Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
116 detections
Filters
Last updated
All Time
Detection languages
44
34
14
13
6
Contributors
20
18
18
12
10
Categories
78
30
28
27
19
Platforms
67
35
17
9
5
Products / Services
27
17
15
14
13
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
4
1
IDS Classtypes
8
4
1
IDS Protocols
5
4
2
1
1
Detects 'svchost.exe' spawning 'rundll32.exe' with command arguments like 'C:\windows\system32\davclnt.dll,DavSetCookie'. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).
Detects 'svchost.exe' spawning 'rundll32.exe' with command arguments indicating the use of 'davclnt.dll,DavSetCookie' and a remote IP address. This activity is suspicious as it can be an indicator of data exfiltration, execution of code hosted on a WebDAV server, or exploitation related to CVE-2023-23397, particularly for NTLM hash theft.
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server. This rule detects suspicious outbound SMTP connections by looking for connections to common SMTP ports (25, 587, 465, 2525) from processes that are not common mail client applications like Thunderbird or Outlook, or Microsoft Exchange Server processes.
This rule detects HTTP PUT requests where the User-Agent header contains 'WebDAV' and the destination IP address is not a private or loopback address. This activity could indicate an attempt to exfiltrate data to an external WebDAV share.
Detects PowerShell script blocks attempting to exfiltrate data using ICMP by creating a System.Net.NetworkInformation.Ping object and sending data. This method allows adversaries to bypass traditional network controls by tunneling data over ICMP.
Detects suspicious DNS queries using base64 encoding
Detects "svchost.exe" spawning "rundll32.exe" with command arguments like C:\windows\system32\davclnt.dll,DavSetCookie. This could be an indicator of exfiltration or use of WebDav to launch code (hosted on WebDav Server) or potentially a sign of exploitation of CVE-2023-23397
WebDav Put Request
Sigma
A General detection for WebDav user-agent being used to PUT files on a WebDav network share. This could be an indicator of exfiltration.
Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
The data may also be sent to an alternate network location from the main command and control server.
The data may also be sent to an alternate network location from the main command and control server.
Detects Exfiltration Over Alternative Protocol - ICMP. Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.
Detects "svchost.exe" spawning "rundll32.exe" with command arguments like "C:\windows\system32\davclnt.dll,DavSetCookie".
This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).
This could be an indicator of exfiltration or use of WebDav to launch code (hosted on a WebDav server).
Page 6 of 6