Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
34 detections
Filters
Last updated
All Time
Detection languages
20
6
4
3
1
Contributors
11
5
4
3
3
Categories
13
12
9
7
6
Platforms
14
14
9
2
2
Products / Services
14
9
7
6
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
6
IDS Protocols
6
Detects outbound SMTP traffic associated withAVERAT malware, tracking the EHLO sequence, STARTTLS command negotiation, server acceptance, and subsequent custom TLS ClientHello patterns on port 25.
Detects outbound SMTP traffic associated withAVERAT malware, tracking the EHLO sequence, STARTTLS command negotiation, server acceptance, and subsequent custom TLS ClientHello patterns on port 25.
Detects outbound SMTP traffic associated withAVERAT malware, tracking the EHLO sequence, STARTTLS command negotiation, server acceptance, and subsequent custom TLS ClientHello patterns on port 25.
Detects outbound SMTP traffic associated withAVERAT malware, tracking the EHLO sequence, STARTTLS command negotiation, server acceptance, and subsequent custom TLS ClientHello patterns on port 25.
This rule detects anomalous outbound SMTP (port 25) traffic originating from a NetScaler ADC or Gateway appliance. Since these appliances have no legitimate business requirement to initiate outbound SMTP communication, such traffic is a strong indicator of post-compromise activity, potentially used for command and control or data exfiltration.
This rule monitors for suspicious network traffic to SMTP services and specific external email addresses, as well as process command lines containing these indicators. Additionally, it tracks email events involving specific sender, recipient, and subject indicators which may be indicative of unauthorized communication or data exfiltration attempts.
Detects outbound SMTP communication to Gmail servers containing specific indicators of compromise (sender, recipient, or subject line) associated with the LucidKnight (LucidRook) malware campaign, indicating potential reconnaissance data exfiltration.
This rule detects activities associated with the NotDoor malware used by APT28 for email-based exfiltration. It specifically monitors for the creation of staging files in temporary directories, the use of Outlook.exe to establish external SMTP connections on common mail ports, and the transmission of emails to known adversary-controlled addresses.
This rule detects activities associated with the NotDoor malware used by APT28 for email-based exfiltration. It specifically monitors for the creation of staging files in temporary directories, the use of Outlook.exe to establish external SMTP connections on common mail ports, and the transmission of emails to known adversary-controlled addresses.
This rule detects potential Command and Control (C2) communication over SMTP (port 25). It specifically looks for TCP traffic originating from the home network to any destination on port 25, indicating an established connection. A threshold of 10 connections within 300 seconds from the same source IP is set to reduce false positives, suggesting a high volume of SMTP activity that could be indicative of C2.
Detects high-fidelity static artifacts from VECT 2.0 across Windows, Linux, and ESXi variants. This includes known SHA-256 hashes of the ransomware executables, the '.vect' encrypted file extension, the '!!!READ_ME!!!.txt' ransom note, the 'dvm3_wall.bmp' wallpaper, the 'vector_notice.sh' shell hook, and the embedded Tor C2 hostname. These indicators are unique to VECT ransomware and have no legitimate use.
This rule detects suspicious network communication patterns indicative of command and control (C2) activity by analyzing the jitter (variability) in connection gaps and byte transfer sizes. It identifies connections with a high number of events, a consistent average gap between connections, and low jitter in both connection timing and data transfer sizes (bytes out and bytes in). This pattern can suggest automated, scheduled communication often associated with C2 channels.
Detects the legitimate Windows utility 'attrib.exe' initiating outbound network connections to common SMTP ports. This behavior is highly anomalous as attrib.exe is used to modify file attributes and should not be making network connections. The Mispadu banking trojan is known to inject its code into attrib.exe and use it to self-propagate by sending phishing emails.
The following analytic identifies DNS queries to known TOR proxy websites, such as "*.torproject.org" and "www.theonionrouter.com". It leverages Sysmon EventCode 22 to detect these queries by monitoring DNS query events from endpoints. This activity is significant because adversaries often use TOR proxies to disguise the source of their malicious traffic, making it harder to trace their actions. If confirmed malicious, this behavior could indicate an attempt to obfuscate network traffic, potentially allowing attackers to exfiltrate data or communicate with command and control servers undetected.
Analyze Mail Bomb Attack by ISP
KQL Query
KQL Query from file: MDE: Detecting Quick Assist Usage
KQL Query from file: Threat hunting voice phishing for Teams
KQL Query from file: Detecting TeamsPhisher attack with Azure Sentinel
KQL Query from file: LockBit Black Ransomware
KQL Query
Page 1 of 2