Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
2
Categories
1
Platforms
1
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
This KQL detects attack used TCP port 4307 for unauthenticated access and replaced public\js\locale.php with a web shell that provided persistent remote access.
Detects rundll32.exe making outbound network connections to public IP addresses, excluding cases where the parent process is svchost.exe. This indicates the abuse of "rundll32.exe" as a proxy execution binary for defense evasion, payload execution, or suspicious network communication.