Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
Detects a program that invoked suspicious DNS queries known from Cobalt Strike beacons
This rule detects potential command and control (C2) activity by identifying devices that first query 'api.ipify.org' (often used by malware to determine external IP addresses) and then subsequently establish an outbound network connection to a non-private IP address on port 7712. This sequence of events can indicate a compromised host attempting to beacon out to a C2 server after initial reconnaissance.
This rule detects uncommon outbound network connections on TCP port 88, which is the default port for Kerberos. Such activity, especially from processes other than expected system services like LSASS or common applications like web browsers and Tomcat, can indicate potential lateral movement or initial privilege escalation attempts through Kerberos delegation. Attackers often leverage Kerberos for authentication in Windows environments to move between systems or elevate privileges, for example, using tools like Rubeus for Kerberoasting or other Kerberos-based attacks.
Detects potential remote code execution associated with the exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882 on Windows hosts. The rule looks for a Java process spawning a command shell to execute reconnaissance commands, followed by an outbound network connection from the same Java process within a short time frame. This behavior is consistent with post-exploitation activity observed in the campaign.
This analytic identifies suspicious PowerShell script execution via EventCode 4104 that contains multiple URLs within a function or array. This pattern is often indicative of obfuscated scripts or those attempting to download secondary payloads. Such activity may signal an attempt to execute malicious code, download additional malware, lead to further system compromise, or data exfiltration. Review parallel processes and the full script block for additional context and related artifacts.
This rule detects the use of various command-line tools and PowerShell cmdlets that can initiate web requests. These include native Windows PowerShell cmdlets like 'Invoke-RestMethod', 'Invoke-WebRequest', 'Resume-BitsTransfer', 'Start-BitsTransfer', and their aliases ('irm', 'iwr'), as well as common command-line utilities like 'curl' and 'wget', and .NET framework calls such as '[System.Net.WebRequest]::create' and 'WinHttp.WinHttpRequest'. Adversaries often use these methods to download additional tools, malware, or exfiltrate data from a compromised system.
Detects (failed) outbound connection attempts to internet-facing SMB servers. This could be a sign of potential exploitation attempts of CVE-2023-23397, which is a critical elevation of privilege vulnerability in Microsoft Outlook. The vulnerability allows an attacker to send a specially crafted email that, when opened, causes the victim's system to connect to an attacker-controlled SMB share and leak the victim's NTLM hash. This rule specifically looks for SMB client connectivity events (Event IDs 30803, 30804, 30806) where the destination IP address is not a private or loopback address, indicating an attempt to connect to an external SMB server.
Detects abnormal network activity and connectivity issues in Ollama including non-localhost API access attempts and warning-level network errors such as DNS lookup failures, TCP connection issues, or host resolution problems that may indicate network-based attacks, unauthorized access attempts, or infrastructure reconnaissance activity.
This rule detects suspicious network connections made by processes (excluding legitimate EDR processes like mssense.exe and senseir.exe) to URLs commonly associated with EDR command and control (C2) infrastructure. This could indicate an attempt by an adversary to communicate with or manipulate the EDR agent.
This rule detects successful network connections from devices to domains identified as high-confidence threats by ThreatView.io. It specifically looks for outbound connections to public IP addresses where the remote URL's domain matches an entry in the ThreatView high-confidence feed.
This rule detects an unusually high number of outbound network connections originating from the Local Security Authority Subsystem Service (LSASS) process on a Windows machine. LSASS is a critical system process responsible for enforcing security policy on the system, including user authentication, and typically does not initiate a large number of outbound connections. A high count of outbound connections from LSASS could indicate credential dumping activity, where an attacker is exfiltrating harvested credentials, or other malicious activity compromising the LSASS process.
Detects modifications to the 'SSLKEYLOGFILE' environment variable in the Windows Registry. This variable is often used by applications like web browsers to log SSL/TLS session keys to a file, which can then be used to decrypt encrypted network traffic. Malicious actors might enable this to capture sensitive data.
This analytic detects the use of `curl.exe` with insecure flags such as `-k`, `--insecure`, `--proxy-insecure`, or `--doh-insecure` which disable TLS certificate validation. It leverages Cisco Network Visibility Module (NVM) flow data and process arguments to identify outbound connections initiated by curl where TLS checks were explicitly disabled. This behavior may indicate an attempt to bypass certificate validation to connect to potentially untrusted or malicious endpoints, a common tactic in red team operations, malware staging, or data exfiltration over HTTPS.
Detects when a legitimate Windows binary, MSBuild.exe or mtstocom.exe, initiates an outbound network connection. This behavior is not typical for these processes and is a technique used by malware like DarkCloud to evade defenses by process hollowing.
This rule detects phishing attempts by identifying emails containing URLs and endpoint network connections to domains known to be associated with phishing campaigns. It leverages an external Indicator of Compromise (IOC) list of phishing domains. The rule scans email events for inbound messages with URLs matching these domains and also monitors endpoint network events for successful connections or HTTP inspections to these malicious domains. The results from both email and endpoint sources are then combined to provide a correlated view of potential phishing activity.
NetworkSignatureInspected just means the network sensor saw and matched a signature (it inspected the packet) — it doesn’t mean the flow was blocked. That’s the problem.
If your machines are negotiating SMB or NTLM with unknown remote IPs, you’ve got a real risk on your hands: data leakage, credential relay, or worm-style propagation. SMB to the Internet is almost never legitimate; if you don’t recognize the remote IP, treat it as suspicious.
The KQL query includes multiple conditions to detect not only default connections on legacy (139) or modern (445) SMB ports, but also cases where SMB is running over non-standard ports (attempts to evade simple port-based detection). It also extracts the SMB negotiation state so you can spot repeated or incomplete negotiation attempts (useful to detect scanning, failed auths, or relay attempts).
If your machines are negotiating SMB or NTLM with unknown remote IPs, you’ve got a real risk on your hands: data leakage, credential relay, or worm-style propagation. SMB to the Internet is almost never legitimate; if you don’t recognize the remote IP, treat it as suspicious.
The KQL query includes multiple conditions to detect not only default connections on legacy (139) or modern (445) SMB ports, but also cases where SMB is running over non-standard ports (attempts to evade simple port-based detection). It also extracts the SMB negotiation state so you can spot repeated or incomplete negotiation attempts (useful to detect scanning, failed auths, or relay attempts).
Detects network traffic to a known Command and Control (C2) server (136.243.146.46:8898) associated with the YiBackdoor malware.
Detects outbound network connections to the Telegram API, a technique used by XWorm for command and control (C2) and data exfiltration. The rule specifically looks for connections to "api.telegram.org/bot" and "/sendMessage" paths, originating from suspicious processes like WmiPrvSE.exe or Soundman.exe, or from common user-writable locations.
This rule detects network connections initiated by a process with a command line containing "filesystem", "--json", and "--results=verified", which is used to scan the entire filesystem.
This specific combination of command-line arguments is associated with the Shai-Hulud malware.
This specific combination of command-line arguments is associated with the Shai-Hulud malware.
Detects processes potentially related to XillenStealer making outbound network connections or DNS queries for telegram.org. This is indicative of command and control or data exfiltration activity.
This analytic detects unexpected outbound network connections initiated by known webserver processes such as `httpd.exe`, `nginx.exe`, or `tomcat.exe` to common file sharing or public content hosting services like GitHub, Discord CDN, Transfer.sh, or Pastebin. Webservers are rarely expected to perform outbound downloads, especially to dynamic or anonymous file hosting domains. This behavior is often associated with server compromise, where an attacker uses a reverse shell, webshell, or injected task to fetch malware or tools post-exploitation. The detection leverages Cisco Network Visibility Module flow data, enriched with process context, to identify this highly suspicious behavior.
Page 266 of 280