Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
34 detections
Filters
Last updated
All Time
Detection languages
27
7
Contributors
15
10
3
3
1
Categories
22
18
17
10
8
Platforms
26
4
1
1
1
Products / Services
26
24
4
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
14
7
4
2
IDS Protocols
13
6
4
2
2
This rule detects network traffic (DNS, TLS, HTTP, and TCP) originating from internal assets to known infrastructure associated with the QTFY proxy botnet/C2 framework. It identifies communication with specific C2 domains, proxy management systems, and associated malicious IP ranges.
Detects high-volume, potentially malicious activity where a client requests a large number of distinct hostnames ending in .shop from a single destination IP address within a short time frame, which may indicate infrastructure used for phishing or fraudulent e-commerce storefronts similar to DoppelCart-style activity.
Detects high-volume, potentially malicious activity where a client requests a large number of distinct hostnames ending in .shop from a single destination IP address within a short time frame, which may indicate infrastructure used for phishing or fraudulent e-commerce storefronts similar to DoppelCart-style activity.
BlueNoroff ClickFix - Traffic to Known-Malicious Watchlist IP
This rule detects the creation of Azure DNS zones by callers who have no prior history of writing to DNS zones within a specified lookback period. This behavior can indicate an attempt at DNS zone takeover, as observed in campaigns like 'Borrowed Trust' or 'link99', where adversaries might create orphaned DNS zones to redirect traffic or host malicious content.
Offshore VPS Provider API Access
Suricata
This rule detects HTTP traffic to specific domains associated with offshore VPS providers (frantech.ca, serverius.net, combahton.net). This could indicate API access or other interactions with these services, which might be suspicious depending on the environment.
This rule detects HTTP network connections to common Cloud Virtual Private Server (VPS) providers (DigitalOcean, Vultr, Linode, Hetzner) where the URI content includes the word 'create'. This combination suggests an attempt to set up new infrastructure, potentially for malicious purposes, aligning with resource development tactics.
Detects IP geolocation lookups used to determine system geographic location
This is a classic Adversary-in-the-Middle (AiTM) pattern. By proxying the authentication process in real-time, the FlowerStorm-like actors are bypassing standard MFA by intercepting the session token.
The query is a triple-threat hunting as it looks for the delivery (the domain), the access (the ASNs), and the persistence/evasion (the "LinkedIn" rule) all at once.
The query is a triple-threat hunting as it looks for the delivery (the domain), the access (the ASNs), and the persistence/evasion (the "LinkedIn" rule) all at once.
KQL Query from file: Azure Cloud Security Monitoring
KQL Query from file: Azure Cloud Security Monitoring
KQL Query from file: Detecting Copilot Studio Bot Creation
'Looks for file uploads actions to Azure File and Blob Storage from known VPS provider network ranges.
This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent providers observed.'
This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent providers observed.'
Page 2 of 2