Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
640 detections
Filters
Last updated
All Time
Detection languages
302
82
80
57
53
Contributors
139
126
122
26
24
Categories
510
318
124
86
79
Platforms
309
155
127
112
91
Products / Services
164
119
84
80
76
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
8
2
1
1
1
IDS Classtypes
44
25
6
5
1
IDS Protocols
60
12
5
1
The analytic detects the execution of the 'gdrive' tool on a Windows host. This tool allows standard users to perform tasks associated with Google Drive via the command line, such as downloading, uploading, listing, updating, syncing, sharing, and managing accounts or files. Adversaries commonly use this tool to stage other tools or exfiltrate data. Detection leverages Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. If confirmed malicious, this activity could lead to system compromise or sensitive data theft.
Detects the use of the 'mdimport' command to index sensitive user directories. This is a key step in the Sploitlight TCC bypass technique (CVE-2025-31199), where a malicious Spotlight importer is triggered to run within the 'mdworker' process and exfiltrate data from TCC-protected locations by writing it to the system log.
Detects network connections to BTunnels domains initiated by a process on the system.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects an executable initiating a network connection to "ngrok" domains. Attackers were seen using this "ngrok" in order to store their second stage payloads and malware. While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse this feature to establish a reverse shell, persistence, or exfiltrate data from a compromised machine.
Detects network connections to Cloudflared tunnels domains initiated by a process on the system. Attackers can abuse this feature to establish a reverse shell or persistence on a machine.
Detects when a non-browser process initiates network communication with the Telegram API. This activity is suspicious as it could indicate the use of Telegram for covert command and control (C2) or data exfiltration by malware, bypassing typical browser-based interactions.
Ngrok is a legitimate tool that creates secure tunnels to localhost servers through NAT/firewalls, often used by developers.
Additionally, Ngrok tunnels have been used by Iranian APT groups, among others, to support their operations particularly for Command and Control (C2), data exfiltration, and initial access staging.
Additionally, Ngrok tunnels have been used by Iranian APT groups, among others, to support their operations particularly for Command and Control (C2), data exfiltration, and initial access staging.
Detects an executable initiating a network connection to "ngrok" domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects network connections to Cloudflared tunnels domains initiated by a process on the system.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
Detects an a non-browser process interacting with the Telegram API which could indicate use of a covert C2
KQL Query
Detects network communication patterns associated with the SparkKitty mobile spyware, which exfiltrates sensitive data, including images, by connecting to known command and control servers or using specific API endpoints.
KQL Query
KQL Query
KQL Query
KQL Query from file: M365 Copilot Plugins Inventory Analysis
KQL Query from file: MS Teams DLP Playbook
KQL Query from file: The Hunt for Top 10 Self Hosted AI
KQL Query from file: Technique profile eDiscovery misuse detection
Page 28 of 31