Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,154 detections
Filters
Last updated
All Time
Detection languages
683
379
342
230
173
Contributors
630
378
354
145
119
Categories
841
831
746
393
348
Platforms
1,587
586
494
263
118
Products / Services
10,670
9,758
6,693
4,421
3,749
2,154
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
Detects network traffic associated with the Tycoon and ODx phishing kits, which are used in Attacker-in-the-Middle (AiTM) phishing campaigns to bypass MFA. The rule identifies connections to known malicious domains, IP addresses, and specific URLs used by these kits.
This rule detects successful network connections from external (internet) IP addresses to common Industrial Control System (ICS) ports, such as Modbus (502) and EtherNet/IP (44818). This activity could indicate unauthorized access attempts, reconnaissance, or exploitation of internet-exposed ICS assets. The rule specifically filters for allowed/accepted/permitted connections and excludes connections from RFC 1918 private IP addresses and a configurable list of authorized external IPs.
Detects a high volume of specific RPC calls from a single source to a single target, indicative of the TorpeDoS technique. This technique is used to cause a denial of service by overwhelming the target with memory-intensive RPC operations.
This rule consolidates multiple detections related to a widespread malspam campaign delivering the Nova infostealer. It hunts for activity across email, network, DNS, and firewall logs associated with known malicious domains, IPs, and specific TTPs like suspicious archive attachments from impersonated brands.
Detects network traffic to an ERMAC banking trojan exfiltration server by identifying a unique 'WWW-Authenticate' header in the HTTP response. This indicates a client device is communicating with a known ERMAC command and control server for data exfiltration.
The analytic detects when a Windows RDP client attempts to execute an RDP file from a temporary directory, downloads directory, or Outlook directories. This detection is significant as it can indicate an attempt for an adversary to deliver a .rdp file, which may be leveraged by attackers to control or exfiltrate data. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further lateral movement within the network.
The following analytic detects unusual Remote Desktop Protocol (RDP) traffic on TCP/3389 by filtering out known RDP sources and destinations, focusing on atypical connections within the network. This detection leverages network traffic data to identify potentially unauthorized RDP access. Monitoring this activity is crucial for a SOC as unauthorized RDP access can indicate an attacker's attempt to control networked systems, leading to data theft, ransomware deployment, or further network compromise. If confirmed malicious, this activity could result in significant data breaches or complete system and network control loss.
This detection identifies potential usage of the Naabu port scanner by searching for its process execution or its specific network user-agent string. Naabu is a fast port scanner that can be used for network reconnaissance.
This analytic leverages alerts from Splunk AppDynamics SecureApp to identify and monitor exploit attempts targeting business applications. It specifically looks for vulnerabilities in web applications, including injection attacks (SQL, API abuse), deserialization vulnerabilities, remote code execution attempts, LOG4J, and zero-day attacks. These attacks typically aim to gain unauthorized access, exfiltrate sensitive data, or disrupt application functionality. Splunk AppDynamics SecureApp provides real-time detection by analyzing application-layer events and correlating attack behavior with known vulnerability signatures, categorizing attack severity, providing visibility into attacker tactics, and generating risk-based scoring and contextual alerts.
The analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. It leverages Palo Alto traffic logs mapped to the Network_Traffic data model in Splunk. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments. If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
This analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer, as identified by Cisco Secure Firewall Application Detectors. It leverages Cisco Secure Firewall Threat Defense Connection Events. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments. If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
The analytic identifies potential Remote Desktop Protocol (RDP) brute force attacks by monitoring network traffic for RDP application activity. It detects potential RDP brute force attacks by identifying source IPs that have made more than 10 connection attempts to the same RDP port on a host within a one-hour window. The results are presented in a table that includes the source and destination IPs, destination port, number of attempts, and the times of the first and last connection attempts, helping to prioritize IPs based on the intensity of activity.
Detects attempts to exploit multiple buffer overflow vulnerabilities (CVE-2025-8184, CVE-2025-8169, CVE-2025-8168) in D-Link DIR-513 routers via the 'curTime' parameter in formSetWan endpoints.
The analytic identifies the execution of the native mimikatz.exe binary on Windows systems, including instances where the binary is renamed. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because Mimikatz is a widely used tool for extracting authentication credentials, posing a severe security risk. If confirmed malicious, this activity could allow attackers to obtain sensitive credentials, escalate privileges, and move laterally within the network, leading to potential data breaches and system compromise.
The analytic identifies allowed network traffic to The Onion Router (TOR), an anonymity network often exploited for malicious activities. It leverages data from Next Generation Firewalls to detect traffic where the application is TOR and the action is allowed. This activity is significant as TOR can be used to bypass conventional monitoring, facilitating hacking, data breaches, and illicit content dissemination. If confirmed malicious, this could lead to unauthorized access, data exfiltration, and severe compliance violations, compromising the integrity and security of the network.
The following analytic detects the execution of known remote access software within the environment. It leverages network logs mapped to the Web data model, identifying specific URLs and user agents associated with remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these utilities to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or further compromise the network, posing a severe security risk.
Detects large data transfers over SSH/SCP (port 22) to or from an ESXi host. This activity is highly suspicious and could indicate an attacker delivering a ransomware payload to the hypervisor or exfiltrating sensitive data (like VMDK files).
Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse this feature to establish a reverse shell, persistence, or exfiltrate data from a compromised machine.
š Description
Threat actors frequently register lookalike domains to support malicious activities such as phishing attacks, drive-by compromises, and command-and-control (C2) operations. This KQL hunting query is designed to help identify potential phishing and typosquatting domains that may be targeting your organization or its third-party vendors.
š Threat Intelligence Feed
The hunting query utilizes data from the SANS Internet Storm Center (ISC) API, which provides access to newly registered domains.
API Endpoint:
https://isc.sans.edu/api/recentdomains/today?json
Use Cases:
Threat intelligence enrichment
Detection of suspicious or malicious domains
Security log correlation
Returned Data Fields:
Domain name
Registration date
IP address
Type
Additional metadata (if available)
Query by Date (Optional):
Example: https://isc.sans.edu/api/recentdomains/2025-07-08?json
šÆ ATT&CK Framework Mapping
Technique: Acquire Infrastructure: Domains
ID: T1583.001
Reference: MITRE ATT&CK
Threat actors frequently register lookalike domains to support malicious activities such as phishing attacks, drive-by compromises, and command-and-control (C2) operations. This KQL hunting query is designed to help identify potential phishing and typosquatting domains that may be targeting your organization or its third-party vendors.
š Threat Intelligence Feed
The hunting query utilizes data from the SANS Internet Storm Center (ISC) API, which provides access to newly registered domains.
API Endpoint:
https://isc.sans.edu/api/recentdomains/today?json
Use Cases:
Threat intelligence enrichment
Detection of suspicious or malicious domains
Security log correlation
Returned Data Fields:
Domain name
Registration date
IP address
Type
Additional metadata (if available)
Query by Date (Optional):
Example: https://isc.sans.edu/api/recentdomains/2025-07-08?json
šÆ ATT&CK Framework Mapping
Technique: Acquire Infrastructure: Domains
ID: T1583.001
Reference: MITRE ATT&CK
Detects the download of a Java Archive (.jar) file from common file-sharing services like Dropbox or MediaFire. This behavior is associated with sophisticated email campaigns where attackers use PDF attachments with embedded links to trick users into downloading and executing Remote Access Trojans (RATs).
This rule identifies network traffic to known Command and Control (C2) infrastructure associated with the Katz Stealer malware family. It uses a list of hardcoded IP addresses and domains from threat intelligence to detect suspicious outbound connections.
Page 92 of 103