Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
30
4
3
1
Contributors
21
4
3
3
2
Categories
21
16
13
13
9
Platforms
23
13
4
Products / Services
15
9
7
3
2
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
Detects unusually fast response times for FTP LIST commands, which could indicate an automated or programmatic interaction with an FTP server, potentially related to a vulnerability exploitation or data exfiltration attempt. The rule specifically looks for network events on port 21 (FTP) where the URL contains 'LIST' and the response time is less than 100 milliseconds.
Detects network connections originating from a Squid proxy process (squid.exe or processes containing 'squid' in their name) attempting to connect to an FTP server (port 21). This could indicate a reachability test or other activity related to the Squidbleed vulnerability, or general proxy misuse.
Detects the execution of the Squid proxy process with command-line arguments indicating the use of FTP parsing components. This could be indicative of a vulnerability exploitation attempt or unusual configuration.
Detects execution of squid.exe with suspicious command line arguments
Detects outbound network connections from 'squid.exe' to internal IP addresses on port 21 (FTP). This could indicate an attacker controlling an FTP server within the internal network, potentially exploiting a vulnerability like Squidbleed.
This rule detects potential exploitation of the Squidbleed vulnerability by identifying network connections to FTP port 21 where the remote URL contains 'PASV' or 'EPSV' commands, and the initiating process is 'squid.exe'. This indicates an attempt to abuse FTP passive mode through the Squid proxy.
This rule detects network connections to FTP servers (port 21) where the remote URL contains keywords associated with NetWare or Novell, along with suspicious whitespace patterns. This could indicate an attempt to exploit a known vulnerability related to whitespace handling in NetWare FTP servers, potentially the 'Squidbleed' vulnerability.
Detects the creation of a file on a server system by common network utilities (curl, ftp, powershell, winscp, certutil) within a 5-minute window of a network connection to common ports (21, 22, 80, 443). This could indicate ingress tool transfer or data exfiltration attempts.
This rule detects the use of common file transfer and remote access protocols (SSH, FTP, SMB, TELNET, FTPS, SMB.v3) communicating over non-standard ports. Adversaries often use non-standard ports to bypass firewall rules, evade detection, or obscure their command and control (C2) traffic. The rule specifically excludes the standard ports for these protocols to focus on anomalous behavior.
The analytic detects FTP connections initiated by processes located in non-standard installation paths on Windows systems. It leverages Sysmon EventCode 3 to identify network connections where the process image path does not match common directories like "Program Files" or "Windows\System32". This activity is significant as FTP is often used by adversaries and malware, such as AgentTesla, for Command and Control (C2) communications to exfiltrate stolen data. If confirmed malicious, this could lead to unauthorized data transfer, exposing sensitive information and compromising the integrity of the affected host.
Detects the execution of 'ftp.exe' with the '-s' or '/s' flag, which indicates script execution, or any child processes spawned by 'ftp.exe'. This behavior can be abused by adversaries for arbitrary command execution, often as a method of defense evasion or indirect command execution.
Use this query to locate injected processes launching discovery activity. Qakbot has been observed leading to ransomware in numerous instances.
'Identifies malware that has been hidden in the recycle bin.
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
Finding attackers hiding malware in the recycle bin.
Read more here: https://azure.microsoft.com/blog/how-azure-security-center-helps-reveal-a-cyberattack/.
Tags: #execution #SuspiciousPath.
Read more here: https://azure.microsoft.com/blog/how-azure-security-center-helps-reveal-a-cyberattack/.
Tags: #execution #SuspiciousPath.
The following analytic identifies unauthorized software downloads to network devices via TFTP, FTP, or SSH/SCP. It detects this activity by analyzing network traffic events on specific ports (69, 21, 22) from devices categorized as network, router, or switch. This activity is significant because adversaries may exploit netbooting to load unauthorized operating systems, potentially compromising network integrity. If confirmed malicious, this could lead to unauthorized control over network devices, enabling further attacks, data exfiltration, or persistent access within the network.
This rule detects the usage of cleartext protocols over a network by monitoring firewall logs for allowed connections to specific destination ports commonly associated with unencrypted services. These ports include HTTP (80, 8080), FTP (21), Telnet (23), and various database or application-specific ports (e.g., 1433, 3306, 1521, 27017, 50000, 11211, 15672, 5900-5904). The rule specifically looks for 'forward' or 'accept' actions, or connections not marked as 'blocked', indicating active cleartext communication. The primary goal is to identify potential credential exposure or sensitive data transmission over insecure channels.
This rule detects the execution of the 'ftp.exe' binary when it has been renamed. Adversaries often rename legitimate system binaries to evade detection by security tools that monitor for specific executable names. The detection logic specifically looks for process creation events where the original filename metadata indicates 'ftp.exe', but the actual image path (the executed file name) is different from 'ftp.exe'. This indicates that the 'ftp.exe' binary has been renamed and then executed.
Page 2 of 2