Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,223 detections
Filters
Last updated
All Time
Detection languages
2,420
1,435
704
406
354
Contributors
1,092
1,080
584
397
348
Categories
2,145
1,820
1,775
1,301
888
Platforms
4,250
1,450
901
581
181
Products / Services
1,571
855
774
655
512
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
This rule detects the execution of specific binaries identified as being used by the UNC4841 threat group to deploy the SEASPY backdoor. The binaries include 'BarracudaMailService', 'resize2fstab', and 'resize_reisertab'. Detection is based on the image path ending with any of these specific names.
Detects the execution of the 'curl' command on Linux systems when it includes options to set a custom user agent. This behavior can be indicative of command and control communication or data exfiltration attempts where an adversary tries to mimic legitimate web traffic or evade detection by changing the default user agent string.
Finger.EXE Execution
Sigma
Detects the execution of the "finger.exe" utility, which is an old Windows utility used to display information about users on a remote computer running the finger service. Due to its age and the rarity of the finger service being active, any execution of this utility is considered suspicious and warrants investigation.
This rule detects DNS queries to specific malicious domains associated with the GALLIUM threat group, as identified by Microsoft Threat Intelligence Center in December 2019. The rule specifically looks for Event ID 257 in the Microsoft-Windows-DNS-Server/Analytical log, where the queried domain name (QNAME) matches a predefined list of indicators.
Detects potential C2 communication related to Devil Bait malware by identifying specific URI patterns in GET requests. The rule looks for URIs containing '/cross.php?op=', '&dt=', and '&uid=' which are indicative of Devil Bait's communication with its command and control server.
Detects potential beaconing activity to domains associated with the 3CXDesktopApp supply chain compromise. This rule specifically looks for DNS queries to known malicious domains identified during the compromise.
Detects potential malicious .ICO files downloaded from a compromised 3CXDesktopApp via web requests to a malicious GitHub repository, indicative of the SmoothOperator campaign.
This rule detects the execution of specific commands associated with the installation of the Triple Cross eBPF rootkit. It looks for commands executed via 'sudo' that contain specific 'tc' (traffic control) parameters, including 'qdisc' and 'filter', along with a network interface like 'enp0s3'. These command line arguments are characteristic of the 'deployer.sh' script used by the Triple Cross rootkit to establish persistence and hide its presence using eBPF.
This rule detects suspicious Windows file path strings (e.g., 'C:/Users', 'C:/Windows', 'C:/Program Files') within the URI query component of web requests. The presence of such strings in a URI could indicate an attempt to exfiltrate data from a Windows system or communicate with a webshell that is attempting to access local files or directories. The rule looks for both standard and URL-encoded variations of these paths.
Detects cases where ngrok, a legitimate reverse proxy tool, is used to forward traffic to the local Remote Desktop Protocol (RDP) port. This activity can indicate malicious behavior, as adversaries often use tools like ngrok for command and control, bypassing firewalls, or establishing persistent remote access to compromised systems.
Detects the presence of Silence EmpireDNSAgent by looking for specific PowerShell script block text patterns associated with both the Empire post-exploitation framework and Dnscat2 tunneling. The rule combines keywords related to system shutdown/reboot, process manipulation, and DNS tunneling techniques used by this malware.
This rule detects the execution of 'plink.exe' with command-line arguments indicative of RDP tunneling. Specifically, it looks for 'plink.exe' combined with ':127.0.0.1:3389' or ':3389' along with '-P 443' or '-P 22'. This activity suggests an adversary is using Plink to establish a tunnel, potentially to exfiltrate data or maintain covert access to a remote desktop session.
This rule detects the potential use of an SSH utility to establish Remote Desktop Protocol (RDP) over a reverse SSH Tunnel. Attackers commonly use this technique to enable routing of network packets that would otherwise not reach their intended destination, bypassing network segmentation or firewalls. The detection logic looks for command-line arguments containing the RDP port ':3389' in conjunction with common SSH tunneling switches such as '-L', '-P', '-R', '-pw', or '-ssh'.
This rule detects a specific HTTP GET request pattern associated with potential exploitation of CVE-2023-36884 by the RomCom threat group. The pattern involves a URI containing '/MSHTML_C7/' and a query parameter 'd' followed by an IPv4 address.
Detects potential beaconing activity to known malicious domains associated with the 3CXDesktopApp supply chain compromise. This rule specifically looks for connections through a proxy to a list of hardcoded domains identified as indicators of compromise (IOCs) during the 3CXDesktopApp incident.
This rule detects sign-in attempts originating from IP addresses that have been identified as infected with malware. These malware-infected IP addresses are known to actively communicate with bot servers, indicating a high risk of compromise or malicious activity associated with the sign-in.
Detects when Microsoft Cloud App Security reports an activity originating from a country that has not been recently or ever visited by any user within the organization. This indicates potential unauthorized access or anomalous user behavior from an unusual geographic location.
Detects connections made by Microsoft BITSAdmin to domains using uncommon Top-Level Domains (TLDs). This can indicate command and control activity or data exfiltration where an adversary is attempting to blend in with legitimate traffic but using less common TLDs to avoid common filtering.
Detects a specific URL pattern containing a specific extension and parameters pointing to an IP address. This pattern was seen being used by RomCOM potentially exploiting CVE-2023-36884. The rule looks for GET requests where the URI contains a file extension like .zip, .asp, .htm, .url, .xml, .chm, .mht, .vbs, or .search-ms, followed by '?d=' and an IPv4 address.
Detects HTTP GET requests for specific file paths associated with the RomCom threat actor, potentially exploiting CVE-2023-36884. These file paths include various file types such as .url, .search-ms, .vbs, .mht, and .asp, which are likely used for initial access or further stages of the attack.
Detects access to a file share with a specific naming schema ('\MSHTML_C7\' and an IP address pattern) that has been observed during exploitation of CVE-2023-36884. This rule looks for Windows Security Event ID 5140 (A network share object was accessed) where the ShareName or ShareLocalPath contains the characteristic string and an IP address.
Page 287 of 297