Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
486 detections
Filters
Last updated
All Time
Detection languages
142
130
119
29
22
Contributors
84
68
57
54
30
Categories
179
153
150
107
91
Platforms
263
161
69
33
10
Products / Services
130
120
72
70
54
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
6
5
4
2
2
IDS Classtypes
66
37
14
9
4
IDS Protocols
37
30
27
14
9
Detects the execution of Cloudflared with command-line arguments associated with creating a persistent tunnel or installing it as a service. This technique is used by the Kraken ransomware group for persistence and command and control.
Detects the use of PuTTY Link (plink.exe) with command-line arguments indicative of SSH tunneling, executed from a suspicious file path. This technique is used by the xHunt APT group for lateral movement and to create covert communication channels.
ET INFO Observed VNT VPN Domain (vnt .wherewego .top in TLS SNI)
ET INFO Observed VNT VPN Domain (vnt .8443 .eu .org in TLS SNI)
ET INFO VNT VPN Domain in DNS Lookup (vnt .wherewego .top)
ET INFO VNT VPN Domain in DNS Lookup (vnt .8443 .eu .org)
Detects potential BRICKSTORM C2 activity. This rule identifies processes initiating a WebSocket connection over HTTPS, which is a technique used by BRICKSTORM for its command and control channel. The rule filters for processes that lack file metadata, a common characteristic of Go-based malware like BRICKSTORM.
This detection identifies potential abuse of SSH ProxyCommand by monitoring for suspicious process execution patterns. Specifically, it looks for instances where ssh.exe (as a parent process) containing "ProxyCommand" in its arguments spawns potentially malicious child processes like mshta, powershell, wscript, or cscript, or processes containing "http" in their command line. This technique can be used by attackers to execute arbitrary commands through SSH proxy configurations, potentially enabling command & control activities or remote code execution. The detection focuses on commonly abused Windows scripting engines and web requests that may indicate malicious activity when spawned through SSH proxy commands.
Detects potential BRICKSTORM C2 activity. This rule identifies processes initiating a WebSocket connection over HTTPS, which is a technique used by BRICKSTORM for its command and control channel. The rule filters for processes that lack file metadata, a common characteristic of Go-based malware like BRICKSTORM.
This analytic detects the use of `curl.exe` with insecure flags such as `-k`, `--insecure`, `--proxy-insecure`, or `--doh-insecure` which disable TLS certificate validation. It leverages Cisco Network Visibility Module (NVM) flow data and process arguments to identify outbound connections initiated by curl where TLS checks were explicitly disabled. This behavior may indicate an attempt to bypass certificate validation to connect to potentially untrusted or malicious endpoints, a common tactic in red team operations, malware staging, or data exfiltration over HTTPS.
Time to live (TTL) values in DNS responses provide valuable threat-hunting insights, including:
- Fast-flux botnets (rotating IPs with low TTLs).
- Malware C2 detection (extremely low TTLs). ( | where TTLs < 10 )
- DNS tunneling (high TTLs or changing TTLs). ( | where TTLs > 86400 )
- Fake domains mimicking real services (TTL anomalies).
- Evasive infrastructure constantly changing TTL values.
You can use the following KQL Query to search for the mentioned cases.
- Fast-flux botnets (rotating IPs with low TTLs).
- Malware C2 detection (extremely low TTLs). ( | where TTLs < 10 )
- DNS tunneling (high TTLs or changing TTLs). ( | where TTLs > 86400 )
- Fake domains mimicking real services (TTL anomalies).
- Evasive infrastructure constantly changing TTL values.
You can use the following KQL Query to search for the mentioned cases.
Detects scenarios where an attacker configure port forwarding on a host to redirect traffic to a C&C target.
Detects scenarios where an attacker uses RDP tunneling to redirect traffic to a C&C target.
Detects scenarios where an attacker uses RDP tunneling to redirect traffic to a C&C target.
Detects the use of the Visual Studio Code (VSCode) command-line interface to create a tunnel. This technique was observed in the TAOTH campaign for post-exploitation persistence and command and control.
This rule detects the creation of a process using 'ssh.exe' with command-line arguments indicative of remote port forwarding. Specifically, it looks for the '-R' flag, which is used to specify remote port forwarding in SSH. This activity can be used by adversaries for command and control or lateral movement by tunneling network communications.
This KQL query detects network traffic to or from suspicious ports by joining firewall logs (CommonSecurityLog) with an external, regularly updated list of known suspicious ports. It specifically looks for accepted or passed connections to these ports, indicating potential exploitation attempts or unauthorized communication channels used by threat actors.
Detects the creation of the 'socks' binary used by the Odyssey Stealer to establish a SOCKS5 proxy for network tunneling on compromised macOS systems. This rule identifies the binary based on specific SHA256 hashes and its filename 'socks'.
Detects port forwarding activity via SSH.exe
No description available.
Detects DNS query requests to Devtunnels domains. Attackers can abuse that feature to establish a reverse shell or persistence on a machine. Devtunnels can be used for command and control or data exfiltration by tunneling traffic over legitimate-looking DNS requests.
Page 18 of 24