Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
236 detections
Filters
Last updated
All Time
Detection languages
100
47
32
24
10
Contributors
52
45
40
28
16
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
158
60
20
14
4
Products / Services
65
55
49
49
40
MITRE Techniques
74
66
39
27
22
CVEs
3
2
2
2
2
IDS Classtypes
30
13
3
1
IDS Protocols
43
2
2
Detects network communication associated with the SilkParasite campaign. This includes detection of TLS traffic using self-signed LokiDev certificates (CN=localhost, O=LokiDev), direct connections to known malicious C2 IP addresses, and DNS queries for the domain normativ.dushanbeidc.org, which is linked to the LokiDev infrastructure.
Detects network communication associated with the SilkParasite campaign, specifically identifying TLS traffic using fraudulent certificates impersonating the Uzbekistan railway authority (azure.uzrailwaystax.com) and connections to identified malicious infrastructure using specific JA4X TLS fingerprinting.
Detects network traffic attempting to impersonate the Uzbekistan railway authority via suspicious TLS certificates. The rules identify specific SNI domains, certificate subjects, and issuers associated with the 'SilkParasite' campaign, which uses Chinese state-affiliated certificate authorities to facilitate C2 communications.
Detects network communication associated with the SilkParasite campaign, specifically targeting TLS connections that use spoofed certificates impersonating azure.uzrailwaystax.com or communication with known SpiceRAT command-and-control server IP addresses.
Detects network activity associated with the SilkParasite C2 infrastructure (used by SpiceRAT and NodeEdgeRAT malware). The rule monitors for specific impersonated TLS certificates, known malicious IP addresses, and unique JA4X TLS fingerprints associated with these threat actors.
Detects network activity associated with the QUICAgent backdoor, including QUIC C2 traffic using a self-signed 'RAT System' certificate, direct connections to a known C2 IP address (104.64.211.22), and DNS queries for the hardcoded C2 domain 'register.mediumser.com'.
Detects the installation of a potentially malicious root certificate on a host. The rule monitors for common command-line arguments used by 'certutil.exe' to add certificates to the store, use of the 'security' utility for certificate installation on macOS, and the execution of processes referencing 'Localcertificate.zip'.
Detects TLS connections using suspicious certificates identified as belonging to the SilkParasite threat actor. The rule monitors for specific certificate issuer strings paired with either malicious subject domain patterns (targeting Central Asian entities) or specific JA4X fingerprints associated with known malicious activity.
Detects indicators of compromise related to the TraderTraitor (KelpDAO) threat actor, including specific file hashes, malicious process paths, C2 network infrastructure (IPs and domains), and malicious TLS certificates. The rule uses filename-path matching to reduce noise from legitimate macOS binaries.
Detects indicators of compromise related to the TraderTraitor (KelpDAO) threat actor, including specific file hashes, malicious process paths, C2 network infrastructure (IPs and domains), and malicious TLS certificates. The rule uses filename-path matching to reduce noise from legitimate macOS binaries.
Detects indicators of compromise related to the TraderTraitor (KelpDAO) threat actor, including specific file hashes, malicious process paths, C2 network infrastructure (IPs and domains), and malicious TLS certificates. The rule uses filename-path matching to reduce noise from legitimate macOS binaries.
Detects several potentially malicious activities related to Active Directory Certificate Services (AD CS). This includes high volumes of failed requests (potential enumeration), requests for sensitive templates (privilege escalation), and potential impersonation attempts using Subject Alternative Names (SANs). These activities are associated with AD CS abuse techniques.
Detects TLS connections where the certificate subject is 'azure.uzrailwaystax.com' and the issuer is 'TLC DV TLS CA', indicating potential impersonation of the Uzbekistan railway authority infrastructure, likely associated with SilkParasite activity.
Detects network activity associated with SilkParasite infrastructure, including the use of specific self-signed TLS certificates (swarm ca, proxy.local, 127.0.0.1) and connections to known malicious pivot domains such as socket.ayakliborsa.net or certificate subjects like *.scalefast.ninja.
This rule monitors for ADFS-related security events that may indicate credential theft or authentication bypass attempts. It flags anomalous federated sign-in events (e.g., MFA bypass, unfamiliar location), unauthorized access to the ADFS DKM container in Active Directory, and suspicious attempts to export ADFS token-signing certificates.
Detects TLS connections using suspicious certificates identified as belonging to the SilkParasite threat actor. The rule monitors for specific certificate issuer strings paired with either malicious subject domain patterns (targeting Central Asian entities) or specific JA4X fingerprints associated with known malicious activity.
Detects PE binaries that are either signed with Discord Inc. certificates but do not contain expected Discord metadata, or binaries that are signed with Lenovo certificates but contain indicators (e.g., 'DocSend') that suggest unauthorized use. It also detects any binaries claiming to be signed by these entities that contain invalid or untrusted signatures, identifying attempts to bypass security controls using stolen or spoofed certificates.
Detects the installation of a rogue root certificate into the operating system's trust store. This is a common technique used by adversaries to perform TLS/SSL interception (Adversary-in-the-Middle) by establishing a chain of trust for malicious proxy traffic. The rule identifies suspicious use of Windows 'certutil' to add certificates to the 'Root' store, macOS keychain certificate management commands, and indicators associated with 'Localcertificate.zip' payloads.
Detects the execution of Certipy, an open-source tool used for enumerating and exploiting Active Directory Certificate Services (AD CS). The rule monitors for common command-line arguments used during various stages of AD CS attack lifecycle, including finding misconfigurations, requesting certificates, relaying, and template exploitation.
Detects indicators of compromise related to the TraderTraitor (KelpDAO) threat actor, including specific file hashes, malicious process paths, C2 network infrastructure (IPs and domains), and malicious TLS certificates. The rule uses filename-path matching to reduce noise from legitimate macOS binaries.
Detects indicators of compromise related to the TraderTraitor (KelpDAO) threat actor, including specific file hashes, malicious process paths, C2 network infrastructure (IPs and domains), and malicious TLS certificates. The rule uses filename-path matching to reduce noise from legitimate macOS binaries.
Page 4 of 12