Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
223 detections
Filters
Last updated
All Time
Detection languages
105
45
18
16
11
Contributors
55
48
19
17
11
Categories
85
79
49
42
38
Platforms
95
83
25
24
20
Products / Services
62
28
27
21
18
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
5
5
5
5
IDS Classtypes
11
4
1
IDS Protocols
6
5
3
2
Detects when an Amazon Simple Email Service (SES) configuration is modified, which could indicate an attacker attempting to propagate phishing email campaigns. This includes the creation, deletion, or verification of email identities and domains, as well as enabling sending for accounts or configuration sets.
Detect when the Amazon Simple Email Service (SES) has been modified where an attacker can modify Amazon SES service to propagate phishing emails campaigns.
Amazon GuardDuty detects CryptoCurrency activity in Amazon EC2, AWS Lambda or Amazon EKS Runtimes.
Detects suspicious DNS queries to known Monero mining pools, indicating potential cryptocurrency mining activity on the network. This rule identifies specific domain names associated with various Monero mining operations.
Detects suspicious DNS queries to Monero mining pools
This rule identifies DNS queries made to domains associated with known cryptocurrency mining pools. It specifically looks for DNS queries where the 'query' field ends with any of the listed mining pool domains. The rule excludes queries with answers '127.0.0.1' or '0.0.0.0' and those marked as rejected, to reduce false positives. The primary goal is to detect potential resource hijacking through cryptomining on compromised systems.
Detects outbound network connections to known cryptocurrency mining pool domains. This activity is often indicative of resource hijacking (cryptojacking) where an attacker uses a compromised system's resources to mine cryptocurrency without the owner's consent. The rule specifically targets a comprehensive list of domains associated with various mining pools, primarily for Monero (XMR) and other cryptocurrencies.
This rule detects command-line parameters and strings commonly associated with cryptocurrency mining software, specifically targeting Monero miners like XMRig. It looks for specific arguments such as CPU priority settings, donation levels, pool addresses (e.g., 'pool.', 'stratum+tcp://', 'stratum+udp://'), algorithm specifications ('--algo=rx/0'), and base64 encoded versions of these strings. It also includes a specific command for loading the 'msr' kernel module, which can be used by miners to optimize performance.
This rule detects the execution of commands or processes that contain specific command-line arguments or strings commonly associated with cryptocurrency mining activities. It looks for parameters such as CPU priority settings, donation levels (often set to zero by malicious miners), pool server addresses (e.g., 'pool.', 'stratum+tcp://', 'stratum+udp://'), and specific mining algorithms like 'rx/0'. The rule also includes base64 encoded versions of some of these strings to evade simple detection. It filters out common false positives like 'pool.c', 'pool.o', and 'gcc -' which might appear in legitimate compilation processes.
This rule detects outbound network connections from a Linux system to known Monero crypto mining pools. The detection is based on a predefined list of destination hostnames associated with various Monero mining operations. This activity is indicative of resource hijacking, where a system's computational resources are illicitly used for cryptocurrency mining.
Detects command line parameters or strings often used by crypto miners
Detects process connections to a Monero crypto mining pool
Detects command line parameters or strings often used by crypto miners
Page 11 of 11