Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,223 detections
Filters
Last updated
All Time
Detection languages
2,420
1,435
704
406
354
Contributors
1,092
1,080
584
397
348
Categories
2,145
1,820
1,775
1,301
888
Platforms
4,250
1,450
901
581
181
Products / Services
1,571
855
774
655
512
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects a potential TeamPCP infostealer execution chain where a bash shell running setup.sh or entrypoint.sh spawns curl with POST or upload arguments.
This analytic detects PowerShell Script Block Logging (Event ID 4104) events that use common download methods to retrieve files directly from raw-content URLs on GitHub, GitLab, or Codeberg.
These code hosting services can be abused to stage payloads, but administrators and developers also download files from them.
A match identifies a download attempt; it does not establish that the file was successfully retrieved or executed. Review the full script block, destination path, process ancestry, and related endpoint activity.
These code hosting services can be abused to stage payloads, but administrators and developers also download files from them.
A match identifies a download attempt; it does not establish that the file was successfully retrieved or executed. Review the full script block, destination path, process ancestry, and related endpoint activity.
The following analytic detects a process located in a potentially suspicious location making DNS queries to known URL shortening services, specifically tinyurl.
URL shorteners are frequently used by threat actors to obfuscate malicious destinations, including phishing pages, malware distribution sites, or command-and-control (C2) endpoints.
While tinyurl.com is a legitimate service, its use in enterprise environments—particularly by non-browser processes or scripts—should be considered suspicious, especially if correlated with subsequent outbound connections, file downloads, process file path or credential prompts. Analysts should investigate the source process, execution context, and destination domain to determine intent and risk.
URL shorteners are frequently used by threat actors to obfuscate malicious destinations, including phishing pages, malware distribution sites, or command-and-control (C2) endpoints.
While tinyurl.com is a legitimate service, its use in enterprise environments—particularly by non-browser processes or scripts—should be considered suspicious, especially if correlated with subsequent outbound connections, file downloads, process file path or credential prompts. Analysts should investigate the source process, execution context, and destination domain to determine intent and risk.
The following analytic detects the execution of a DNS query by a process to the associated Telegram API domain, which could indicate access via a Telegram bot commonly used by malware for command and control (C2) communications. By monitoring DNS queries related to Telegram's infrastructure, the detection identifies potential attempts to establish covert communication channels between a compromised system and external malicious actors. This behavior is often observed in cyberattacks where Telegram bots are used to receive commands or exfiltrate data, making it a key indicator of suspicious or malicious activity within a network.
Detects DNS tunnelling, where data is encoded into queries and answers against a
domain the attacker controls. TXT records carry the most payload per query, so a
high volume of TXT lookups beneath one parent domain is the characteristic shape.
Tunnelling is slow, which means it is usually evidence of a long-running compromise
rather than a recent one.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and lower(recordtype) = 'txt'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 100
domain the attacker controls. TXT records carry the most payload per query, so a
high volume of TXT lookups beneath one parent domain is the characteristic shape.
Tunnelling is slow, which means it is usually evidence of a long-running compromise
rather than a recent one.
Onboarding: INFOBLOX is ingested via Syslog (CEF) (Bloo extractor 155).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dns where sourcename='INFOBLOX' and action='DNS_QUERIED'
and lower(recordtype) = 'txt'
| duration 1h
| groupby srcip
| select srcip, count(*) as cnt
| having cnt > 100
Detects a DHCP-driven DNS update for a hostname not present in the asset inventory.
Dynamic DNS registration lets a device choose the name under which it is reachable,
and an attacker can use that to impersonate a service or make a rogue host appear
legitimate to anything resolving by name.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP'
and action in ('DNS_UPDATE_REQUEST', 'DNS_UPDATED')
| groupby macaddress, srcip, user, resultcode
Dynamic DNS registration lets a device choose the name under which it is reachable,
and an attacker can use that to impersonate a service or make a rogue host appear
legitimate to anything resolving by name.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP'
and action in ('DNS_UPDATE_REQUEST', 'DNS_UPDATED')
| groupby macaddress, srcip, user, resultcode
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs.
Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement.
Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects network, DNS, email, and URL click events matching known IOC domains associated with AdFection, Candiru, and Discover-Tech threat intelligence reports.
Detects DNS responses linking the adtimizer.co domain (specifically tekma.adtimizer.co) to the known Discover-Tech ALB infrastructure associated with Controlium/Intelos ADINT operations.
Detects network connections to known Indicators of Compromise (IOCs) associated with the TraderTraitor campaign, including trojanized Terraform providers (FLATROOF/ROOFDECK malware families) using specific domains and URL paths.
Detects network connections to known Indicators of Compromise (IOCs) associated with the TraderTraitor campaign, including trojanized Terraform providers (FLATROOF/ROOFDECK malware families) using specific domains and URL paths.
Sweeps proxy, firewall and endpoint network telemetry for requests to the three published BraZetsu Pastebin dead-drop raw URLs used to retrieve the XOR-encrypted C2 config.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Detects the PatchAgent Stage 3 HTTP C2 protocol recovered from the decrypted shellcode: plain HTTP requests to /api/checkin, /api/cmd/, or /api/result/ combined with the hardcoded, truncated User-Agent "Mozilla/5.0 (Windows NT 10.0; Win64; x64)" (a real browser UA continues past this). Matching the API path plus the exact short UA keeps this durable across C2 IP rotation (observed on 46.30.188[.]99 and 185.228.83[.]217, port 8443).
Detects HTTP requests to a Cloudflare Workers subdomain
(*.workers.dev) targeting the /token/v1/{UID} signaling endpoint, originating
from a headless Chrome user agent. Chaos ransomware's msaRAT offloads all C2
signaling to the browser via CDP-injected JavaScript, performing WebRTC SDP
Offer/Answer exchange through this trusted developer platform to evade domain
reputation blocking.
(*.workers.dev) targeting the /token/v1/{UID} signaling endpoint, originating
from a headless Chrome user agent. Chaos ransomware's msaRAT offloads all C2
signaling to the browser via CDP-injected JavaScript, performing WebRTC SDP
Offer/Answer exchange through this trusted developer platform to evade domain
reputation blocking.
Detects script-driven (curl, wget, python) outbound connections to
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
AI/LLM API endpoints. The campaign uses legitimate AI platform APIs as covert
command, control, and exfiltration channels, blending malicious traffic with
approved web services to evade network-based detection.
The following analytic detects the execution of ngrok.exe on a Windows operating system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because while ngrok is a legitimate tool for creating secure tunnels, it is increasingly used by adversaries to bypass network defenses and establish reverse proxies. If confirmed malicious, this could allow attackers to exfiltrate data, maintain persistence, or facilitate further attacks by tunneling traffic through the compromised system.
Page 7 of 297