Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects an office application (Word, Excel, PowerPoint) that initiate a network connection to a non-private IP addresses.
This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.
This rule will require an initial baseline and tuning that is specific to your organization.
This rule aims to detect traffic similar to one seen exploited in CVE-2021-42292.
This rule will require an initial baseline and tuning that is specific to your organization.
Detects an executable accessing the portmap.io domain, which could be a sign of forbidden C2 traffic or data exfiltration by malicious actors
Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.
Detects an executable that isn't dropbox but communicates with the Dropbox API
Detects a rundll32 that communicates with public IP addresses
Detects suspicious connections from Microsoft Sync Center to non-private IPs.
Detects outbound network connection initiated by Microsoft Dialer.
The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer.
This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"
The Microsoft Dialer, also known as Phone Dialer, is a built-in utility application included in various versions of the Microsoft Windows operating system. Its primary function is to provide users with a graphical interface for managing phone calls via a modem or a phone line connected to the computer.
This is an outdated process in the current conext of it's usage and is a common target for info stealers for process injection, and is used to make C2 connections, common example is "Rhadamanthys"
Detects a "winlogon.exe" process that initiate network communications with public IP addresses
Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.
Detects an office suit application (Word, Excel, PowerPoint, Outlook) communicating to target systems over uncommon ports.
Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and making network connections.
One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.
One could easily make the DLL spawn a new process and inject to it to proxy the network connection and bypass this rule.
Detects "RegAsm.exe" initiating a network connection to public IP adresses
Detects network connections from the Equation Editor process "eqnedt32.exe".
Detects suspicious network connections made by a well-known Windows binary run with no command line parameters
Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.
Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe".
This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.
This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.
Detects a network connection initiated by the certutil.exe utility.
Attackers can abuse the utility in order to download malware or additional payloads.
Attackers can abuse the utility in order to download malware or additional payloads.
Detects potential beaconing activity to domains related to 3CX 3CXDesktopApp compromise
Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs
Detects a network connection that was initiated from a PowerShell process.
Often times malicious powershell scripts download additional payloads or communicate back to command and control channels via uncommon ports or IPs.
Use this rule as a basis for hunting for anomalies.
Often times malicious powershell scripts download additional payloads or communicate back to command and control channels via uncommon ports or IPs.
Use this rule as a basis for hunting for anomalies.
Detects a network connection initiated by an "Msiexec.exe" process over port 80 or 443.
Adversaries might abuse "msiexec.exe" to install and execute remotely hosted packages.
Use this rule to hunt for potentially anomalous or suspicious communications.
Adversaries might abuse "msiexec.exe" to install and execute remotely hosted packages.
Use this rule to hunt for potentially anomalous or suspicious communications.
Page 228 of 246