Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
486 detections
Filters
Last updated
All Time
Detection languages
142
130
119
29
22
Contributors
84
68
57
54
30
Categories
179
153
150
107
91
Platforms
263
161
69
33
10
Products / Services
130
120
72
70
54
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
6
5
4
2
2
IDS Classtypes
66
37
14
9
4
IDS Protocols
37
30
27
14
9
The following analytic identifies network traffic where the higher layer protocol does not match the expected port, such as non-HTTP traffic on TCP port 80. It leverages data from network traffic inspection technologies like Bro or Palo Alto Networks firewalls. This activity is significant because it may indicate attempts to bypass firewall restrictions or conceal malicious communications. If confirmed malicious, this behavior could allow attackers to evade detection, maintain persistence, or exfiltrate data through commonly allowed ports, posing a significant threat to network security.
This rule detects network connections initiated by an executable to sub-domains associated with the "LocaltoNet" tunneling service. LocaltoNet is a reverse proxy that exposes localhost services to the internet. Adversaries have been observed leveraging this service for command-and-control (C2) activities, often to bypass multi-factor authentication (MFA) and perimeter security controls.
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet. Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
LocaltoNet is a reverse proxy that enables localhost services to be exposed to the Internet.
Attackers have been seen to use this service for command-and-control activities to bypass MFA and perimeter controls.
The analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes. It leverages network traffic data to detect large ICMP packets that aren't blocked and are directed toward external networks. This can indicate information smuggling, covert communication, or command-and-control (C2) activities, potentially signaling ICMP tunneling, unauthorized data transfer, or compromised endpoints.
The following analytic identifies potential DNS data exfiltration using a pre-trained deep learning model. It leverages DNS request data from the Network Resolution datamodel and computes features from past events between the same source and domain. The model generates a probability score (pred_is_exfiltration_proba) indicating the likelihood of data exfiltration. This activity is significant as DNS tunneling can be used by attackers to covertly exfiltrate sensitive data. If confirmed malicious, this could lead to unauthorized data access and potential data breaches, compromising the organization's security posture.
This analytic detects the use of Plink (including renamed versions like pvhost.exe) for protocol tunneling, which may be used for egress or lateral movement within an organization. It identifies specific command-line options (-R, -L, -D, -l, -N, -P, -pw) commonly used for port forwarding and tunneling by analyzing process execution logs from Endpoint Detection and Response (EDR) agents. This activity is significant as it may indicate an attempt to bypass network security controls or establish unauthorized connections. If confirmed malicious, this could allow an attacker to exfiltrate data, move laterally across the network, or maintain persistent access, posing a severe threat to the organization's security. The detection covers both the original Plink executable and potential renamed versions, enhancing its ability to catch evasion attempts.
The analytic detects the use of Ngrok on a Linux operating system by monitoring process names and command-line arguments. Ngrok is a legitimate reverse proxy tool that can be used by adversaries to establish reverse proxies, potentially bypassing network defenses. If confirmed malicious, this could allow attackers to create persistent, unauthorized access channels, facilitating data exfiltration or further exploitation of the compromised system.
This analytic detects DNS queries to common Ngrok domains, indicating potential use of the Ngrok reverse proxy tool. It leverages the Network Resolution datamodel to identify queries to domains such as "*.ngrok.com" and "*.ngrok.io". While Ngrok usage is not inherently malicious, it has been increasingly adopted by adversaries for covert communication and data exfiltration. If confirmed malicious, this activity could allow attackers to bypass network defenses, establish persistent connections, and exfiltrate sensitive data, posing a significant threat to the network's security.
The following analytic detects the execution of ngrok.exe on a Windows operating system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because while ngrok is a legitimate tool for creating secure tunnels, it is increasingly used by adversaries to bypass network defenses and establish reverse proxies. If confirmed malicious, this could allow attackers to exfiltrate data, maintain persistence, or facilitate further attacks by tunneling traffic through the compromised system.
Detects potentially suspicious execution of the Qemu utility in a Windows environment. Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky. The rule specifically looks for Qemu command-line arguments indicative of network tunneling or proxying, such as low memory allocation ('-m 1M', '-m 2M', '-m 3M'), network device configuration ('-netdev', 'connect='), and running without a graphical interface ('-nographic'), while filtering out common legitimate use cases like CD-ROM or virtual block device usage.
Detects potentially suspicious execution of the Qemu utility in a Windows environment.
Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.
Threat actors have leveraged this utility and this technique for achieving network access as reported by Kaspersky.
Detects the execution of 'npc.exe', the client component of NPS (a port forwarding and intranet penetration proxy server). Detection is based on the executable name, specific command-line arguments indicative of server connection and authentication, or known hashes of the 'npc.exe' client.
Detects the execution of the "cloudflared" tool with command-line arguments indicative of establishing or running a tunnel. This activity has been observed in post-compromise scenarios by threat actors, such as the Akira ransomware group, to maintain persistence and remote access to compromised networks by creating covert communication channels.
Detects the execution of the Cloudflared Quick Tunnel utility, which can be used by adversaries to establish tunnels for various services like HTTP, RDP, SSH, and SMB. This tool has been observed in use by threat groups, including Akira ransomware, to create ad-hoc tunnels that generate random subdomains on trycloudflare.com.
Detects the execution of the "cloudflared" tool with the "tunnel cleanup" command. This command is used to remove Cloudflare Tunnel connections, which could be an indicator of an adversary attempting to remove traces of their C2 infrastructure or clean up after an operation. The rule looks for specific command-line arguments including 'tunnel', 'cleanup', and either '-config' or '-connector-id'.
Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.
Detects execution of the "cloudflared" tool to connect back to a tunnel. This was seen used by threat actors to maintain persistence and remote access to compromised networks.
This rule detects the creation of a file named "code_tunnel.json". This file is associated with the execution and usage of the Visual Studio Code (VSCode) tunneling utility. Adversaries can abuse this functionality to establish a command and control (C2) channel, allowing them to remotely control compromised systems.
Detects the creation of a file named "code_tunnel.json" when the creating process is not a legitimate Visual Studio Code executable. This indicates potential execution and usage of the VsCode tunneling utility by an unauthorized or renamed process, which could be used for command and control.
Page 22 of 24