Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
301 detections
Filters
Last updated
All Time
Detection languages
119
80
68
11
9
Contributors
87
39
27
26
22
Categories
136
107
105
84
44
Platforms
133
127
29
28
16
Products / Services
113
105
39
30
24
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
2
2
1
1
IDS Classtypes
78
36
3
1
1
IDS Protocols
74
30
11
2
'This query looks at the last 14 days for "Consent to application" operation by a user/app which could potentially mean unauthorized access. Additional context is added from AuditLogs based on CorrleationId from the same account that performed the action.'
'This hunting query looks for hosts that have attempted to interact with the Discord CDN. This activity is not normally invoked from the command line and could indicate C2, exfiltration, or malware delivery activity.'
Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service
Detects an initiated network connection by a non-browser process on the system to "azurewebsites.net". This domain has been frequently used by threat actors for malware hosting and data exfiltration. The rule filters out connections made by common web browsers and other legitimate applications to reduce false positives.
This rule detects network connections initiated by an executable to sub-domains associated with the "LocaltoNet" tunneling service. LocaltoNet is a reverse proxy that exposes localhost services to the internet. Adversaries have been observed leveraging this service for command-and-control (C2) activities, often to bypass multi-factor authentication (MFA) and perimeter security controls.
Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
The following analytic detects the execution of suspicious processes on systems identified as web servers. It leverages the Splunk data model "Endpoint.Processes" to search for specific process names such as "whoami", "ping", "iptables", "wget", "service", and "curl". This activity is significant because these processes are often used by attackers for reconnaissance, persistence, or data exfiltration. If confirmed malicious, this could lead to data theft, deployment of additional malware, or even ransomware attacks. Immediate investigation is required to determine the legitimacy of the activity and mitigate potential threats.
This rule detects when a user attempts to download multiple unique files from OneDrive via the Microsoft Graph API, and these download attempts result in a 401 Unauthorized status code. This behavior may indicate a permissions issue for the user, potentially due to misconfiguration, revoked access, or an attempt to access unauthorized resources.
This rule identifies API requests made to the Microsoft Graph API to access user mailboxes and retrieve a specified number of messages. It specifically looks for GET requests to the `/v1.0/users/*/mailFolders/*/messages?$top=` endpoint with a successful HTTP 200 response. This activity could indicate an attacker attempting to exfiltrate emails from a compromised mailbox.
This rule identifies when the HTTP DELETE method is used within the Microsoft Graph API. This can indicate administrative activities such as deleting users, groups, or other resources. The rule specifically looks for network HTTP events where the product event type is 'Microsoft Graph Activity' and the HTTP method is 'DELETE'. It excludes IP addresses within a specific Azure CIDR range (20.151.0.0/16) to reduce noise from internal Azure operations. Further tuning can be applied to target specific API endpoints or user agents.
Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet). The rule specifically looks for connections to Google API domains from processes that are not common web browsers or Google-related applications, aiming to identify potentially malicious command and control activity.
Detects a non-browser process interacting with the Google API which could indicate the use of a covert C2 such as Google Sheet C2 (GC2-sheet)
This rule detects a suspicious sequence of events: a process launching with a low prevalence executable (meaning it's rarely seen in the environment) followed by that same process initiating an HTTP connection to a low prevalence domain (a domain rarely accessed in the environment) within a 10-minute window. This combination can indicate the execution of novel or custom malware attempting to establish command and control or exfiltrate data to an unusual destination.
Detects the execution of the "cloudflared" tool with the "tunnel cleanup" command. This command is used to remove Cloudflare Tunnel connections, which could be an indicator of an adversary attempting to remove traces of their C2 infrastructure or clean up after an operation. The rule looks for specific command-line arguments including 'tunnel', 'cleanup', and either '-config' or '-connector-id'.
This rule detects network connections initiated by executables (excluding common internet browsers and known applications) to a list of legitimate, popular websites that have been previously identified as 'dead drop resolvers' in cyberattacks. Attackers leverage these trusted websites (e.g., Facebook, YouTube, Google Drive) to host C2 infrastructure or relay data, aiming to blend in with normal network traffic and evade detection. The rule specifically filters out connections from a comprehensive list of legitimate browser executables and other applications to reduce false positives.
Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.
Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.
This rule detects outbound network connections to ngrok tunneling service endpoints. Ngrok is a legitimate tool that can be used to expose local servers to the internet, but it is also frequently leveraged by malicious actors for data exfiltration, command and control, and bypassing network restrictions. Detection of communication to these specific ngrok domains could indicate unauthorized use of the service for malicious purposes.
Page 14 of 15