Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7 detections
Filters
Last updated
All Time
Detection languages
5
1
1
Contributors
5
1
1
Categories
4
4
3
1
1
Platforms
5
2
Products / Services
5
1
1
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
3
2
IDS Protocols
4
1
This rule detects TCP connections originating from the internal network ($HOME_NET) to any external destination on port 9150, specifically looking for the SYN flag in the TCP handshake. Port 9150 is commonly associated with Tor Browser's SOCKS proxy. The rule's message suggests it's intended to identify instances where Tor Browser is being used to access external resources, potentially bypassing organizational policies or security controls.
This rule detects HTTP connections to known paid intelligence databases. It specifically looks for hostnames containing 'silobreaker.com', 'sixgill.io', or 'cybersixgill' in HTTP traffic flowing from the home network to any destination. This could indicate an internal system or user accessing external threat intelligence platforms, which might be a normal operation for security teams but could also be an indicator of reconnaissance activity by an adversary.
This rule detects HTTP requests to known underground forums (nulled.to, hackforums.net, ogusers) via a clearnet proxy. It specifically looks for these hostnames in HTTP traffic.
This rule detects HTTP requests to domains associated with corporate intelligence subscription services such as Dun & Bradstreet (dun.com, dnb.com) and Hoovers (hoovers.com). It triggers an alert if a single source IP makes 10 or more such requests within a 60-second window, indicating potential reconnaissance activity.
This rule detects HTTP requests to known data broker websites such as Spokeo, Intelius, and BeenVerified. It triggers an alert if 10 or more such requests are observed from a single source IP within a 60-second window. This activity could indicate reconnaissance efforts to gather information about individuals.
The following analytic detects the usage of specific Exchange PowerShell modules, such as New-MailboxExportRequest, New-ManagementRoleAssignment, New-MailboxSearch, and Get-Recipient. It leverages PowerShell Script Block Logging (EventCode 4104) to identify these commands. This activity is significant because these modules can be exploited by adversaries who have gained access via ProxyShell or ProxyNotShell vulnerabilities. If confirmed malicious, attackers could export mailbox contents, assign management roles, conduct mailbox searches, or view recipient objects, potentially leading to data exfiltration, privilege escalation, or unauthorized access to sensitive information.
This query was originally published in the threat analytics report, ironSource PUA & unwanted apps impact millions.
IronSource provides software bundling tools for many popular legitimate apps, such as FileZilla. However, some of ironSource's bundling tools are considered PUA, because they exhibit potentially unwanted behavior. One component of these tools, detected by Microsoft as Prifou, silently transmits system information from the user. It also installs an outdated version of Chromium browser with various browser extensions, resets the user's home page, changes their search engine settings, and forces Chromium and itself to launch at startup.
The following query can be used to locate unique command-line strings used by ironSource bundlers to launch Prifou, as well as commands used by Prifou to install Chromium.
IronSource provides software bundling tools for many popular legitimate apps, such as FileZilla. However, some of ironSource's bundling tools are considered PUA, because they exhibit potentially unwanted behavior. One component of these tools, detected by Microsoft as Prifou, silently transmits system information from the user. It also installs an outdated version of Chromium browser with various browser extensions, resets the user's home page, changes their search engine settings, and forces Chromium and itself to launch at startup.
The following query can be used to locate unique command-line strings used by ironSource bundlers to launch Prifou, as well as commands used by Prifou to install Chromium.
