Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40 detections
Filters
Last updated
All Time
Detection languages
15
10
4
4
3
Contributors
12
6
4
4
4
Categories
15
12
12
10
5
Platforms
18
18
4
3
1
Products / Services
15
13
6
5
4
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
IDS Classtypes
14
1
IDS Protocols
9
4
2
Detects outbound network communication to ports 80 or 443 that lacks standard application-layer protocol signatures (HTTP/HTTPS/TLS). This behavior is characteristic of the Gh0stRAT malware, which uses a non-standard zlib-compressed protocol with a specific 'Gh0st' header, commonly observed in TA4922 operations.
This rule detects the creation of Amazon Q Model Context Protocol (MCP) configuration files, identified by 'mcp.json' in specific directories. It additionally correlates this file creation event with concurrent Git operations (checkout, merge, pull, or fetch) performed by a user, flagging the activity as a higher risk signal if both conditions are met.
Loader malware delivering follow-on ransomware payloads
Loader malware delivering follow-on ransomware payloads
This rule detects HTTP traffic that attempts to impersonate legitimate browser traffic (specifically Chrome on Safari) for command and control (C2) purposes. It looks for a specific User-Agent pattern that mimics Chrome on Safari and a URI pattern consisting of 8 to 16 lowercase alphanumeric characters. A threshold is applied to prevent excessive alerts, triggering if 20 such events occur within 60 seconds from the same source.
This rule detects C2 traffic that attempts to impersonate legitimate Microsoft Update services. It specifically looks for HTTP traffic where the host header contains 'windowsupdate.com' or 'update.microsoft.com' (case-insensitive) and the User-Agent header contains 'Windows-Update-Agent'. A threshold of 10 occurrences within 60 seconds from the same source IP triggers the alert, indicating potential command and control activity trying to blend in with normal Windows update traffic.
Detects a specific combination of HTTP GET, POST, and PUT requests to the GitHub API (api.github.com) within a short timeframe. This sequence matches the behavior of the AdaptixC2 custom listener used by Tropic Trooper, which uses GitHub issues for beaconing/task polling and the contents API for data exfiltration. The detection has been refined to look for specific AdaptixC2 operational keywords ('beat', 'upload', 'download') to reduce noise.
Detects a sequence of HTTP requests where the User-Agent shifts from 'WordPressAgent' to 'FingerPrint' within a short time window, a behavior associated with OysterLoader C2 registration and payload retrieval.
KQL Query from file: KQLObfusGuard - Detecting ArgFuscator Obfuscation
The PowerShell implementation of DNSCat2 calls nslookup to craft queries. Counting nslookup processes spawned by PowerShell will show hundreds or thousands of instances if PS DNSCat2 is active locally.
Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFragger and are additionally not commonly used in companies.
This query checks for network connection failures to Microsoft Defender for Endpoint URLs.
The output includes any device with 1+ connectivity failures, a list of the domains they
failed to connect to (including the number of failures), as well as the overall number of
failures in the time period. Results are sorted by the total number of connection failures
by the device.
The output includes any device with 1+ connectivity failures, a list of the domains they
failed to connect to (including the number of failures), as well as the overall number of
failures in the time period. Results are sorted by the total number of connection failures
by the device.
Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.
This query visualises total emails with Phish detections over time summarizing the data daily by various Phish Detection technologies/controls
The PowerShell implementation of DNSCat2 calls nslookup to craft queries. Counting nslookup processes spawned by PowerShell will show hundreds or thousands of instances if PS DNSCat2 is active locally.
Detects the usage of specific LDAP attributes ('primaryInternationalISDNNumber', 'otherFacsimileTelephoneNumber', 'primaryTelexNumber') that are known to be used by the LDAPFragger tool for data exchange via LDAP. These attributes are generally not commonly used in enterprise environments, making their appearance suspicious and indicative of potential Command and Control activity.
Detects the creation of an "Active Directory Schema Cache File" (.sch) by an uncommon process. This activity can be indicative of tools performing Active Directory-related operations, potentially for reconnaissance or command and control, such as LDAPFragger. The rule filters out common legitimate processes that create these files.
Detects the usage of particular AttributeLDAPDisplayNames, which are known for data exchange via LDAP by the tool LDAPFragger and are additionally not commonly used in companies.
Detects the creation of an "Active Directory Schema Cache File" (.sch) file by an uncommon tool.
Page 2 of 2