Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,223 detections
Filters
Last updated
All Time
Detection languages
2,420
1,435
704
406
354
Contributors
1,092
1,080
584
397
348
Categories
2,145
1,820
1,775
1,301
888
Platforms
4,250
1,450
901
581
181
Products / Services
1,571
855
774
655
512
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects Silence EmpireDNSAgent as described in the Group-IP report
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity
Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
Detects when a user downloads a file by using CertOC.exe
Detects usage of the "type" command to download/upload data from WebDAV server
Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.
Well-known DNS Exfiltration tools execution
Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)
Detects SILENTTRINITY stager use via PE metadata
Detects execution of the IEExec utility to download and execute files
Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service
Download and compress a remote file and store it in a cab file on local machine.
Download or Copy file with Extrac32
Execution of plink to perform data exfiltration and tunneling
Detects attempts of decoding encoded Gzip archives via PowerShell.
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Detects attempts of decoding a base64 Gzip archive via PowerShell. This technique is often used as a method to load malicious content into memory afterward.
Detects the use of 3proxy, a tiny free proxy server
Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available.
Involved domains are bin.equinox.io for download and *.ngrok.io for connections.
Involved domains are bin.equinox.io for download and *.ngrok.io for connections.
Page 294 of 297