Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,247 detections
Filters
Last updated
All Time
Detection languages
690
140
94
67
56
Contributors
389
247
199
52
45
Categories
787
411
262
248
188
Platforms
836
265
264
169
66
Products / Services
498
157
148
133
115
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
1,247
CVEs
4
3
2
2
2
IDS Classtypes
70
58
3
3
2
IDS Protocols
66
23
15
12
9
BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Excel file, they are prompted to enable a malicious macro that infects their device with BazaLoader.
This query surfaces connections to the distinctive .xyz domains that the BazaCall campaign uses to host malicious Excel files.
This query surfaces connections to the distinctive .xyz domains that the BazaCall campaign uses to host malicious Excel files.
This analytic identifies outbound LDAP traffic to external IP addresses. It leverages network traffic data to detect connections on ports 389 (LDAP) or 636 (LDAPS) that are not directed to private IP ranges (RFC1918). This activity is significant because outbound LDAP traffic can indicate potential data exfiltration or unauthorized access attempts. If confirmed malicious, attackers could exploit this to access sensitive directory information, leading to data breaches or further network compromise. The rule specifically excludes traffic between internal source and destination IPs.
This rule detects outbound network connections to IP addresses that have been observed for the first time within the last 24 hours. It specifically excludes connections to private IP address ranges (RFC1918). The detection relies on correlating current network connection events with historical 'first seen' data for IP addresses from an entity graph.
The following analytic identifies network traffic where the higher layer protocol does not match the expected port, such as non-HTTP traffic on TCP port 80. It leverages data from network traffic inspection technologies like Bro or Palo Alto Networks firewalls. This activity is significant because it may indicate attempts to bypass firewall restrictions or conceal malicious communications. If confirmed malicious, this behavior could allow attackers to evade detection, maintain persistence, or exfiltrate data through commonly allowed ports, posing a significant threat to network security.
Detects network web access to a low prevalence domain
IOC IP Target
YARA-L
Detect network events that indicate communication to a watchlisted IP address
IP Target Prevalence
YARA-L
Detect events that are communicating to IP addresses that have a low rolling max prevalence.
This analytic identifies internal systems that generate a high volume of intrusion detection events within a 30-minute window, specifically leveraging Cisco Secure Firewall Threat Defense logs. It counts hosts that trigger 15 or more Snort-based signatures. A sudden increase in intrusion alerts from a single host can indicate malicious activity such as malware execution, command-and-control communication, vulnerability scanning, or lateral movement. It may also be caused by misconfigured software. Systems exhibiting this pattern require prompt investigation as repeated Snort rule matches are often early indicators of compromise or active exploitation.
The following analytic identifies high inbound or outbound network I/O anomalies in Kubernetes containers. It leverages process metrics from an OTEL collector and Kubelet Stats Receiver, along with data from Splunk Observability Cloud. A lookup table with average and standard deviation values for network I/O is used to detect anomalies persisting over a 1-hour period. This activity is significant as it may indicate data exfiltration, command and control communication, or unauthorized data transfers. If confirmed malicious, it could lead to data breaches, service outages, financial losses, and reputational damage.
This analytic identifies significant changes in network communication behavior within Kubernetes containers by examining the inbound to outbound network IO ratios. It leverages process metrics from an OTEL collector and Kubelet Stats Receiver, along with data from Splunk Observability Cloud. Anomalies are detected using a lookup table containing average and standard deviation values for network IO, triggering an event if the anomaly persists for over an hour. This activity is significant as it may indicate data exfiltration, command and control communication, or compromised container behavior. If confirmed malicious, it could lead to data breaches, service outages, and unauthorized access within the Kubernetes cluster.
The following analytic detects the use of default or publicly known named pipes associated with the RMX remote admin tool. It leverages Sysmon EventCodes 17 and 18 to identify named pipe creation and connection events. This activity is significant as the RMX tool has been abused by adversaries and malware like Azorult to collect data from targeted hosts. If confirmed malicious, this could indicate unauthorized remote administration capabilities, leading to data exfiltration or further compromise of the affected system. Immediate investigation is required to determine the legitimacy of this tool's presence.
This YARA rule detects the Sshdinjector backdoor on Linux systems. It identifies specific byte patterns associated with the backdoor's functionalities, including killing and restarting daemons, network communication, reading the /etc/shadow file (for credential dumping), and listing running services.
Yara rule that detects BackConnect backdoor.
This rule detects when an Amazon EC2 instance or a container attempts to communicate with a black hole IP address, as reported by AWS GuardDuty. Black hole IP addresses are typically used to sinkhole malicious traffic or are unroutable, indicating potentially suspicious or misconfigured outbound communication from a compromised or misbehaving resource.
This rule detects Command and Control (C2) activity identified by AWS GuardDuty across Amazon EC2, AWS Lambda, or Amazon EKS Runtimes. It specifically looks for GuardDuty findings with a product event type matching 'C&CActivity' and filters out sample findings. The rule aims to alert on suspicious communication patterns that indicate an adversary is controlling compromised resources within the AWS environment.
Suspicious ASN Watchlist
YARA-L
Identify any network connections to a list of ASNs
Identify network traffic based on target country
Amazon GuardDuty detects an Amazon EC2 instance or a container attempting to communicate with a black hole IP address.
Amazon GuardDuty detects Command and control activity in Amazon EC2, AWS Lambda or Amazon EKS Runtimes.
Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential process injection activity from a beacon or similar mechanisms.
Yara rule that detects Voldemort backdoor.
Page 58 of 60