Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
486 detections
Filters
Last updated
All Time
Detection languages
142
130
119
29
22
Contributors
84
68
57
54
30
Categories
179
153
150
107
91
Platforms
263
161
69
33
10
Products / Services
130
120
72
70
54
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
6
5
4
2
2
IDS Classtypes
66
37
14
9
4
IDS Protocols
37
30
27
14
9
KQL Query
KQL Query from file: DPRK (Famous Chollima) use of Astrill VPN
KQL Query from file: Sentinel - Threat Hunting DNS Tunneling
KQL Query from file: DefenderXDR - Threat Hunting DNS Tunneling
KQL Query
KQL Query from file: Detecting Twill Typhoon VSCode Exploit
KQL Query from file: Check for Azure Outdated Security Protocols
KQL Query from file: Hunting Zloader DNS Tunneling
KQL Query from file: BlueAlpha GammaDrop Detection
KQL Query from file: Hunting Aqua Blizzards
This rule detects changes to the Windows Registry key that controls the Remote Desktop Protocol (RDP) port number. Specifically, it triggers when the RDP port is modified from its default value of 3389 to any other port. This activity can be indicative of an adversary attempting to evade detection, bypass network filtering, or maintain persistence by configuring RDP to listen on a non-standard port.
Detects an executable initiating a network connection to "ngrok" tunneling domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Detects port forwarding activity via SSH.exe
Detects the use of Ngrok, a utility used for port forwarding and tunneling, often used by threat actors to make local protected services publicly available.
Involved domains are bin.equinox.io for download and *.ngrok.io for connections.
Involved domains are bin.equinox.io for download and *.ngrok.io for connections.
Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443
Execution of plink to perform data exfiltration and tunneling
Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
Detects Silence EmpireDNSAgent as described in the Group-IP report
Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.
Detects suspicious Plink tunnel port forwarding to a local port
Page 20 of 24