Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
88 detections
Filters
Last updated
All Time
Detection languages
46
20
16
4
2
Contributors
27
17
10
9
8
Categories
47
44
32
31
12
Platforms
50
40
10
6
3
Products / Services
41
38
13
13
6
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
27
16
2
1
IDS Protocols
34
7
5
Detects an initiated network connection by a non-browser process on the system to "azurewebsites.net". This domain has been frequently used by threat actors for malware hosting and data exfiltration. The rule filters out connections made by common web browsers and other legitimate applications to reduce false positives.
Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.
This rule detects network connections initiated by executables (excluding common internet browsers and known applications) to a list of legitimate, popular websites that have been previously identified as 'dead drop resolvers' in cyberattacks. Attackers leverage these trusted websites (e.g., Facebook, YouTube, Google Drive) to host C2 infrastructure or relay data, aiming to blend in with normal network traffic and evade detection. The rule specifically filters out connections from a comprehensive list of legitimate browser executables and other applications to reduce false positives.
This rule detects direct access to raw content hosted on various paste services. Adversaries often use these services to host malicious code (e.g., encrypted or encoded payloads) that is downloaded in subsequent stages of an attack, leveraging the services for command and control or defense evasion.
Page 5 of 5