Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
2
1
Contributors
2
1
Categories
2
1
1
1
1
Platforms
2
1
1
1
Products / Services
2
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
KQL Query from file: Global Admin Entra Cookie with Chrome ZeroDay
KQL Query from file: Vulnerability Profile: CVE-2024-30040 (Zero-day)
Detects the execution of 'wget' to download a '.tar' file from an untrusted direct IP address, specifically when the '--no-check-certificate' flag is used. This behavior has been observed in attacks attributed to UNC4841 during their exploitation of Barracuda ESG zero-day vulnerabilities.
