Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
10
8
3
3
Contributors
8
6
4
2
1
Categories
12
9
9
9
7
Platforms
13
12
3
1
1
Products / Services
10
9
5
4
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
8
2
IDS Protocols
5
3
1
1
'This detection will identify network requests in HTTP proxy data that contains Base64 encoded usernames from machines in the DeviceEvents table.
This technique was seen usee by POLONIUM in their RunningRAT tool.'
This technique was seen usee by POLONIUM in their RunningRAT tool.'
'Identifies instances of a base64 encoded PE file header seen in the process command line parameter.
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
This query will identify strings in process command lines which match Base64 encoding format, extract the string to a column called Base64, and decode it in a column called DecodedString.
Page 2 of 2