Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,879 detections
Filters
Last updated
All Time
Detection languages
2,954
1,378
313
289
239
Contributors
1,807
1,529
1,304
180
173
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,747
1,857
1,076
782
160
Products / Services
2,241
1,434
1,273
746
582
MITRE Techniques
2,448
2,151
1,129
937
790
CVEs
19
15
9
7
5
IDS Classtypes
834
334
94
23
20
IDS Protocols
689
276
235
117
23
The analytic detects outbound network connections from an endpoint process to suspicious or non-standard ports. It uses Cisco Network Visibility Module flow data to identify processes communicating over ports like 4444, 2222, or 51820, which are commonly associated with tools such as Metasploit, SliverC2, other penetration testing tools, red team activities, or malware. These connections warrant further investigation, especially when initiated by unexpected or non-network-native binaries.
This analytic identifies non-browser processes reaching out to public IP lookup or geolocation services. These services are commonly used by legitimate tools, but their usage outside of browsers may indicate network reconnaissance, virtual machine detection, or staging by malware. This activity is observed in post-exploitation frameworks, stealer malware, and advanced threat actor campaigns. The detection relies on Cisco Network Visibility Module (NVM) telemetry and excludes known browser processes to reduce noise.
This analytic detects network connections initiated by binaries that are not typically associated with network communication, such as 'notepad.exe', 'calc.exe' or 'write.exe'. It leverages Cisco Network Visibility Module logs to correlate network flow activity with process context, including command-line arguments, process path, and parent process information. These applications are normally used for locally and do not require outbound network access. When they do initiate such connections, it may indicate process hollowing, code injection, or proxy execution, where adversaries abuse a trusted process to mask malicious activity.
Detects a LOLBAS (Living Off the Land Binary) executing a payload from a common staging directory, which is then followed by an outbound RDP connection from the same process. This behavior is indicative of a proxied RDP connection, often used for lateral movement after an initial compromise, as seen with malware like SystemBC.
This analytic detects suspicious Python package installations where the package name resembles popular Python libraries but may be typosquatted or slightly altered. Typosquatting is a common technique used by attackers to trick users into installing malicious packages that mimic legitimate ones. This detection leverages Cisco NVM flow telemetry and checks for pip or poetry package managers with the "install" or "add" flags, making outbound connections to package repository such as `pypi.org` with known or suspected typo package names.
This analytic identifies the use of Chromium-based browsers (like Microsoft Edge) running in headless mode with the `--dump-dom` argument. This behavior has been observed in attack campaigns such as DUCKTAIL, where browsers are automated to stealthily download content from the internet using direct URLs or suspicious hosting platforms. The detection focuses on identifying connections to known file-sharing domains or direct IPs extracted from command-line arguments and cross-checks those against the destination of the flow. Since it leverages Cisco Network Visibility Module telemetry, the rule triggers only if a network connection is made.
This rule detects potential C2 communication patterns associated with the NightshadeC2 botnet. It looks for outbound TCP connections from non-browser processes to specific ports used by the malware, or connections to Steam community pages which are used to host C2 addresses. It also identifies initial geo-IP lookups from non-browser processes.
Detects outbound Network File System (NFS) connections originating from an internal network IP address to a public IP address. This activity is highly unusual for legitimate NFS usage and could indicate an attempt to download malware, exfiltrate data, or establish command and control, as observed with malware like RapperBot.
Detects outbound API calls to api.github.com for repository creation or file uploads matching patterns used in the s1ngularity supply chain attack.
This rule detects the presence of potentially malicious or unwanted browser extensions and outbound network connections to known adware or tracking domains. It correlates extension presence with network behavior to identify threats.
This rule detects the installation of potentially unwanted or suspicious applications, specifically looking for a sponsored version of FileZilla. It then correlates this installation with outbound network activity to public IP addresses, which could indicate telemetry, beaconing, data exfiltration, or command and control (C2) behavior.
This rule identifies devices connected to Wi-Fi networks with public IP addresses and correlates those connections with outbound network events. It aims to provide process-level context for connections originating from such network configurations, including geolocation of both local and remote IPs. This could indicate unusual or unauthorized network activity, potentially related to command and control or data exfiltration from devices on less secure network segments.
Detects potential Command and Control (C2) communication patterns based on ASIM-normalized network session data in Microsoft Sentinel. This detection covers three primary patterns:
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
Detects a process launching from a common user-writable directory that subsequently makes an external network connection. This behavior is consistent with malware, such as the Mythic agent used by RomCom, that performs an execution guardrail check (e.g., verifying the host's domain name) before initiating command and control communications.
The following analytic detects the execution of known remote access software within the environment. It leverages network logs mapped to the Web data model, identifying specific URLs and user agents associated with remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these utilities to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or further compromise the network, posing a severe security risk.
This rule detects PowerShell scripts that utilize web request cmdlets (Invoke-WebRequest, Invoke-RestMethod, irm, iwr) along with the '-UserAgent' parameter. Adversaries often modify user agents to mimic legitimate traffic or specific applications, blending in with normal network activity to evade detection while communicating with command and control servers or exfiltrating data.
This rule identifies network traffic to known Command and Control (C2) infrastructure associated with the Katz Stealer malware family. It uses a list of hardcoded IP addresses and domains from threat intelligence to detect suspicious outbound connections.
This detection identifies network traffic to or from IP addresses known to be associated with command and control (C2) infrastructure or active exploitation in recent SharePoint vulnerability campaigns. Communication with these IPs is a strong indicator of either an attempted attack or an existing compromise.
This analytic detects outbound connections from Cisco Secure Firewall Threat Defense to commonly abused file sharing and pastebin-style hosting domains. It specifically looks for allowed connections where the URL matches a predefined list of known data hosting or temporary storage services. These platforms are frequently used by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads. Identifying such connections can indicate potential abuse of legitimate infrastructure as part of an attacker's kill chain, suggesting tool staging, credential dumping, or outbound data leaks over HTTP(S).
This analytic detects outbound network connections initiated by command-line tools such as `curl` or `wget` as observed in Cisco Secure Firewall Threat Defense logs. It specifically looks for allowed connections where the `EVE_Process` or `ClientApplication` fields indicate the use of these utilities. While these tools have legitimate uses, adversaries frequently abuse them to download malicious payloads, retrieve additional tools, or establish staging infrastructure on compromised systems. Detection of this activity may indicate the download phase of an attack chain or the retrieval of command-and-control utilities.
The following analytic detects the use of the Background Intelligent Transfer Service (BITS) client application in allowed outbound connections. It leverages logs from Cisco Secure Firewall Threat Defense devices and identifies instances where BITS is used to initiate downloads from non-standard or unexpected domains. While BITS is a legitimate Windows service used for downloading updates, it is also commonly abused by adversaries to stealthily retrieve payloads or tools. This analytic filters out known Microsoft Edge update URLs and focuses on connections that may indicate suspicious or unauthorized file transfers. If confirmed malicious, this could represent a command and control (C2) channel or a download of malware or tooling as part of an attack chain.
Page 267 of 280