Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
67 detections
Filters
Last updated
All Time
Detection languages
35
22
5
4
1
Contributors
28
9
9
6
4
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
41
19
6
5
1
Products / Services
25
25
10
7
6
MITRE Techniques
39
32
16
7
5
IDS Classtypes
11
5
3
2
1
IDS Protocols
17
5
Detects potential C2 beaconing activity associated with Potassium by correlating a DNS query for a known C2 domain with a subsequent TCP connection to port 50792 from the same device within a short time window.
Detects DNS responses linking the adtimizer.co domain (specifically tekma.adtimizer.co) to the known Discover-Tech ALB infrastructure associated with Controlium/Intelos ADINT operations.
Sweeps endpoint telemetry for known UAC-0099 MATCHBOIL/LONEPAGE indicators: SHA256 hashes, C2 IPs, C2 domains (including subdomains), and payload/C2 URLs. Matches are limited to public outbound connections, Defender self-activity is excluded from file hits, and repeat hits are collapsed to one row per device and indicator. The lists are a subset of the 142 IOCs in the source report.
Detects endpoint and network activity matching known Indicators of Compromise (IOCs) associated with BPFDoor, AVERAT, and Rekoobe backdoors based on Rapid7 research. The query checks for specific file hashes, IP addresses, and domain names across process, file, image load, network, and DNS events.
Detects DNS responses linking the adtimizer.co domain (specifically tekma.adtimizer.co) to the known Discover-Tech ALB infrastructure associated with Controlium/Intelos ADINT operations.
Sweeps endpoint telemetry for known UAC-0099 MATCHBOIL/LONEPAGE indicators: SHA256 hashes, C2 IPs, C2 domains (including subdomains), and payload/C2 URLs. Matches are limited to public outbound connections, Defender self-activity is excluded from file hits, and repeat hits are collapsed to one row per device and indicator. The lists are a subset of the 142 IOCs in the source report.
Sweeps endpoint telemetry for known UAC-0099 MATCHBOIL/LONEPAGE indicators: SHA256 hashes, C2 IPs, C2 domains (including subdomains), and payload/C2 URLs. Matches are limited to public outbound connections, Defender self-activity is excluded from file hits, and repeat hits are collapsed to one row per device and indicator. The lists are a subset of the 142 IOCs in the source report.
Detects DNS responses linking the adtimizer.co domain (specifically tekma.adtimizer.co) to the known Discover-Tech ALB infrastructure associated with Controlium/Intelos ADINT operations.
Detects DNS responses linking the adtimizer.co domain (specifically tekma.adtimizer.co) to the known Discover-Tech ALB infrastructure associated with Controlium/Intelos ADINT operations.
Detects DNS responses linking the adtimizer.co domain (specifically tekma.adtimizer.co) to the known Discover-Tech ALB infrastructure associated with Controlium/Intelos ADINT operations.
Sweeps endpoint telemetry for known UAC-0099 MATCHBOIL/LONEPAGE indicators: SHA256 hashes, C2 IPs, C2 domains (including subdomains), and payload/C2 URLs. Matches are limited to public outbound connections, Defender self-activity is excluded from file hits, and repeat hits are collapsed to one row per device and indicator. The lists are a subset of the 142 IOCs in the source report.
Sweeps endpoint telemetry for known UAC-0099 MATCHBOIL/LONEPAGE indicators: SHA256 hashes, C2 IPs, C2 domains (including subdomains), and payload/C2 URLs. Matches are limited to public outbound connections, Defender self-activity is excluded from file hits, and repeat hits are collapsed to one row per device and indicator. The lists are a subset of the 142 IOCs in the source report.
Detects endpoint and network activity matching known Indicators of Compromise (IOCs) associated with BPFDoor, AVERAT, and Rekoobe backdoors based on Rapid7 research. The query checks for specific file hashes, IP addresses, and domain names across process, file, image load, network, and DNS events.
Detects endpoint and network activity matching known Indicators of Compromise (IOCs) associated with BPFDoor, AVERAT, and Rekoobe backdoors based on Rapid7 research. The query checks for specific file hashes, IP addresses, and domain names across process, file, image load, network, and DNS events.
Detects endpoint and network activity matching known Indicators of Compromise (IOCs) associated with BPFDoor, AVERAT, and Rekoobe backdoors based on Rapid7 research. The query checks for specific file hashes, IP addresses, and domain names across process, file, image load, network, and DNS events.
Detects endpoint and network activity matching known Indicators of Compromise (IOCs) associated with BPFDoor, AVERAT, and Rekoobe backdoors based on Rapid7 research. The query checks for specific file hashes, IP addresses, and domain names across process, file, image load, network, and DNS events.
Detects anomalous DNS traffic patterns indicative of malware Domain Generation Algorithms (DGA). The rule identifies multiple NXDOMAIN responses for domains exhibiting high-entropy character structures (high consonant-to-vowel ratios, random alphanumeric string patterns) originating from a single source IP within a short timeframe, which is a common indicator of C2 beaconing attempts.
Detects anomalous DNS activity characterized by high-frequency IP address rotation for a single domain within a 10-minute window. This behavior is indicative of fast-flux DNS techniques used by attackers to maintain C2 infrastructure and evade domain-based blocking or IP reputation filtering.
Detects specific Cloudflare name server pairs ('randy.ns.cloudflare' and 'stevie.ns.cloudflare') in DNS responses. This pattern is associated with Exvicy domain management infrastructure, which has been identified as a component in adversary C2 and domain staging operations.
This rule detects activities associated with the AMOS (Atomic macOS Stealer) malware family by monitoring for known malicious file hashes on endpoints and network communication with domains linked to its command-and-control infrastructure.
This rule detects activities associated with the AMOS (Atomic macOS Stealer) malware family by monitoring for known malicious file hashes on endpoints and network communication with domains linked to its command-and-control infrastructure.
Page 1 of 4