Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,605 detections
Filters
Last updated
All Time
Detection languages
495
433
214
119
105
Contributors
403
350
248
92
65
Categories
20,440
11,814
5,871
5,145
4,864
1,605
Platforms
860
775
236
213
66
Products / Services
469
348
348
319
208
MITRE Techniques
726
541
453
167
163
CVEs
6
5
2
2
2
IDS Classtypes
235
83
34
19
18
IDS Protocols
283
56
51
16
12
This rule identifies network traffic to known Command and Control (C2) infrastructure associated with the Katz Stealer malware family. It uses a list of hardcoded IP addresses and domains from threat intelligence to detect suspicious outbound connections.
This detection identifies network traffic to domains known to be used as command and control (C2) infrastructure in recent SharePoint exploitation campaigns. Communication with these domains is a strong indicator of compromise.
This rule detects network connections and DNS queries to known command and control (C2) infrastructure associated with Lumma Stealer malware. It leverages a regularly updated external list of indicators of compromise (IOCs) including IP addresses and domains to identify malicious communication attempts.
The analytic detects the `wermgr.exe` process attempting to connect to known IP check web services. This activity is significant because `wermgr.exe` is typically used for Windows error reporting, and its connection to these services may indicate malicious code injection, often associated with malware like Trickbot. If confirmed malicious, this behavior could allow attackers to recon the infected machine's IP address, aiding in further exploitation and evasion tactics.
This rule detects network connections or DNS queries to domains associated with the Tycoon 2FA phishing kit. The rule leverages an external data source containing a list of known malicious domains used by this phishing kit. Detection occurs if a device attempts to connect to or resolve any of these domains.
Detects network connections to domains matching patterns commonly used by the Scattered Spider threat group for phishing campaigns.
The group often registers domains that mimic legitimate corporate services by appending suffixes like "-sso", "-servicedesk", "-okta", "-vpn", or "-helpdesk" to a target's name (e.g., victim-sso.com).
The group often registers domains that mimic legitimate corporate services by appending suffixes like "-sso", "-servicedesk", "-okta", "-vpn", or "-helpdesk" to a target's name (e.g., victim-sso.com).
Detects DNS queries to domains associated with the VexTrio Traffic Distribution System (TDS) and related malicious adtech platforms as detailed in Infoblox research. These platforms are used to redirect users from compromised websites to scams, malware, and other malicious content.
Generic rule content from file: LOLBAS - Execution - Outbound Traffic to Suspicious TLD
KQL Query from file: Azure Cloud Security Monitoring
KQL Query from file: Sentinel All-In-One IP ThreatHunt
KQL Query from file: Sentinel - Threat Hunting DNS Tunneling
KQL Query from file: DefenderXDR - Threat Hunting DNS Tunneling
KQL Query from file: CVE-2025-33073 Detection
KQL Query from file: LDAPNightmare POC Detection
KQL Query from file: DefenderXDR Advanced Hunting All-In-One IP Search
KQL Query from file: Detecting Mamba 2FA phishing-as-a-service
KQL Query from file: Hunting Zloader DNS Tunneling
KQL Query from file: Discord Invite Hijacking Detection
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 12052025
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 10032025
Detects DNS queries for specific subdomains associated with the "Put.io" sharing website. This activity could indicate command and control communication, data exfiltration, or other malicious use by adversaries.
Page 69 of 77