Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
330 detections
Filters
Last updated
All Time
Detection languages
146
74
28
25
16
Contributors
68
49
47
30
19
Categories
224
210
37
27
26
Platforms
272
78
33
18
4
Products / Services
91
82
44
23
23
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
2
2
1
1
1
IDS Classtypes
8
2
IDS Protocols
4
4
1
1
Yara rule that detects Skuld infostealer.
Detects network enumeration commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
Detects the execution of the "esxcli" command with the "network" flag to retrieve information about the network configuration on an ESXi host. This activity can be indicative of an adversary performing discovery.
The following analytic identifies instances where `ipconfig.exe`, `systeminfo.exe`, or similar tools are executed by a non-standard shell parent process, excluding CMD, PowerShell, or Explorer. This detection leverages Endpoint Detection and Response (EDR) telemetry to monitor process creation events. Such behavior is significant as it may indicate adversaries using injected processes to perform system discovery, a tactic observed in FIN7's JSSLoader. If confirmed malicious, this activity could allow attackers to gather critical host information, aiding in further exploitation or lateral movement within the network.
The following analytic detects suspicious system network configuration discovery activities, which may indicate an adversary's attempt to gather information about the network environment. Such actions typically involve commands or tools used to identify network interfaces, routing tables, and active connections. Detecting these activities is crucial, as they often precede more targeted attacks like lateral movement or data exfiltration. By identifying unusual or unauthorized network discovery efforts, this analytic helps security teams to swiftly detect and respond to potential reconnaissance operations, mitigating the risk of further compromise.
The following analytic identifies instances where four or more distinct detection analytics are associated with malicious command line behavior on a specific host. This detection leverages the Command Line Interface (CLI) data from various sources to identify suspicious activities. This behavior is significant as it often indicates attempts to execute malicious commands, access sensitive data, install backdoors, or perform other nefarious actions. If confirmed malicious, attackers could gain unauthorized control, exfiltrate information, escalate privileges, or launch further attacks within the network, leading to severe compromise.
The analytic identifies potential enumeration of local network configuration on Linux systems. It detects this activity by monitoring processes such as "arp," "ifconfig," "ip," "netstat," "firewall-cmd," "ufw," "iptables," "ss," and "route" within a 30-minute window. This behavior is significant as it often indicates reconnaissance efforts by adversaries to gather network information for subsequent attacks. If confirmed malicious, this activity could enable attackers to map the network, identify vulnerabilities, and plan further exploitation or lateral movement within the environment.
The following analytic detects the execution of the `route.exe` Windows application, commonly used for network discovery. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events. This activity is significant because adversaries often use `route.exe` to map network routes and identify potential targets within a network. If confirmed malicious, this behavior could allow attackers to gain insights into network topology, facilitating lateral movement and further exploitation. Note that false positives may occur due to legitimate administrative tasks or automated scripts.
The following analytic identifies the rapid execution of processes used for system network configuration discovery on an endpoint. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process GUIDs, names, parent processes, and command-line executions. This activity can be significant as it may indicate an attacker attempting to map the network, which is a common precursor to lateral movement or further exploitation. If confirmed malicious, this behavior could allow an attacker to gain insights into the network topology, identify critical systems, and plan subsequent attacks, potentially leading to data exfiltration or system compromise.
The analytic identifies the execution of the "ipconfig /displaydns" command, which retrieves DNS reply information using the built-in Windows tool IPConfig. Monitoring this activity is significant as threat actors and post-exploitation tools like WINPEAS often abuse this command to gather network information. If confirmed malicious, this activity could allow attackers to map the network, identify DNS servers, and potentially facilitate further network-based attacks or lateral movement.
This YARA rule detects the BackConnect backdoor by identifying specific byte patterns related to its network communication, system information gathering, DNS server enumeration, and network interface enumeration functionalities. The rule looks for distinct code sequences that are characteristic of how this malware operates.
Yara rule that detects BackConnect backdoor.
Yara rule that detects GobRAT backdoor.
Detects network connections made by non-browser processes to public IP lookup services. This activity can indicate an adversary performing discovery to understand the external IP address of a compromised system, often as a post-compromise internet connectivity test or for reconnaissance purposes.
This rule detects when an SNMP OID request is made to an OpenCanary honeypot's SNMP service. This indicates an adversary is likely performing reconnaissance to gather information about the network or devices, potentially looking for vulnerabilities or sensitive data.
Detects instances where an SNMP service on an OpenCanary node has had an OID request.
Detects external IP address lookups by non-browser processes via services such as "api.ipify.org". This could be indicative of potential post compromise internet test activity.
Detects system discovery activity carried out by Pikabot, such as network, user information, and domain groups. The malware Pikabot has been observed using this technique as part of its C2-botnet registration with a short collection time frame (less than 1 minute). The rule specifically looks for `ipconfig.exe /all`, `netstat.exe -aon`, and `whoami.exe /all` commands executed by processes whose grandparent image ends with `rundll32.exe` or parent image ends with `SearchFilterHost.exe` or `SearchProtocolHost.exe`.
This rule detects attempts to use obfuscated or encoded IP addresses (e.g., hexadecimal, octal, or URL-encoded formats) within command-line arguments of `ping.exe` or `arp.exe`. This technique can be used by adversaries to evade simple string-based detections or to obscure their network communication targets.
Detects the execution of common macOS command-line utilities used for enumerating local network configuration and firewall settings. This includes tools like 'arp', 'ifconfig', 'netstat', 'networksetup', and 'socketfilterfw', as well as 'defaults' when querying specific firewall preferences.
Detects enumeration of local network configuration
Page 15 of 16