Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
178 detections
Filters
Last updated
All Time
Detection languages
92
31
29
9
6
Contributors
66
27
16
11
8
Categories
105
81
64
53
28
Platforms
95
58
11
11
9
Products / Services
83
78
23
19
15
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
49
38
3
1
IDS Protocols
55
28
6
Detects connections with Azure Front Door (known legitimate service that can be leveraged for C2)
that fall outside of known benign behavioral baseline (not using common apps or common azurefd.net endpoints)
that fall outside of known benign behavioral baseline (not using common apps or common azurefd.net endpoints)
'CreepyDrive uses OneDrive for command and control, however, it makes regular requests to predicatable paths.
This detecton will alert when over 20 sequences are observed in a single day.'
This detecton will alert when over 20 sequences are observed in a single day.'
Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
'CreepyDrive uses OneDrive for command and control. This detection identifies URLs specific to CreepyDrive.'
This query finds network communication to specific URL.
Please note that in line #7 it filters RemoteUrl using has operator, which looks for a "whole term" and runs faster.
Example: RemoteUrl has "microsoft" matches "www.microsoft.com" but not "microsoftonline.com".
Please note that in line #7 it filters RemoteUrl using has operator, which looks for a "whole term" and runs faster.
Example: RemoteUrl has "microsoft" matches "www.microsoft.com" but not "microsoftonline.com".
This analytic identifies a process making a DNS query to Discord, excluding legitimate Discord application paths. It leverages Sysmon logs with Event ID 22 to detect DNS queries containing "discord" in the QueryName field. This activity is significant because Discord can be abused by adversaries to host and download malicious files, as seen in the WhisperGate campaign. If confirmed malicious, this could indicate malware attempting to download additional payloads from Discord, potentially leading to further code execution and compromise of the affected system.
This rule detects suspicious DNS queries specifically targeting 'api.telegram.org'. This domain is used by Telegram Bot API, which can be leveraged by various types of malware (e.g., RATs, ransomware) for command and control (C2) or data exfiltration. Monitoring these queries helps identify systems potentially communicating with malicious Telegram bots.
This rule detects suspicious network requests to the Telegram API (api.telegram.org) that do not include a standard 'Telegram' or 'Bot' user-agent string. This behavior is often indicative of malware or custom tools attempting to use Telegram's API for command and control or data exfiltration without revealing their identity as a legitimate Telegram client or bot.
Detects suspicious DNS queries to api.telegram.org used by Telegram Bots of any kind
This rule detects the LimeRAT backdoor by identifying specific byte patterns associated with its persistence mechanism, cryptocurrency mining capabilities, downloader functionality, and network communication routines. The rule looks for a combination of these distinct patterns within a file to confirm the presence of LimeRAT.
Page 9 of 9