Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
15
9
Contributors
23
1
Categories
20,417
11,806
5,870
5,145
4,864
Platforms
14
6
3
2
1
Products / Services
5
5
4
3
2
MITRE Techniques
6
4
2
2
2
CVEs
2
1
1
1
IDS Classtypes
8
3
2
1
1
IDS Protocols
5
4
2
2
1
Detects DNS/TLS SNI lookups for the hollowed wab.exe process's secondary C2 domains (bsc.rpc.blxrbdn.com, lb.propertyfind.cc) and the correlated follow-on connection to their resolved IPs, flagging the shared Cloudflare IP 172.67.161.234 for additional host-side process-lineage verification.
Detects SSL-VPN traffic-control/promiscuous-mode changes triggered by unexpected or unsigned processes outside approved maintenance windows, consistent with Gunra's interception of VDI authentication traffic.
Detects Cisco device configuration lines containing weakly protected or plaintext credentials (Type 0 plaintext, Type 4 broken SHA-256, Type 7 Vigenere-cipher passwords) captured in syslog/config backup feeds. These weak hash types are trivially reversible and, once a router config is exfiltrated (e.g., via SNMP/TFTP abuse), allow rapid credential recovery and lateral movement.
Page 2 of 2