Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
51 detections
Filters
Last updated
All Time
Detection languages
29
15
2
2
2
Contributors
24
6
6
5
4
Categories
19
13
12
12
10
Platforms
17
15
12
8
5
Products / Services
15
15
11
7
7
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
10
3
2
IDS Protocols
13
1
1
This query will hunt for files matching the current abuse.ch recent threat feed based on Sha256. Currently the query is set up to analyze the last day worth of events, but this is configurable using the MaxAge variable.
This query visualises total emails with Malware detections over time summarizing the data daily by various Malware detection technologies/controls.
This query visualises total inbound emails with Malware detections summarizing the data by the top email sender P2 domain (SenderFromDomain)
The following query can locate activity possibly associated with the EUROPIUM threat actor
This query helps reviewing external top malicious email sender with malware or phishing emails in an organization in last 30 days
In this query, we are looking for emails containing malware attachment sent by an internal sender
This query helps reviewing malware detections by detection methods
This analytic detects previously unseen processes within the Kubernetes environment on master or worker nodes. It leverages process metrics collected via an OTEL collector and hostmetrics receiver, with data pulled from Splunk Observability Cloud. The detection compares processes observed in the last hour against those seen in the previous 30 days. Identifying new processes is crucial as they may indicate unauthorized activity or attempts to compromise the node. If confirmed malicious, these processes could lead to data exfiltration, privilege escalation, denial-of-service attacks, or the introduction of malware, posing significant risks to the Kubernetes cluster.
The following analytic detects emails in Gsuite containing links to known abuse web services such as Pastebin, Telegram, and Discord. It leverages Gsuite Gmail logs to identify emails with these specific domains in their links. This activity is significant because these services are commonly used by attackers to deliver malicious payloads. If confirmed malicious, this could lead to the delivery of malware, phishing attacks, or other harmful activities, potentially compromising sensitive information or systems within the organization.
Page 3 of 3