Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
89 detections
Filters
Last updated
All Time
Detection languages
48
10
7
6
5
Contributors
24
20
12
6
4
Categories
24
21
20
18
17
Platforms
46
27
17
17
7
Products / Services
24
10
10
7
6
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
1
1
IDS Classtypes
5
3
1
1
IDS Protocols
4
3
2
1
Detects the execution of multiple distinct host reconnaissance commands (e.g., systeminfo, whoami, ipconfig, AV/EDR checks, and domain enumeration) within a short window (10 minutes) originating from the same parent process. This pattern is characteristic of automated reconnaissance collection, often performed during the initial phases of an attack or as part of a C2 workflow. The rule includes exclusions for common administrative, monitoring, and RMM tools to reduce false positives.
Detects the execution of multiple distinct host reconnaissance commands (e.g., systeminfo, whoami, ipconfig, AV/EDR checks, and domain enumeration) within a short window (10 minutes) originating from the same parent process. This pattern is characteristic of automated reconnaissance collection, often performed during the initial phases of an attack or as part of a C2 workflow. The rule includes exclusions for common administrative, monitoring, and RMM tools to reduce false positives.
Detects Node.js processes executing system-level reconnaissance (e.g., CPU, memory, hostname, uptime enumeration) followed by network connections to known exfiltration endpoints (Slack, Telegram API). This behavior aligns with identified npm malware campaigns using host fingerprinting for target selection and data exfiltration.
Detects a suspicious pattern where a user browser visits a Google Document and subsequently initiates a connection to the Telegram Bot API within a short timeframe (10 minutes). This sequence is indicative of malicious Google Apps Scripts embedded in documents attempting to exfiltrate victim information (IP, geolocation, device details) as part of a reconnaissance phase before a ClickFix-style payload delivery.
Detects anomalous Microsoft Graph API activity characterized by user enumeration or querying for sensitive organizational groups (e.g., payroll, finance, HR) often associated with post-AiTM account-takeover reconnaissance. This detection specifically identifies multiple requests for sensitive URIs or high-count enumeration requests originating from suspicious User-Agent strings like 'axios/1.18.1', commonly observed in threat actor activity such as Storm-2755.
Detects instances where a Node.js process spawns another Node.js process as a child. This behavior is often associated with malicious npm packages attempting to evade detection during runtime execution or executing secondary malicious payloads.
Detects anomalous SharePoint search activity that uses 'indexdocid' queries targeting specific site or web content classes. This pattern is often indicative of automated reconnaissance or enumeration of documents within a SharePoint environment, potentially attempting to bypass standard UI navigation to identify or access sensitive content.
Detects network traffic associated with the 'ClickFix' technique, where malicious websites masquerade as legitimate CAPTCHA or bot-protection services to exfiltrate visitor telemetry via POST requests or fetch malicious script overlays.
Detects HTTP POST requests to a /collect endpoint containing visitorId and stage parameters, which is characteristic of ClickFix-style fake bot-protection overlays used to trick users into executing malicious scripts under the guise of security verification.
This rule detects outgoing HTTP POST requests to the 'velvet-otter-glagceis.life' domain path '/collect'. The request body contains indicators of victim fingerprinting, specifically looking for 'visitorId' and 'events' fields, characteristic of the Macfinger/ClickFix campaign used for gathering visitor telemetry for malicious purposes.
Detects adversarial conversational reconnaissance patterns where a user queries an AI agent to enumerate its capabilities, such as available plugins, functions, or parameter schemas. The disclosure of this internal information by the agent facilitates the construction of targeted prompt-injection payloads, a known precursor to exploitation of AI agent vulnerabilities.
Detects network activity associated with Adversary-in-the-Middle (AiTM) phishing kits. This includes detection of kit-specific fingerprinting scripts (class_identifier.php), use of specific server banners (openresty), unauthenticated geolocation lookups (api.country.is), setting of geolocation cookies, and proxying of requests to Microsoft OAuth endpoints.
This rule detects suspicious PowerShell activity involving the enumeration and manipulation of COM objects and .NET assemblies, patterns often associated with reconnaissance or post-exploitation activities. It flags instances where PowerShell scripts utilize specific command-line arguments (e.g., Get-ComDatabase, Get-ComClass, Import-Win32Module, NtObjectManager) in conjunction, suggesting automated discovery of COM infrastructure or assembly loading.
Detects the presence of a specific Russian-language error string ("Не удалось сгенерировать HWID") within binary files, which is characteristic of the HWID generation mechanism used by Vidar Stealer malware.
This rule detects suspicious UDP traffic directed at port 8800 targeting the Dahua P2P cloud relay interface. It specifically monitors for enumeration attempts against device serial numbers, which may be a precursor to unauthorized access or reconnaissance against vulnerable Dahua devices.
Detects high-frequency, diverse Microsoft Graph API requests initiated by an identity, indicative of automated reconnaissance or enumeration of the cloud environment. The rule tracks requests across multiple categories such as organization settings, user/group identities, privilege information, application configurations, and resource access within a 30-minute window.
This rule detects instances of VS Code, code-server, or associated Node.js processes executing 'git config --get user.email'. This behavior is characteristic of malicious VS Code extensions (specifically 'evil-twin' extensions) attempting to perform developer reconnaissance by harvesting local Git identity information, which can then be exfiltrated.
KQL Query
This query is a comprehensive set of KQL (Kusto Query Language) scripts designed for threat hunting in Windows DNS environments. It leverages data from ASimDnsActivityLogs and SecurityEvent to detect various suspicious activities and potential security threats related to DNS operations.
This query is a comprehensive set of KQL (Kusto Query Language) scripts designed for threat hunting in Windows DNS environments. It leverages data from ASimDnsActivityLogs and SecurityEvent to detect various suspicious activities and potential security threats related to DNS operations.
Detects OS fingerprinting commands executed as child processes of a process that is actively listening on a network port, consistent with DOGLEASH.
Page 2 of 5