Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,156 detections
Filters
Last updated
All Time
Detection languages
2,302
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,877
5,156
4,865
Platforms
2,859
2,017
816
524
213
Products / Services
1,337
1,144
831
576
366
MITRE Techniques
1,823
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects the specific command and control check-in format used by the PhantomPull loader to retrieve the final PhantomPulse payload. It monitors for a unique URL pattern in process command lines, indicating communication with the PhantomPulse C2 server.
Provides high-fidelity detection of the initial infrastructure used by the threat actor to deliver the PhantomPulse RAT. This rule specifically detects network connections to a known PhantomPulse staging server IP address.
Detects network connections over FTP (port 21) to specific compromised IP addresses abused by the LucidRook malware. The threat actor utilizes these Taiwanese FTP servers to stage payloads and receive exfiltrated data.
Detects a network connection initiated by Cmstp.EXE
Its uncommon for "cmstp.exe" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.
Its uncommon for "cmstp.exe" to initiate an outbound network connection. Investigate the source of such requests to determine if they are malicious.
Detects "RegAsm.exe" initiating a network connection to public IP adresses
Detects a network connection initiated by "Regsvr32.exe"
Detects suspicious behavior associated with an Adobe Reader zero-day exploit, including specific network connections, suspicious user-agent strings, registry persistence, and specific image loads (e.g., ntdll.dll or bootsvc.dll).
EXE Search
KQL
Gives you a report from a specific date and onwards of a certain file name that was used within the tenant. (Replace "Outlook.exe" with the file name you are looking for, and replace date to desired range)
Notes: LocalIP ≠ RemoteIP = Outbound connection
Notes: LocalIP ≠ RemoteIP = Outbound connection
KQL Query- List of known malicious IPs associated with Iranian-affiliated APT exploiting PLCs
Detects BGP failures which may be indicative of brute force attacks to manipulate routing
Detects LDP failures which may be indicative of brute force attacks to manipulate MPLS labels
Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
Detects juniper BGP missing MD5 digest. Which may be indicative of brute force attacks to manipulate routing.
Detects svchost hosting RDP termsvcs communicating with the loopback address
Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe".
This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.
This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.
Detects a network connection that is initiated by the "notepad.exe" process.
This might be a sign of process injection from a beacon process or something similar.
Notepad rarely initiates a network communication except when printing documents for example.
This might be a sign of process injection from a beacon process or something similar.
Notepad rarely initiates a network communication except when printing documents for example.
Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports.
Detects a rundll32 that communicates with public IP addresses
Detects a possible remote connections to Silenttrinity c2
Detects suspicious network connections made by a well-known Windows binary run with no command line parameters
Detects uncommon outbound network activity via Kerberos default port indicating possible lateral movement or first stage PrivEsc via delegation.
Page 183 of 246