Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,223 detections
Filters
Last updated
All Time
Detection languages
2,420
1,435
704
406
354
Contributors
1,092
1,080
584
397
348
Categories
2,145
1,820
1,775
1,301
888
Platforms
4,250
1,450
901
581
181
Products / Services
1,571
855
774
655
512
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. This rule detects suspicious outbound SMTP connections by looking for connections to common SMTP ports (25, 587, 465, 2525) from processes that are not common mail client applications like Thunderbird or Outlook, or Microsoft Exchange Server processes.
Detects suspicious usage of curl.exe to download files to sensitive or temporary locations on Windows systems. This rule specifically looks for curl.exe processes that output downloaded content to common temporary directories, user-specific application data folders, public user folders, or the desktop, often with suspicious file extensions. This behavior is frequently associated with malware staging or initial access techniques.
Detects the execution of 'IEExec.exe' with command-line arguments containing 'http://' or 'https://', indicating an attempt to download and execute files from a remote web server. This utility is part of the .NET Framework and can be abused by adversaries for ingress tool transfer.
Detects the execution of "Ldifde.exe" with the import flag "-i" and a file specified by "-f". This can be abused to import data, potentially from remote HTTP sources, leading to arbitrary file downloads or data injection.
Detects the use of 'curl.exe' to download files by looking for specific command-line arguments such as '-O', '--remote-name', or '--output'. This activity can indicate an adversary transferring tools or other files into a compromised environment.
This rule detects sign-in attempts originating from IP addresses identified as malicious by Azure AD Identity Protection, specifically when these attempts are characterized by a high failure rate. This indicates potential brute-force attacks, credential stuffing, or other unauthorized access attempts from known bad IP addresses.
Detects the use of the 'wget' utility to download and create files within common temporary directories like '/tmp' or '/var/tmp' on Linux systems. This activity can be indicative of an adversary performing ingress tool transfer or staging malicious files.
Detects when legitimate Windows applications, including Microsoft Office programs and various Living Off The Land Binaries (LOLBINs), create archive files (ZIP, RAR, 7Z, diagcab, appx). This behavior is often indicative of malicious activity, such as staging data for exfiltration or dropping malicious payloads, as these applications typically should not be creating archives.
This rule detects the use of 'powercat' or 'powercat.ps1' within PowerShell classic logs. Powercat is a PowerShell-based network utility similar to Netcat, often used by adversaries for network communication, including reverse shells, bind shells, and file transfers, potentially bypassing traditional network controls. This activity is indicative of command and control communication or lateral movement using non-application layer protocols.
This rule detects the usage of the PowerShell cmdlet `Test-NetConnection` to probe network connectivity to a specified computer name and port, specifically looking for connections to ports other than the commonly used 80 or 443. This behavior can indicate an adversary attempting to establish or test communication channels over non-standard ports, potentially to bypass network defenses or obscure command and control activities.
Detects the use of Plink (PuTTY Link) for suspicious remote port forwarding to a local port. This technique can be used by adversaries to bypass network restrictions and establish tunnels for command and control or data exfiltration.
Detects attempts to decompress Gzip archives using PowerShell's GZipStream::Decompress method. This technique can be used by adversaries to unpack malicious payloads that have been compressed to evade detection.
Detects the creation of a suspicious file by 'svchost.exe' in the 'Personalization\LockScreenImage' directory, specifically looking for files that are not in the 'C:\Windows\' directory and do not have common image extensions like '.jpg', '.jpeg', or '.png'. This behavior can indicate an adversary attempting to download or stage malicious files using the 'desktopimgdownldr' functionality, which is often associated with T1105 (Ingress Tool Transfer).
Detects the execution of Ngrok, a legitimate utility often abused by threat actors for port forwarding and tunneling. This allows them to expose local services to the internet, bypassing firewalls and network restrictions. The rule specifically looks for common command-line arguments used with Ngrok, such as those for tunneling specific TCP ports (e.g., 139, 445, 3389, 5985, 5986), HTTP services, or configuration file usage.
Detects network connections to the Notion API (api.notion.com) from processes that are not recognized legitimate Notion applications or common web browsers. This rule aims to identify potential covert command and control (C2) channels, specifically referencing tools like "OffensiveNotion C2" which leverage Notion's infrastructure for malicious communication.
Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
This rule detects PowerShell scripts that add a Name Resolution Policy Table (NRPT) rule. An NRPT rule can be used to bypass the default DNS server and force DNS queries for specific namespaces to a different, specified DNS server. This technique can be used by adversaries to redirect traffic, potentially for command and control, data exfiltration, or to evade network filtering.
Detects usage of the "type" command to download/upload data from WebDAV server. This technique can be used by adversaries to transfer files into or out of a compromised environment.
Detects suspicious execution of the Microsoft desktopimgdownldr utility. This utility is being used with parameters to download files from the Internet, specifically when the '/lockscreenurl:' argument is present and the downloaded file is not a common image format (like .jpg, .jpeg, or .png), or when it's used in conjunction with 'reg delete' and '\PersonalizationCSP' to potentially manipulate system settings related to personalization. This behavior can indicate an adversary attempting to download malicious payloads or modify system configurations.
Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases. This rule identifies outbound network connections to a specific list of destination ports that have been historically associated with malware command and control (C2) communications. It filters out connections to local IP ranges and common system directories to reduce false positives.
This rule detects outbound network connections to destination ports 8080 or 8888 that are not within common local IP ranges or initiated by programs in standard system directories. This aims to identify potentially malicious command and control (C2) activity or data exfiltration using non-standard ports.
Page 289 of 297