Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
21 detections
Filters
Last updated
All Time
Detection languages
13
2
2
2
1
Contributors
7
3
2
2
2
Categories
8
5
5
4
4
Platforms
16
4
3
3
1
Products / Services
5
3
3
2
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
2
IDS Protocols
1
1
[IOC based] Surfaces every macOS host that contacts api.ipify.org or ipinfo.io/json. These are MiniRAT's exfiltration endpoints but are also used by many legitimate tools.
Detects network connection attempts directed toward RFC 1918 private IP address spaces (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and localhost (127.0.0.0/8) that do not involve common Windows file sharing ports (TCP/445 and TCP/139). This behavior may indicate lateral movement, internal reconnaissance, or the use of non-standard protocols for internal communication.
Detects network connection attempts directed toward RFC 1918 private IP address spaces (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) and localhost (127.0.0.0/8) that do not involve common Windows file sharing ports (TCP/445 and TCP/139). This behavior may indicate lateral movement, internal reconnaissance, or the use of non-standard protocols for internal communication.
This rule detects attempts by a client on the home network to check internet connectivity by querying external IP lookup services over HTTP. It specifically looks for requests to domains like api.ipify.org, ifconfig.me, checkip.amazonaws.com, and icanhazip.com. A threshold is set to trigger an alert if five such requests are observed from the same source within 30 seconds, indicating a potential network scan or reconnaissance activity.
This rule detects DNS queries to specific domains (connectivitycheck.gstatic.com or msftconnecttest.com) that are commonly used by operating systems and applications to check for internet connectivity. A high volume of such queries (threshold of 10 within 30 seconds from a single source) could indicate a network scan or unusual network activity.
This rule identifies devices connected to Wi-Fi networks that have successfully established connections to public IP addresses. It lists details such as the device name, network adapter information (name, status, vendor), the public IP address connected to, and the first/last seen connection times, along with a count of connections. The primary goal is to provide visibility into Wi-Fi device network configurations and their external communication.
Detects specific command-line patterns used by the Turla APT group, as detailed in an ESET report from May 2020. The rule looks for `tracert` commands targeting `yahoo.com`, PowerShell obfuscated commands involving `FromBase64String`, and `net use` commands attempting to connect to `docs.live.net` with an `@aol.co.uk` credential.
This query is designed to inventory Wi-Fi-connected devices and their network configurations, identify public IP addresses in use, and geolocate those IPs to detect anomalies (e.g., a device showing a public IP from an unexpected country). It also provides visibility into network adapter details, including vendor and status.
KQL Query
KQL Query from file: External Attack Surface Monitoring KQL
KQL Query
KQL Query from file: Internet facing devices vulnerablility report
KQL Query from file: CVE-2025-22224 (CVSS 9.3 CRITICAL) Internet facing VMware server discovery
KQL Query from file: Hunting CVE-2025-31324
KQL Query from file: Critical Vulnerability in Elastic Kibana
Get all filtering events done by the Windows filtering platform.
This includes any blocks done by Windows Firewall rules, but also blocks triggered by some 3rd party firewalls.
When no Firewall rules are configured, the default behavior is to block all incoming network connections.
This includes any blocks done by Windows Firewall rules, but also blocks triggered by some 3rd party firewalls.
When no Firewall rules are configured, the default behavior is to block all incoming network connections.
Query #1 - Find the machines on which this file was seen.
TODO - set file hash to be a SHA1 hash of your choice...
TODO - set file hash to be a SHA1 hash of your choice...
This query was originally published in the threat analytics report, Trickbot: Pervasive & underestimated.
Trickbot is a very prevalent piece of malware with an array of malicious capabilities. Originally designed to steal banking credentials, it has since evolved into a modular trojan that can deploy other malware, disable security software, and perform command and control (C2) operations.
Trickbot operators are known to use the legitimate Windows process rundll.exe to perform malicious activities, such as reconnaissance. Once a target is infected, the operator will drop a batch file that runs several commands and connects to a C2 server for further action.
The following query detects suspicious rundll.exe activity associated with Trickbot campaigns.
See Office applications launching wscript.exe to run JScript for another query related to Trickbot activity.
Reference - https://attack.mitre.org/software/S0266/
Trickbot is a very prevalent piece of malware with an array of malicious capabilities. Originally designed to steal banking credentials, it has since evolved into a modular trojan that can deploy other malware, disable security software, and perform command and control (C2) operations.
Trickbot operators are known to use the legitimate Windows process rundll.exe to perform malicious activities, such as reconnaissance. Once a target is infected, the operator will drop a batch file that runs several commands and connects to a C2 server for further action.
The following query detects suspicious rundll.exe activity associated with Trickbot campaigns.
See Office applications launching wscript.exe to run JScript for another query related to Trickbot activity.
Reference - https://attack.mitre.org/software/S0266/
This rule detects various network enumeration commands commonly used by adversaries for reconnaissance, as identified in the CISA Living off the Land report. It specifically looks for commands like 'arp -a', 'curl www.ip-api.com', 'dnscmd /enumrecords', 'dnscmd /enumzones', 'ipconfig /all', 'netsh' commands related to firewall and portproxy, and 'netstat -ano'. Additionally, it detects DNS queries for 'www.ip-api.com', which can be indicative of C2 frameworks like Covenant attempting to check for internet connectivity or external IP addresses.
The following analytic detects the execution of the `route.exe` Windows application, commonly used for network discovery. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events. This activity is significant because adversaries often use `route.exe` to map network routes and identify potential targets within a network. If confirmed malicious, this behavior could allow attackers to gain insights into network topology, facilitating lateral movement and further exploitation. Note that false positives may occur due to legitimate administrative tasks or automated scripts.
Detects network connections made by non-browser processes to public IP lookup services. This activity can indicate an adversary performing discovery to understand the external IP address of a compromised system, often as a post-compromise internet connectivity test or for reconnaissance purposes.