Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,220 detections
Filters
Last updated
All Time
Detection languages
2,419
1,435
704
406
354
Contributors
1,092
1,080
584
397
348
Categories
2,143
1,819
1,774
1,301
888
Platforms
4,247
1,450
898
578
181
Products / Services
1,571
855
774
655
512
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects strings used in command execution in DNS TXT Answer
Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/
Detects WebDav DownloadCradle
Detects suspicious encoded User-Agent strings, as seen used by some malware.
Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFragger and are additionally not commonly used in companies.
Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour
Detects DNS queries made by "AppInstaller.EXE". The AppInstaller is the default handler for the "ms-appinstaller" URI. It attempts to load/install a package from the referenced URL
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.
Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases
Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files.
Detects usage of the Sharp Chisel via the commandline arguments
Detects suspicious Plink tunnel port forwarding to a local port
Detects usage of the Chisel tunneling tool via the commandline arguments
This rule detects the ChinaZ trojan by identifying specific byte patterns associated with its functionalities. These functionalities include collecting system information, sending system information, parsing C2 commands, and performing DNS flood attacks. The rule contains distinct byte patterns for both 32-bit and 64-bit architectures of the malware.
Indicates sign-in from a malicious IP address based on high failure rates.
Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.
Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.
Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence.
These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.
These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.
Detects when a Microsoft Cloud App Security reported when an activity occurs from a location that wasn't recently or never visited by any user in the organization.
Detects the use of wget to download content in a temporary directory such as "/tmp" or "/var/tmp"
Page 292 of 297