Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
338 detections
Filters
Last updated
All Time
Detection languages
120
98
40
28
21
Contributors
66
66
65
53
13
Categories
148
107
105
82
53
Platforms
254
113
56
29
5
Products / Services
10,670
9,758
6,693
4,421
3,749
338
MITRE Techniques
158
96
45
41
35
CVEs
3
3
2
2
2
IDS Classtypes
17
3
3
2
2
IDS Protocols
18
4
3
2
2
Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify successful exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.
Detects the remote installation of a print driver, which is a possible indication of the exploitation of PrintNightmare (CVE-2021-1675, CVE-2021-34527). The occurrence of print drivers being installed remotely via RPC functions should be rare, as print drivers are normally installed locally or through group policy.
Detects attempts to download executable files via WebDAV. This activity has been observed in campaigns attributed to APT29, where adversaries leverage WebDAV to transfer malicious tools into a compromised environment.
Detects the use of the spoolss named pipe over SMB. This can be used to trigger NTLM authentication from machines with the spooler service enabled, often as part of NTLM relay attacks or credential harvesting.
This rule detects DNS queries for specific domains associated with the WannaCry ransomware killswitch. The presence of these queries indicates a potential WannaCry infection attempting to resolve its killswitch domain. If the domain resolves, the ransomware may cease its encryption activities.
This rule detects the first-time observation of remote named pipe connections, excluding a predefined list of common and legitimate named pipes. This behavior is often indicative of lateral movement or remote execution using named pipes, which attackers commonly leverage to move within a network or execute code on remote systems. The rule specifically looks for connections to '\\*\IPC$', a common administrative share used for interprocess communication over a network. By filtering out known legitimate named pipes, the rule aims to reduce false positives and highlight potentially malicious activity.
Detects the presence of default Cobalt Strike certificate in the HTTPS traffic
zeek_dns_nkn
Sigma
NKN is a networking service using blockchain technology to support a decentralized network of peers. While there are legitimate uses for it, it can also be used as a C2 channel. This rule looks for a DNS request to the ma>
This rule detects the execution of PsExec or PAExec when the service name has been renamed from its default 'PSEXESVC'. It specifically looks for SMB file access events (smb_files) in Zeek logs where the path contains '\IPC$' and the name ends with '-stdin', '-stdout', or '-stderr', but filters out events where the name starts with 'PSEXESVC'. This helps to identify potentially malicious use of PsExec-like tools that attempt to evade detection by altering the service name, while reducing noise from legitimate PsExec usage or other PsExec clients.
This rule detects HTTP PUT requests where the User-Agent header contains 'WebDAV' and the destination IP address is not a private or loopback address. This activity could indicate an attempt to exfiltrate data to an external WebDAV share.
Detects suspicious DNS queries using base64 encoding
Detects strings used in command execution in DNS TXT Answer
Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.
Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/
WebDav Put Request
Sigma
A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting
Detects suspicious DNS queries known from Cobalt Strike beacons
Detects wannacry killswitch domain dns queries
The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused).
Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare.
Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward.
Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering.
This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'
Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare.
Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward.
Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering.
This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'
Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml
Page 16 of 17