Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
21 detections
Filters
Last updated
All Time
Detection languages
11
4
2
2
2
Contributors
6
4
2
1
1
Categories
11
8
6
6
4
Platforms
14
8
2
2
1
Products / Services
7
5
5
4
4
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
3
1
IDS Protocols
3
1
Detects when an SAP process opens an FTP session to a host that is not on the approved server list.
This rule detects anomalous activity associated with the Antino backdoor, which uses Microsoft OneDrive as a dead-drop command-and-control (C2) channel. It identifies specific file paths related to heartbeat check-ins, operator tool drops, and exfiltration retrieval, summarizing events by user and IP to highlight potential malicious persistent communication and data transfer patterns.
Detects suspicious FTP command and control traffic originating from internal hosts to known compromised servers in Taiwan. The rules monitor for specific FTP commands such as STOR (to upload archive4.zip), RETR (to download archive1.zip), and initial authentication (USER command) associated with C2 communication.
This rule detects network connections to FTP servers (port 21) where the remote URL contains keywords associated with NetWare or Novell, along with suspicious whitespace patterns. This could indicate an attempt to exploit a known vulnerability related to whitespace handling in NetWare FTP servers, potentially the 'Squidbleed' vulnerability.
Detects instances of FTP transfer mode switching (ASCII/Binary) by monitoring network events for FTP traffic on port 21 and specific commands like 'TYPE A' or 'TYPE I' in the RemoteUrl. This behavior can be indicative of data transfer activities, potentially related to vulnerabilities or malicious data exfiltration.
Detects instances of FTP transfer mode switching (ASCII/Binary) by monitoring network events for FTP traffic on port 21 and specific commands like 'TYPE A' or 'TYPE I' in the RemoteUrl. This behavior can be indicative of data transfer activities, potentially related to vulnerabilities or malicious data exfiltration.
This rule detects network events where an FTP LIST response contains malformed directory entries, potentially indicating an attempt to exploit the Squidbleed vulnerability. It specifically looks for network signature inspections on port 21 (FTP) with common FTP commands (LIST, NLST, MLSD, MLST, RETR) in the RemoteUrl, while excluding common log and text file extensions.
Detects FTP protocol being used for covert C2 communications
Detects FTP traffic with suspicious URLs referencing potentially insecure or legacy protocols.
This rule detects network connections to FTP servers (port 21) where the remote URL contains keywords associated with NetWare or Novell, along with suspicious whitespace patterns. This could indicate an attempt to exploit a known vulnerability related to whitespace handling in NetWare FTP servers, potentially the 'Squidbleed' vulnerability.
This rule detects the use of SFTP (Secure File Transfer Protocol) as a covert command and control (C2) data channel. It specifically looks for TCP traffic on port 22 (SFTP's default port) with a specific content pattern ('|00 00 00|') within the first 4 bytes of the payload, a payload size between 100 and 500 bytes, and a high frequency (20 times in 60 seconds) from a single source IP address. This pattern and frequency could indicate an attempt to exfiltrate data or maintain C2 communication disguised as legitimate SFTP traffic.
FTP Used as C2 Command Channel
Suricata
This rule detects potential command and control (C2) activity over FTP by identifying a high frequency of 'RETR' (retrieve) commands. A threshold of 20 'RETR' commands within 60 seconds from the same source IP address triggers the alert. This pattern can indicate an attacker using FTP to download commands or tools from a C2 server.
This rule detects a potential FTP C2 (Command and Control) channel exhibiting a regular beaconing pattern. It triggers an alert if 10 or more TCP connections are made to port 21 (FTP) from a single source IP address within a 300-second window, indicating established communication from the internal network to an external FTP server. This behavior is characteristic of malware using FTP for C2 communications.
Detects network connections over FTP (port 21) to specific compromised IP addresses abused by the LucidRook malware. The threat actor utilizes these Taiwanese FTP servers to stage payloads and receive exfiltrated data.
This rule detects suspicious network communication patterns indicative of command and control (C2) activity by analyzing the jitter (variability) in connection gaps and byte transfer sizes. It identifies connections with a high number of events, a consistent average gap between connections, and low jitter in both connection timing and data transfer sizes (bytes out and bytes in). This pattern can suggest automated, scheduled communication often associated with C2 channels.
This rule identifies devices connected to Wi-Fi networks with public IP addresses and correlates those connections with outbound network events. It aims to provide process-level context for connections originating from such network configurations, including geolocation of both local and remote IPs. This could indicate unusual or unauthorized network activity, potentially related to command and control or data exfiltration from devices on less secure network segments.
This detection identifies outbound NTLM authentication attempts to remote SMB servers with suspicious characteristics consistent with the use of impacket-smbserver, a tool commonly used by adversaries for lateral movement and data exfiltration. The detection looks for RemotePort 445 traffic where:
- The server version is the anomalous string 255.255 65535 255
- Server identity fields (DNS and NetBIOS names) are exactly 8 characters long, which is typical for randomly generated names by impacket-smbserver
This pattern strongly indicates impersonation or malicious SMB hosting by an attacker within the network.
- The server version is the anomalous string 255.255 65535 255
- Server identity fields (DNS and NetBIOS names) are exactly 8 characters long, which is typical for randomly generated names by impacket-smbserver
This pattern strongly indicates impersonation or malicious SMB hosting by an attacker within the network.
KQL Query from file: Tracking Proton66 Activity with KQL
The analytic detects outbound SMB (Server Message Block) connections from internal hosts to external servers. It identifies this activity by monitoring network traffic for SMB requests directed towards the Internet, which are unusual for standard operations. This detection is significant for a SOC as it can indicate an attacker's attempt to retrieve credential hashes through compromised servers, a key step in lateral movement and privilege escalation. If confirmed malicious, this activity could lead to unauthorized access to sensitive data and potential full system compromise.
Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
Detects when files are transferred using the ScreenConnect Remote Monitoring and Management (RMM) tool. This activity can indicate an adversary using legitimate tools for data exfiltration or staging.
