Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
34 detections
Filters
Last updated
All Time
Detection languages
18
5
5
5
1
Contributors
17
7
4
2
2
Categories
14
10
5
5
5
Platforms
16
11
9
7
3
Products / Services
13
8
7
6
5
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
3
2
IDS Protocols
3
1
1
Detects phishing attempts related to 'Operation DoppelBrand' campaign using common email service providers (ESPs) to spoof legitimate-looking emails with fraud-themed subjects, such as invoices or payment requests, associated with the Brickstorm malware.
Detects phishing attempts related to 'Operation DoppelBrand' campaign using common email service providers (ESPs) to spoof legitimate-looking emails with fraud-themed subjects, such as invoices or payment requests, associated with the Brickstorm malware.
Detects Certificate Transparency log entries indicating the issuance of Let's Encrypt certificates where the issuer identifies as 'YE1' and the domain subjects match specific brand impersonation tokens, often associated with fraudulent disposable top-level domains.
Detects Certificate Transparency log entries indicating the issuance of Let's Encrypt certificates where the issuer identifies as 'YE1' and the domain subjects match specific brand impersonation tokens, often associated with fraudulent disposable top-level domains.
Detects Certificate Transparency log entries indicating the issuance of Let's Encrypt certificates where the issuer identifies as 'YE1' and the domain subjects match specific brand impersonation tokens, often associated with fraudulent disposable top-level domains.
Detects network activity associated with the ROOTBOY actor, specifically identifying internal devices communicating with known malicious command and control (C2) IP addresses and subsequently attempting to access specific suspicious domains or URLs linked to the actor's infrastructure.
Detects use of free hosting services for staging malicious content
Detects network activity associated with the ROOTBOY actor, specifically identifying internal devices communicating with known malicious command and control (C2) IP addresses and subsequently attempting to access specific suspicious domains or URLs linked to the actor's infrastructure.
Detects wildcard TLS certificates on cheap TLDs commonly used for attack infrastructure
This rule detects suspicious access to domain registration services by monitoring HTTP traffic for requests to known domain registrars (namecheap.com, godaddy.com, porkbun.com) with a URI containing 'register'. A threshold of 5 such requests within 60 seconds from the same source IP triggers an alert, indicating potential resource development activity such as bulk domain registration.
This rule detects DNS queries for top-level domains (TLDs) commonly associated with bulletproof hosting services. Specifically, it looks for queries ending in .ru, .cn, .tk, .ml, .ga, .cf, or .gq. A threshold of 20 queries within 60 seconds from the same source IP will trigger an alert.
Detects when multiple distinct domains, where at least one is known malicious, share the same HTTP body SHA1 hash or favicon MD5 hash. This pattern is indicative of threat actor infrastructure reuse and templating, as described in analysis of campaigns like LaundryBear and FreeDrain.
KQL Query from file: MDO - Enhancing Email Security with NRD Filtering
Page 2 of 2