Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
106 detections
Filters
Last updated
All Time
Detection languages
47
23
20
7
3
Contributors
20
20
19
13
6
Categories
55
45
28
20
13
Platforms
54
35
22
6
2
Products / Services
48
47
22
15
5
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
20
13
8
6
IDS Protocols
29
15
1
Detects the creation of specific files associated with the Pingback backdoor, which is known to establish an ICMP tunnel for command and control (C2) communications. The rule specifically looks for 'updata.exe' being created and 'C:\Windows\oci.dll' as the target filename, as described in the Trustwave report.
Detects the loading of 'oci.dll' by 'msdtc.exe', which is indicative of the Pingback backdoor. This backdoor is known to establish an ICMP tunnel for command and control communication.
Detects the execution of suspicious commands often used in Command and Control (C2) activities, as identified in Florian Roth's 'Best Practice Auditd Configuration'. These commands include `wget`, `curl`, `base64`, `nc`, `netcat`, `ncat`, `ssh`, `socat`, `wireshark`, `rawshark`, `rdesktop`, and `nmap`. These tools can be leveraged for various adversarial techniques such as data transfer, remote access, network discovery, and data encoding.
Detects suspicious activities as declared by Florian Roth in its 'Best Practice Auditd Configuration'.
This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap.
These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)
This includes the detection of the following commands; wget, curl, base64, nc, netcat, ncat, ssh, socat, wireshark, rawshark, rdesktop, nmap.
These commands match a few techniques from the tactics "Command and Control", including not exhaustively the following; Application Layer Protocol (T1071), Non-Application Layer Protocol (T1095), Data Encoding (T1132)
Detects potential Command and Control (C2) communication patterns based on ASIM-normalized network session data in Microsoft Sentinel. This detection covers three primary patterns:
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
1) Periodic beaconing with low jitter
2) Long-lived HTTP(S) long-polling sessions
3) Network traffic with very consistent payload sizes
Such patterns can indicate covert communication with compromised systems or malware infections.
Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
This query was originally published by PWC Security Research Team.
BPFDoor is custom backdoor malware used by Red Menshen. The BPFDoor allows an adversary to backdoor a system and remotely execute codes without opening any new network ports or firewall rules.
BPFDoor is custom backdoor malware used by Red Menshen. The BPFDoor allows an adversary to backdoor a system and remotely execute codes without opening any new network ports or firewall rules.
This query checks for network connection failures to Microsoft Defender for Endpoint URLs.
The output includes any device with 1+ connectivity failures, a list of the domains they
failed to connect to (including the number of failures), as well as the overall number of
failures in the time period. Results are sorted by the total number of connection failures
by the device.
The output includes any device with 1+ connectivity failures, a list of the domains they
failed to connect to (including the number of failures), as well as the overall number of
failures in the time period. Results are sorted by the total number of connection failures
by the device.
This advanced hunting query detects processes communicating with known Tor relay IP addresses.
The public URL in the query is updated daily at 12PM and 12AM UTC.
CSV source is the Tor Project API, obtained with: https://github.com/Dylan-J/Tor-Project-Statistics
The public URL in the query is updated daily at 12PM and 12AM UTC.
CSV source is the Tor Project API, obtained with: https://github.com/Dylan-J/Tor-Project-Statistics
Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
Detects execution of Netcat. Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network
'This query identifies matches based on domain IOCs related to KNOTWEED against Microsoft Defender for Endpoint device network connections'
The analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes. It leverages network traffic data to detect large ICMP packets that aren't blocked and are directed toward external networks. This can indicate information smuggling, covert communication, or command-and-control (C2) activities, potentially signaling ICMP tunneling, unauthorized data transfer, or compromised endpoints.
The analytic detects the use of the `curl` command with proxy-related arguments such as `-x`, `socks`, `--preproxy`, and `--proxy`. This activity is significant as it may indicate an adversary attempting to use a proxy to evade network monitoring and obscure their actions. If confirmed malicious, this behavior could allow attackers to bypass security controls, making it difficult to track their activities and potentially leading to unauthorized data access or exfiltration.
This rule detects suspicious DNS queries where the Z flag bit in the DNS protocol header is set to a non-zero value. The Z flag is reserved (unused) per IETF design, though it has recently been used in DNSSec. A non-zero Z flag value should be rare outside of legitimate DNSSec usage. The rule includes exclusions for common TLDs, query types (NS, MX), responses, and NetBIOS related traffic to reduce false positives. The rule's intent is to identify potential command and control (C2) or data exfiltration attempts leveraging DNS anomalies.
Detects the installation of suspicious packages using common Linux package managers (apt, yum, rpm, dpkg). The rule specifically looks for keywords associated with network scanning, sniffing, and proxy tools, which could indicate reconnaissance, network analysis, or attempts to bypass network controls by an adversary.
Detects the execution of Netcat (nc.exe, ncat.exe, netcat.exe) with suspicious command-line arguments often associated with establishing listener modes, reverse shells, or proxy connections. Netcat is a versatile networking utility that can be used by adversaries for command and control (C2) communication, data exfiltration, or creating backdoors, often leveraging non-application layer protocols.
Detects the installation of suspicious applications by monitoring the Windows Shell-Core event log for EventID 28115, which indicates a shortcut being added to the app resolver cache. The rule specifically looks for known suspicious application names like Zenmap, AnyDesk, Wireshark, and OpenVPN in the 'Name' or 'AppID' fields.
This rule detects the use of 'powercat' or 'powercat.ps1' within PowerShell classic logs. Powercat is a PowerShell-based network utility similar to Netcat, often used by adversaries for network communication, including reverse shells, bind shells, and file transfers, potentially bypassing traditional network controls. This activity is indicative of command and control communication or lateral movement using non-application layer protocols.
The DNS Z flag is bit within the DNS protocol header that is, per the IETF design, meant to be used reserved (unused).
Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare.
Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward.
Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering.
This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'
Although recently it has been used in DNSSec, the value being set to anything other than 0 should be rare.
Otherwise if it is set to non 0 and DNSSec is being used, then excluding the legitimate domains is low effort and high reward.
Determine if multiple of these files were accessed in a short period of time to further enhance the possibility of seeing if this was a one off or the possibility of larger sensitive file gathering.
This Sigma query is designed to accompany the Corelight Threat Hunting Guide, which can be found here: https://www3.corelight.com/corelights-introductory-guide-to-threat-hunting-with-zeek-bro-logs'
Page 5 of 6