Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
21 detections
Filters
Last updated
All Time
Detection languages
9
6
5
1
Contributors
4
3
3
2
2
Categories
10
9
7
6
4
Platforms
13
5
4
3
1
Products / Services
10
9
5
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
9
IDS Protocols
7
2
Detects specific JSON-RPC calls indicating C2 communication associated with the Graphalgo RAT. The rule identifies calls to the 'eth_call' method referencing specific function names like 'setCPubKey', 'serviceData', or a hardcoded Arbitrum Sepolia contract address used as a blockchain dead-drop mechanism.
Detects outbound network traffic (TLS SNI and HTTP requests) directed to the Telegram Bot API endpoint. This behavior is often associated with malware using Telegram as a command-and-control (C2) channel or for the exfiltration of stolen data, credentials, or sensitive information.
Detects network activity associated with a phishing campaign leveraging Cloudflare Workers, identified as 'ARToken'. The rules monitor for specific TLS SNI patterns, HTTP Host headers, and subsequent C2-like behavior involving device code authentication flows (api/device/start and api/device/poll) hosted on 'workers.dev'.
Detects a multi-stage phishing redirect chain used in 'EvilTokens' attacks. The rule identifies communication with common serverless hosting platforms (Vercel, Cloudflare Workers, AWS Lambda/Execute-API) followed by interaction with anti-bot/CAPTCHA gates (Cloudflare Turnstile, hCaptcha, Google reCAPTCHA) and finally reaching known Microsoft device code phishing endpoints (/devicelogin or /common/oauth2/deviceauth).
Detects a multi-stage phishing redirect chain used in 'EvilTokens' attacks. The rule identifies communication with common serverless hosting platforms (Vercel, Cloudflare Workers, AWS Lambda/Execute-API) followed by interaction with anti-bot/CAPTCHA gates (Cloudflare Turnstile, hCaptcha, Google reCAPTCHA) and finally reaching known Microsoft device code phishing endpoints (/devicelogin or /common/oauth2/deviceauth).
Detects a multi-stage phishing redirect chain used in 'EvilTokens' attacks. The rule identifies communication with common serverless hosting platforms (Vercel, Cloudflare Workers, AWS Lambda/Execute-API) followed by interaction with anti-bot/CAPTCHA gates (Cloudflare Turnstile, hCaptcha, Google reCAPTCHA) and finally reaching known Microsoft device code phishing endpoints (/devicelogin or /common/oauth2/deviceauth).
Detects a multi-stage phishing redirect chain used in 'EvilTokens' attacks. The rule identifies communication with common serverless hosting platforms (Vercel, Cloudflare Workers, AWS Lambda/Execute-API) followed by interaction with anti-bot/CAPTCHA gates (Cloudflare Turnstile, hCaptcha, Google reCAPTCHA) and finally reaching known Microsoft device code phishing endpoints (/devicelogin or /common/oauth2/deviceauth).
Larva-24009 HeptaX C2 beacon to shared infrastructure (get-command/index/new-upload/post_proc)
Detects instances where the Microsoft Installer process (msiexec.exe) initiates a network connection to the local IPv4 loopback address (127.0.0.1). This behavior may indicate an MSI custom-action payload attempting to interact with a web browser through the Chrome DevTools Protocol (CDP) to establish a covert command-and-control channel.
Photo-themed ZIP phishing campaign dropping a Node.js implant
This rule detects HTTP PUT requests to Amazon S3 or Azure Blob Storage (cloud storage services) where the request body size is between 100 and 2000 bytes. This pattern is often indicative of one-way command and control (C2) communication, where an attacker might be exfiltrating small chunks of data or sending commands to a compromised host via cloud storage. The thresholding mechanism (20 events within 300 seconds from the same source) aims to reduce alerts from legitimate, infrequent cloud storage interactions.
Detects direct access to raw pastes in different paste services often used by malware in their second stages to download malicious code in encrypted or encoded form
Detects network traffic to known VOID#GEIST C2 domains hosted on TryCloudflare, or the specific command-line execution of `curl.exe` used to send a 'status=success' beacon. This activity confirms a successful compromise by the malware.
Detects DNS queries for subdomains of 'trycloudflare.com' originating from suspicious processes, such as script interpreters and LOLBins.
Attackers, such as those behind the VOID#GEIST campaign, leverage Cloudflare Tunnels to host command and control (C2) infrastructure, and initiating these connections from script interpreters or LOLBins is a common TTP.
Attackers, such as those behind the VOID#GEIST campaign, leverage Cloudflare Tunnels to host command and control (C2) infrastructure, and initiating these connections from script interpreters or LOLBins is a common TTP.
Detects ICMP Echo Request packets where the Identification field is set to the specific magic value 0xC0DE (49374). This value is used by the VoidLink rootkit as a trigger for its covert, out-of-band C2 channel, which can bypass standard firewall rules.
PwnDrp Access
Sigma
Detects downloads from PwnDrp web servers developed for red team testing and most likely also used for criminal activity
This detection identifies instances where Rundll32.exe or svchost.exe are executed by processes initiated through .lnk (shortcut) files, particularly those masquerading as PDFs or containing suspicious keywords like "申報物品清單" (Declaration of Items List). It further filters for command lines referencing potentially malicious file types such as .dll, .dat, .jpg, .zip, or .png, and checks for execution from common user or system directories often abused by malware (e.g., Temp, AppData, Public). This behavior is indicative of initial access or execution stages of malware campaigns, such as those involving the ToughProgress malware family.
KQL Query from file: Global Admin Entra Cookie with Chrome ZeroDay
'Identifies a match for SQL Injection attack in the Application gateway WAF logs. The Threshold value in the query can be changed as per your infrastructure's requirement.
References: https://owasp.org/Top10/A03_2021-Injection/'
References: https://owasp.org/Top10/A03_2021-Injection/'
Query 1 shows you any network communication happened from endpoints to a specific Remote IP or Remote URL.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
Ensure to update RemoteIP and RemoteURL variable.
For questions @MiladMSFT on Twitter or milad.aslaner@microsoft.com by email.
This rule detects direct access to raw content hosted on various paste services. Adversaries often use these services to host malicious code (e.g., encrypted or encoded payloads) that is downloaded in subsequent stages of an attack, leveraging the services for command and control or defense evasion.