Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
23 detections
Filters
Last updated
All Time
Detection languages
15
5
2
1
Contributors
7
4
3
2
2
Categories
10
9
8
7
3
Platforms
16
4
1
1
1
Products / Services
15
11
4
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
7
5
3
IDS Protocols
11
2
2
KQL Query from file: Exposure Management - Slim's Metric (MaxCVSS-DAW)
The following analytic detects the presence of punycode within x509 certificates using Zeek x509 logs. It identifies punycode in the subject alternative name email and other fields by searching for the "xn--" prefix. This activity is significant as punycode can be used in phishing attacks or to bypass domain filters, posing a security risk. If confirmed malicious, attackers could use these certificates to impersonate legitimate domains, potentially leading to unauthorized access or data breaches.
Page 2 of 2