Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
4
2
1
Contributors
3
2
1
1
Categories
5
3
2
2
2
Platforms
3
2
2
Products / Services
3
2
2
1
1
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
This rule detects anomalous, high-volume activity in Jira, such as mass ticket viewing, searching, exporting, or attachment downloading, which is often characteristic of unauthorized data exfiltration or reconnaissance. The detection triggers when an account exceeds thresholds of 200 issue-related actions or 8 attachment downloads within a 7-day period.
Detects bulk export of Confluence wiki content
This rule detects a high volume of HTTP requests to the Confluence REST API endpoint '/rest/api/content'. This pattern of access could indicate an attempt to bulk download content from Confluence spaces, potentially for data exfiltration or reconnaissance purposes. The threshold is set to trigger if 30 such requests are observed from a single source IP within a 60-second window.
This rule detects a high volume of HTTP requests to a Confluence Wiki instance that include both '/wiki/' and 'export' in the URI. Specifically, it triggers if 10 such requests are observed from the same source IP within a 60-second window. This behavior could indicate an attempt to bulk export pages from a Confluence Wiki, potentially for data exfiltration.
This query was originally published in the threat analytics report, Motivated miners.
Doublepulsar is a backdoor developed by the National Security Agency (NSA). First disclosed in 2017, it is now used by many malicious actors. Software patches are available.
The following query detects activity broadly associated with campaigns that use DoublePulsar to exploit web servers.
See Detect DoublePulsar execution for a query that detects possible DoublePulsar execution events.
References:
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoublePulsar&threatId=-2147239036
https://www.scmagazine.com/home/security-news/cybercrime/doublepulsar-malware-spreading-rapidly-in-the-wild-following-shadow-brokers-dump/
https://support.microsoft.com/help/4013389/title
Doublepulsar is a backdoor developed by the National Security Agency (NSA). First disclosed in 2017, it is now used by many malicious actors. Software patches are available.
The following query detects activity broadly associated with campaigns that use DoublePulsar to exploit web servers.
See Detect DoublePulsar execution for a query that detects possible DoublePulsar execution events.
References:
https://www.microsoft.com/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/DoublePulsar&threatId=-2147239036
https://www.scmagazine.com/home/security-news/cybercrime/doublepulsar-malware-spreading-rapidly-in-the-wild-following-shadow-brokers-dump/
https://support.microsoft.com/help/4013389/title
This query was originally published in the threat analytics report, Confluence and WebLogic abuse.
2019 has seen several seemingly related campaigns targeting Atlassian Confluence Server and Oracle WebLogic Server. Although these campaigns use different implants and delivery methods, they consistently use the same infrastructure, and exploit the same vulnerabilities.
The campaigns have specifically targeted:
1. CVE-2019-3396 - Software update
2. CVE-2019-2725 - Software update
The following query detects activity broadly associated with these campaigns.
2019 has seen several seemingly related campaigns targeting Atlassian Confluence Server and Oracle WebLogic Server. Although these campaigns use different implants and delivery methods, they consistently use the same infrastructure, and exploit the same vulnerabilities.
The campaigns have specifically targeted:
1. CVE-2019-3396 - Software update
2. CVE-2019-2725 - Software update
The following query detects activity broadly associated with these campaigns.
This rule detects the GomorrahStealer infostealer by identifying specific bytecode patterns associated with its capabilities. These capabilities include extracting browser autofill data, browser cookies, taking screenshots, gathering antivirus information, and collecting browser history. The rule looks for the presence of all these distinct bytecode signatures within a file to confirm the presence of GomorrahStealer.
