Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
38 detections
Filters
Last updated
All Time
Detection languages
16
13
6
2
1
Contributors
12
7
6
4
3
Categories
15
14
9
8
8
Platforms
20
16
3
3
1
Products / Services
16
15
3
3
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
9
7
IDS Protocols
5
5
4
2
This rule detects DNS queries that match a specific pattern indicative of C2 fallback domain rotation. The pattern looks for domains consisting of 8 to 12 alphanumeric characters followed by a top-level domain (TLD) from a list including .top, .xyz, .club, .icu, or .pw. This behavior is often associated with malware using domain generation algorithms (DGAs) or similar techniques for command and control communication, specifically as a fallback mechanism when primary C2 channels are disrupted.
Detects suspicious modifications to the HKCU\Console registry key used by Gamaredon's GammaLoad to cache C2 URLs for persistence across executions.
Hades Decoy Anthropic Traffic
Cortex XDR
Detects suspicious network connections to the Anthropic API endpoint (api.anthropic.com/v1/api) used as exfiltration camouflage by the Hades campaign. The rule specifically looks for traffic to 'api.anthropic.com' with the path '/v1/api', which is documented as returning 404s, indicating potential misuse for covert communication or data exfiltration.
Detects network connections to the specific local port 8738 used by the IronWorm Exodus wallet injection module to exfiltrate stolen seed phrases and passwords. This rule specifically looks for outbound connections from the 'exodus.exe' process to localhost on port 8738.
Detects suspicious network connections to a non-existent Anthropic API endpoint (api.anthropic.com/v1/api). This specific route is used as network camouflage and decoy traffic by the Hades PyPI supply chain malware campaign.
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
Detects the creation of a macro file for Outlook.
Detects the creation of a macro file for Outlook.
Detects the modification of Outlook security setting to allow unprompted execution of macros.
Detects the creation of a macro file for Outlook.
Detects the modification of Outlook security setting to allow unprompted execution of macros.
'This creates an incident in the event a client generates excessive amounts of DNS queries for non-existent domains.
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
Detects the creation of a macro file for Outlook.
'Identifies clients with a high NXDomain count which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live). Alert is generated when a new IP address is seen (based on not being seen associated with
NXDomain records in prior 10-day baseline period).
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
NXDomain records in prior 10-day baseline period).
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
Detects the modification of Outlook security setting to allow unprompted execution of macros.
Page 2 of 2