Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects Border Gateway Protocol (BGP) authentication failures, which can indicate attempts to brute force BGP peer authentication. Such attacks aim to manipulate routing information, potentially leading to traffic redirection or denial of service.
Detects the remote installation of a print driver, which is a possible indication of the exploitation of PrintNightmare (CVE-2021-1675, CVE-2021-34527). The occurrence of print drivers being installed remotely via RPC functions should be rare, as print drivers are normally installed locally or through group policy.
This rule detects outbound network connections to ngrok tunneling service endpoints. Ngrok is a legitimate tool that can be used to expose local servers to the internet, but it is also frequently leveraged by malicious actors for data exfiltration, command and control, and bypassing network restrictions. Detection of communication to these specific ngrok domains could indicate unauthorized use of the service for malicious purposes.
Detects the download of potentially malicious file types (executables, scripts, documents, archives, etc.) from domains using suspicious or commonly abused Top-Level Domains (TLDs). This rule aims to identify initial access attempts often associated with phishing or drive-by download campaigns.
This rule detects the use of Background Intelligent Transfer Service (BITS) to connect to IP addresses directly, rather than fully qualified domain names (FQDNs). This behavior can be indicative of malicious activity, as adversaries often use BITS for command and control or data transfer, and connecting to IP addresses can be a way to bypass DNS-based security controls or to obscure the true destination.
Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario. This rule specifically looks for EventID 5145 (a network share access event) where the target file path ends with `\Internet Explorer\iertutil.dll` and the `SubjectUserName` does not end with a `$` (indicating a machine account, which is filtered out to reduce false positives).
Detects network access to the 'protected_storage' service, specifically targeting the IPC$ share. This activity is often associated with attempts to extract DPAPI domain backup keys from Domain Controllers, a technique used for credential access and lateral movement.
Detects potential beaconing activity from the 3CXDesktopApp to known malicious domains associated with the 3CX supply chain compromise. This rule identifies outbound network connections initiated by the 3CXDesktopApp.exe process to a specific list of suspicious hostnames, indicating potential command and control communication.
Detects the use of the spoolss named pipe over SMB. This can be used to trigger NTLM authentication from machines with the spooler service enabled, often as part of NTLM relay attacks or credential harvesting.
Detects instances where the svchost.exe process, specifically hosting the RDP terminal services, initiates outbound network connections to target systems on standard HTTP (TCP port 80) or HTTPS (TCP port 443) ports. This behavior is indicative of RDP tunneling, where RDP traffic is encapsulated within web protocols to bypass network restrictions or evade detection.
Detects various process execution behaviors associated with the Lazarus Group, including attempts to dump SAM registry hive, network connection enumeration using netstat, network share discovery patterns, persistence mechanisms involving common program data directories, and rundll32 execution with specific file extensions.
Detects a bash process initiating an outbound network connection to a remote IP address, which is a common indicator of a reverse shell. This rule specifically looks for '/bin/bash' processes making network connections, excluding connections to localhost or unspecified addresses.
Detects the execution of '3proxy.exe', a tiny free proxy server, based on its image name, description, or specific command-line parameters. This tool can be used by adversaries for command and control activities, specifically for proxying network traffic.
Detects outbound network connections to known cryptocurrency mining pool domains. This activity is often indicative of resource hijacking (cryptojacking) where an attacker uses a compromised system's resources to mine cryptocurrency without the owner's consent. The rule specifically targets a comprehensive list of domains associated with various mining pools, primarily for Monero (XMR) and other cryptocurrencies.
This rule detects the first-time observation of remote named pipe connections, excluding a predefined list of common and legitimate named pipes. This behavior is often indicative of lateral movement or remote execution using named pipes, which attackers commonly leverage to move within a network or execute code on remote systems. The rule specifically looks for connections to '\\*\IPC$', a common administrative share used for interprocess communication over a network. By filtering out known legitimate named pipes, the rule aims to reduce false positives and highlight potentially malicious activity.
This rule detects instances where the 'winlogon.exe' process initiates outbound network connections to public IP addresses. Winlogon.exe is a critical Windows component responsible for user logon/logoff and the secure attention sequence. Typically, winlogon.exe should not be making outbound network connections to public IPs. Such activity could indicate compromise, potentially by malware like BlackLotus, which has been observed to leverage winlogon.exe for malicious purposes, including command and control or data exfiltration.
Detects the execution of 'curl.exe' with command-line flags that disable security checks for proxy or DNS over HTTPS (DoH) connections. This behavior can indicate an attempt to bypass security controls or establish covert communication channels.
Detects a BITS transfer job downloading file(s) from a direct IP address. This technique is often used by adversaries for defense evasion and persistence, as BITS jobs can operate in the background, bypass some firewall rules, and persist across reboots.
Detects the usage of the ".Net.Sockets.TCPClient" class within PowerShell, which is commonly abused to establish remote connections and reverse shells. This technique is notably used by tools like Nishang's "Invoke-PowerShellTcpOneLine" and other malicious scripts to create outbound network connections for command and control or data exfiltration.
This rule detects the execution of PsExec or PAExec by monitoring network share access to the IPC$ share. Specifically, it looks for access to named pipes ending with '-stdin', '-stdout', or '-stderr', which are characteristic of PsExec/PAExec communication. The rule filters out instances where the service name starts with 'PSEXESVC', indicating the standard Sysinternals PsExec service, to reduce false positives for legitimate PsExec usage or when the attacker uses a different PsExec client.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario. This is identified by monitoring Windows Security Event ID 5145 for file creations ending with `\wbem\wbemcomn.dll` and filtering out legitimate system accounts (those ending with '$').
Page 240 of 246