Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,227 detections
Filters
Last updated
All Time
Detection languages
2,421
1,435
704
406
354
Contributors
1,092
1,080
584
397
348
Categories
2,147
1,820
1,777
1,302
888
Platforms
4,250
1,450
902
582
182
Products / Services
1,571
855
774
655
512
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains. This behavior can indicate data exfiltration or the staging of malicious tools.
Detects the execution of the "cloudflared" binary from a non standard location.
Detects creation of an ad-hoc Cloudflare Quick Tunnel, which can be used to tunnel local services such as HTTP, RDP, SSH and SMB.
The free TryCloudflare Quick Tunnel will generate a random subdomain on trycloudflare[.]com, following a call to api[.]trycloudflare[.]com.
The tool has been observed in use by threat groups including Akira ransomware.
The free TryCloudflare Quick Tunnel will generate a random subdomain on trycloudflare[.]com, following a call to api[.]trycloudflare[.]com.
The tool has been observed in use by threat groups including Akira ransomware.
Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.
Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.
Detects the execution of a renamed "cloudflared" binary.
This rule detects the Voldemort backdoor by identifying specific byte patterns related to its configuration decryption, general decryption algorithm, access token request mechanism, network communication routines, and data download functions from its command and control (C2) server. The rule looks for a combination of these distinct code segments within a Windows executable (MZ header).
This rule detects a specific command-line execution pattern used by the threat actor 'Lace Tempest' to download 'Cobalt Strike'. The pattern involves PowerShell's 'IEX ((new-object net.webclient).downloadstring(' command, which is commonly used for in-memory execution of downloaded scripts or payloads. The detection specifically looks for the combination of '-nop -w hidden -c IEX ((new-object net.webclient).downloadstring(' and '/a') in the command line, indicating an attempt to download and execute a script, likely a Cobalt Strike payload, as reported by the SysAid Team.
Detects DNS query requests to Visual Studio Code tunnel domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects the use of 'IMEWDBLD.exe', a legitimate Microsoft binary, to download arbitrary files from HTTP or HTTPS sources. This technique is often abused by adversaries for ingress tool transfer or to fetch additional malicious payloads, leveraging a trusted binary to bypass defenses.
Detects the creation of 'Autoit3.exe' by uncommon or suspicious processes such as 'curl.exe', 'KeyScramblerLogon.exe', 'ExtExport.exe', or 'wmprph.exe'. This activity is associated with DarkGate malware, which leverages 'Autoit3.exe' to execute shellcode for process injection and C2 communication. The identified parent processes are considered non-standard for creating this executable.
Detects the execution of a shell (PowerShell, Bash, WSL) via a Visual Studio Code tunnel. Attackers can abuse this functionality to establish a C2 channel and execute arbitrary commands on the system.
This rule detects the creation of a file named "code_tunnel.json". This file is associated with the execution and usage of the Visual Studio Code (VSCode) tunneling utility. Adversaries can abuse this functionality to establish a command and control (C2) channel, allowing them to remotely control compromised systems.
Detects command execution events originating from ScreenConnect, a legitimate remote administration tool. This rule specifically looks for Windows application log events where ScreenConnect is the provider and an event ID of 200 indicates a command of a certain length was executed. This activity can be indicative of an attacker using ScreenConnect for malicious purposes, such as executing arbitrary commands on a compromised system.
Detects the creation of files by the "node.exe" process within the ".vscode-server" directory, specifically targeting paths related to user history. This activity could indicate remote file creation via the Visual Studio Code tunnel feature, which might be used for unauthorized access or data transfer.
This rule detects the installation of Visual Studio Code Tunnel (code-tunnel) as a Windows service. Adversaries may use legitimate tools like VS Code Tunnel for command and control (C2) to establish persistent communication channels that blend in with normal network traffic, making detection more difficult. The detection logic specifically looks for command-line arguments indicative of service installation, including 'tunnel', 'service', 'internal-run', and 'tunnel-service.log'.
Detects when files are transferred using the ScreenConnect Remote Monitoring and Management (RMM) tool. This activity can indicate an adversary using legitimate tools for data exfiltration or staging.
This rule detects DNS queries to specific domains identified as indicators of compromise (IOCs) associated with the Diamond Sleet APT group. The domains '3dkit.org', 'dersmarketim.com', 'galerielamy.com', and 'olidhealth.com' are known to be used by this threat actor for command and control (C2) communications. Monitoring for these specific DNS queries can help identify systems potentially compromised by Diamond Sleet.
Detects the creation of a file named "code_tunnel.json" when the creating process is not a legitimate Visual Studio Code executable. This indicates potential execution and usage of the VsCode tunneling utility by an unauthorized or renamed process, which could be used for command and control.
Detects the creation of temporary files by the ScreenConnect remote monitoring and management (RMM) tool in a specific user document directory. This behavior is associated with ScreenConnect's feature to remotely execute binaries on a target machine, where these binaries are first dropped to the specified temporary location before execution.
Detects when the CertOC.exe utility is used to download a file from an IP address-based URL. This behavior is suspicious as CertOC.exe is a legitimate Windows binary that can be abused for ingress tool transfer, and downloading from an IP address directly often bypasses DNS-based security controls and can indicate malicious activity.
Page 283 of 297