Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects a network connection initiated by IMEWDBLD.EXE. This might indicate potential abuse of the utility as a LOLBIN in order to download arbitrary files or additional payloads.
Detects programs that connect to known malware callback ports based on statistical analysis from two different sandbox system databases
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
The data may also be sent to an alternate network location from the main command and control server.
The data may also be sent to an alternate network location from the main command and control server.
Detect AD credential dumping using impacket secretdump HKTL. Based on the SIGMA rules/windows/builtin/win_impacket_secretdump.yml
This detection excludes known namped pipes accessible remotely and notify on newly observed ones, may help to detect lateral movement and remote exec using named pipes
detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one
Detects a network connection initiated by the certutil.exe utility.
Attackers can abuse the utility in order to download malware or additional payloads.
Attackers can abuse the utility in order to download malware or additional payloads.
Detects a non-browser process communicating with the Notion API. This could indicate potential use of a covert C2 channel such as "OffensiveNotion C2"
Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443
Detects programs that connect to uncommon destination ports
Detects a script interpreter (Wscript/Cscript) initiating a local network connection to download or execute a script hosted on a shared folder.
Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.
Detects Non-Standard tools initiating a connection over port 3389 indicating possible lateral movement.
An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.
An initial baseline is required before using this utility to exclude third party RDP tooling that you might use.
Detects a process that initiated a network connection over ports 5985 or 5986 from a non-network service account.
This could potentially indicates a remote PowerShell connection.
This could potentially indicates a remote PowerShell connection.
This Yara rule detects the AgentRacoon backdoor, which is identified by specific bytecode patterns related to unpacking responses, file uploads, performing requests, retrieving DNS TXT records, and its main operational loop. The rule targets .NET (MSIL) executables, indicated by the 'uint16(0) == 0x5A4D' condition for MZ header and the nature of the bytecode patterns.
This rule detects the Konni backdoor, a remote access tool. It identifies specific byte patterns associated with the malware's network communication, handling of C2 commands, creation and uploading of CAB files, and payload expansion. The rule is designed to catch the presence of this specific malware family.
This YARA rule detects the Lorenz ransomware by identifying specific byte patterns associated with its file encryption routines, file discovery mechanisms, scheduled task creation for persistence, and remote connection functionalities. The rule includes two main versions of the ransomware's code, covering different implementations of these malicious activities.
This rule detects the GoodWill ransomware by identifying specific bytecode patterns related to file encryption, AES encryption routines, file system enumeration, and remote connection activities. The rule looks for a combination of these patterns within a file, indicating the presence of the ransomware.
This YARA rule detects the BlackCat ransomware by identifying specific byte patterns associated with its functionality. The rule looks for patterns related to remote connection establishment, process enumeration, file discovery, and file encryption routines. The presence of these combined patterns indicates the likely presence of BlackCat ransomware.
Page 243 of 246