Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
4
1
1
Contributors
4
1
1
Categories
4
4
1
1
Platforms
4
1
1
Products / Services
4
4
MITRE Techniques
4
4
4
4
4
CVEs
1
IDS Classtypes
1,937
503
461
381
236
6
IDS Protocols
4
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
Detects outbound network traffic matching XMRig Monero cryptocurrency miner stratum login behavior originating from an internal host.
This detection identifies the presence of ChipSoft HiX electronic health record (EHR) software within the environment. ChipSoft is the dominant EHR provider in the Netherlands (~70% market share in Dutch healthcare). On April 7, 2026, ChipSoft was hit by a ransomware attack affecting HiX on-premise, HiX SaaS, and the SaaS patient portal. Z-CERT (Dutch healthcare CERT) advised all customers to immediately disconnect VPN connections to ChipSoft and intensively monitor network traffic.
This KQL detection covers 3 areas:
1. Software Inventory — Finds devices with ChipSoft/HiX installed via Defender TVM
2. Process Detection — Identifies ChipSoft.HiX.exe or related processes running in the last 30 days
3. Network Connections — Detects active connections to chipsoft.nl/.com/.eu domains
No specific IOCs (file hashes, C2 IPs) have been published by ChipSoft or Z-CERT as of the detection creation date. This detection serves as an exposure assessment to determine if your organization runs ChipSoft software and is potentially impacted by the supply chain attack.
This KQL detection covers 3 areas:
1. Software Inventory — Finds devices with ChipSoft/HiX installed via Defender TVM
2. Process Detection — Identifies ChipSoft.HiX.exe or related processes running in the last 30 days
3. Network Connections — Detects active connections to chipsoft.nl/.com/.eu domains
No specific IOCs (file hashes, C2 IPs) have been published by ChipSoft or Z-CERT as of the detection creation date. This detection serves as an exposure assessment to determine if your organization runs ChipSoft software and is potentially impacted by the supply chain attack.
Let's create a detection rule for "XONER dropper (multi-key download/execution)" based on xoner.sh. The key IOCs are as follows:
- C2/Hosting: 165.232.165.152:8080
- Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips, xoner_x86_64, etc.)
- Drop file name: xoner
- Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner xoner & execute → Delete file
Reported by Team_D4rkn3ttz
Detected by @bishop0218
- C2/Hosting: 165.232.165.152:8080
- Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips, xoner_x86_64, etc.)
- Drop file name: xoner
- Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner xoner & execute → Delete file
Reported by Team_D4rkn3ttz
Detected by @bishop0218
