Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
75 detections
Filters
Last updated
All Time
Detection languages
31
24
6
5
5
Contributors
20
10
9
7
6
Categories
40
29
27
25
10
Platforms
40
30
7
6
2
Products / Services
30
27
16
6
4
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
16
15
IDS Protocols
19
5
3
2
1
Detects instances of the openssl command-line tool being used to encrypt data with AES-256-CBC and RSA OAEP padding. This specific sequence matches the credential encryption pattern observed in the Linux/macOS payload of the malicious telnyx PyPI package attributed to TeamPCP.
This detection identifies network requests matching a URL pattern used by the Coruna iOS exploit kit to deliver encrypted binary payloads. The framework generates resource URLs using a 40-character hash and serves them as files ending in ".min.js".
This rule detects files associated with Dohdoor activity. It uses two primary detection methods: matching known SHA256 file hashes and identifying distinctive text markers. The text markers include strings related to DoH request construction (e.g., 'insomnia/11.3.0', 'Accept: applications/dns-json'), staging path patterns (e.g., '/111111?sub=s'), DLLs and LOLBins used for disguise (e.g., 'propsys.dll', 'Fondue.exe'), and obfuscated infrastructure patterns (e.g., 'MswInSofTUpDloAd', '.DeSigN'). A hash match indicates a strong lead, while text marker matches suggest potential activity requiring further investigation.
Detects outbound network connections to a specific .onion domain associated with the 'Tsunami Payload' component of the 'Contagious Interview' campaign, which uses the Tor network for command and control (C2) communications.
Detects network communication patterns associated with the LANDFALL Android spyware C2 servers. This includes connections to known malicious domains/IPs and specific HTTP POST requests used for beaconing.
Detects network connections to known Command and Control (C2) servers associated with the LANDFALL Android spyware. The spyware communicates over HTTPS, often on non-standard ports.
Detects various activities associated with the UTA0388 threat actor and their GOVERSHELL malware family. This includes network connections to known C2 infrastructure, creation of persistence via scheduled tasks, and execution of the malware payload, often involving DLL side-loading. The detection logic covers network communication with known C2 domains and IPs, creation of scheduled tasks with specific names, execution of the malware from common staging directories with specific flags, and the dropping of GOVERSHELL DLLs or files with known hashes.
In this case, I have been researching about the 'curve' value into AdditionalFields field of DeviceNetworkEvents table which I identified into iana.org as two groups 'Elliptic curve' and 'Diffie-Hellman groups'.
These 2 kinds of encryption groups work to secure communication over an insecure channel, are classified by Internet Assigned Numbers Authority (IANA), as if are 'recommended' and the Datagram Transport Layer Security status. In addition, to take into account, the mentioned site mention: "If an item is not marked as 'Recommended', it does not necessarily mean that it is flawed; rather, it indicates that the item either has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases"
Therefore, this KQL Query is oriented to identify if the current encryption to secure your communications is enough or if due to the level of sensitive of your information, would need to be reviewed.
These 2 kinds of encryption groups work to secure communication over an insecure channel, are classified by Internet Assigned Numbers Authority (IANA), as if are 'recommended' and the Datagram Transport Layer Security status. In addition, to take into account, the mentioned site mention: "If an item is not marked as 'Recommended', it does not necessarily mean that it is flawed; rather, it indicates that the item either has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases"
Therefore, this KQL Query is oriented to identify if the current encryption to secure your communications is enough or if due to the level of sensitive of your information, would need to be reviewed.
This query checks for network connection failures to Microsoft Defender for Endpoint URLs.
The output includes any device with 1+ connectivity failures, a list of the domains they
failed to connect to (including the number of failures), as well as the overall number of
failures in the time period. Results are sorted by the total number of connection failures
by the device.
The output includes any device with 1+ connectivity failures, a list of the domains they
failed to connect to (including the number of failures), as well as the overall number of
failures in the time period. Results are sorted by the total number of connection failures
by the device.
This analytic detects the use of known suspicious SSL certificates by comparing the SHA1 fingerprint from Cisco Secure Firewall logs against a blacklist. This is crucial for identifying malware distribution, C2 infrastructure, or phishing campaigns that reuse or self-sign certificates. Detection of such activity may indicate beaconing, malware download, or data exfiltration over TLS/SSL.
This analytic detects network connections flagged by Cisco Secure Firewall's Encrypted Visibility Engine (EVE) with a high threat confidence score (80% or greater). This indicates that the encrypted traffic is highly likely to be malicious, potentially associated with malware command and control (C2), remote access tools, or suspicious tunneling behavior. Such activity could signify covert communication from compromised hosts.
This rule detects PowerShell script blocks that utilize .NET's SslStream for establishing encrypted network connections. Specifically, it looks for the use of 'System.Net.Security.SslStream', 'Net.Security.RemoteCertificateValidationCallback', and '.AuthenticateAsClient' which are indicative of a client-side SSL/TLS connection being programmatically established, potentially for command and control (C2) purposes to evade detection.
Page 4 of 4