Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5 detections
Filters
Last updated
All Time
Detection languages
4
1
Contributors
3
1
1
Categories
3
2
2
1
1
Platforms
2
2
1
1
1
Products / Services
2
1
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
KQL Query
KQL Query
KQL Query
C2-NamedPipe
KQL
Detects the creation of a named pipe used by known APT malware.
Reference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c
Reference - https://docs.microsoft.com/openspecs/windows_protocols/ms-wpo/4de75e21-36fd-440a-859b-75accc74487c
Detects network communication patterns associated with the Turla ComRAT malware, specifically looking for HTTP/HTTPS requests containing '/index/index.php?h=' in the URI. This pattern is indicative of ComRAT's command and control (C2) communication.
