to domains commonly used by threat actors to host malware payloads or redirect through URL shorteners.
These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc.
Such DNS activity can indicate potential delivery or command-and-control communication attempts.
These include platforms like Cloudflare Workers, TryCloudflare, InfinityFree, and URL shorteners such as tinyurl and lihi.cc.
Such DNS activity can indicate potential delivery or command-and-control communication attempts.
Detects Deno writing a file from a direct HTTP(s) call to the AppData folder or introducing its own malicious DLL. This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through Deno.
Detects network connections with a suspicious user-agent string containing "katz-ontop", which may indicate Katz Stealer activity. This specific user-agent string is likely hardcoded or characteristic of the malware's C2 communication.
Detect DNS events that communicate with gaming sites in MISP. These violate policy.
Finger.EXE Execution
YARA-L
Detects execution of the finger.exe utility. Finger.EXE or \"TCPIP Finger Command\" is an old utility that is still present on modern Windows installation. It Displays information about users on a specified remote computer (typically a UNIX computer) that is running the finger service or daemon. Due to the old nature of this utility and the rareness of machines having the finger service. Any execution of finger.exe can be considered suspicious and worth investigating.
Detects a suspicious certreq execution taken from the LOLBAS examples, which can be abused to download (small) files
IOC Domain C2
YARA-L
Detect DNS events that indicate communication to a C2 domain in MISP
Page 275 of 297