Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
461 detections
Filters
Last updated
All Time
Detection languages
163
113
109
24
15
Contributors
109
73
61
49
26
Categories
167
139
127
91
71
Platforms
232
129
75
30
23
Products / Services
108
101
88
53
39
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
6
2
1
1
1
IDS Classtypes
60
46
5
1
1
IDS Protocols
43
30
21
7
6
Detects when Microsoft Cloud App Security reports user activity originating from an IP address identified as an anonymous proxy. This indicates potential attempts to obscure the true source of network connections, which could be used for malicious purposes such as bypassing security controls or maintaining anonymity during an attack.
Detects the execution of the Chisel tunneling tool by analyzing command-line arguments. Chisel is a fast TCP/UDP tunnel, secured by SSH, and can be used for various tunneling purposes, including creating SOCKS5 proxies or reverse tunnels. This rule specifically looks for the 'chisel.exe' image name combined with common client/server commands and tunneling parameters like '-socks5', '-reverse', or '-tls-skip-verify'.
Detects the execution of 'curl.exe' with command-line flags that disable security checks for proxy or DNS over HTTPS (DoH) connections. This behavior can indicate an attempt to bypass security controls or establish covert communication channels.
Detects cases where ngrok, a legitimate reverse proxy tool, is used to forward traffic to the local Remote Desktop Protocol (RDP) port. This activity can indicate malicious behavior, as adversaries often use tools like ngrok for command and control, bypassing firewalls, or establishing persistent remote access to compromised systems.
This rule detects sign-in attempts originating from IP addresses that have been identified as infected with malware. These malware-infected IP addresses are known to actively communicate with bot servers, indicating a high risk of compromise or malicious activity associated with the sign-in.
This rule identifies user sign-ins originating from anonymous IP addresses, which may indicate the use of VPNs, Tor, or other anonymization services. Such activity can be a sign of an adversary attempting to mask their true location or identity during an access attempt.
This rule detects sign-in attempts originating from IP addresses that Microsoft Entra ID Protection has identified as malicious. These IP addresses are known to be associated with attackers or compromised systems at the time of the sign-in, indicating a high-risk authentication attempt.
This rule detects sign-in attempts originating from IP addresses identified as malicious by Azure AD Identity Protection, specifically when these attempts are characterized by a high failure rate. This indicates potential brute-force attacks, credential stuffing, or other unauthorized access attempts from known bad IP addresses.
Detects an executable initiating a network connection to "ngrok" tunneling domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects PowerShell scripts that create TCP listeners and accept client connections, which is indicative of tunneling activity. The rule specifically looks for the use of '[System.Net.HttpWebRequest]', 'System.Net.Sockets.TcpListener', and 'AcceptTcpClient' within the script block text.
Detects the execution of Htran or Htran-like tools such as NATBypass, identified by specific executable names or command-line arguments. These tools are commonly used for proxying network connections to obscure the origin of malicious traffic.
This rule detects the execution of the `netsh.exe` utility to configure a port forwarding rule specifically for RDP (port 3389). This technique can be used by adversaries to bypass network restrictions and establish RDP tunnels for lateral movement or command and control.
Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfiltration of data exfiltration by malicious actors
Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which could be a sign of malicious behaviour
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Indicates sign-in from a malicious IP address based on high failure rates.
Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.
Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.
Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity
Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)
Page 22 of 22