Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
3
2
1
Contributors
3
2
1
Categories
3
2
2
1
1
Platforms
2
2
2
Products / Services
2
2
1
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
IDS Classtypes
1
1
IDS Protocols
2
This rule monitors for suspicious activities involving digital certificates. It detects PowerShell processes attempting to import a certificate into the Root store, which could indicate persistence or credential interception, and it detects the use of curl to download files named 'cert.pem' with insecure SSL settings (no certificate verification).
Detects network activity associated with the SilkParasite C2 infrastructure (used by SpiceRAT and NodeEdgeRAT malware). The rule monitors for specific impersonated TLS certificates, known malicious IP addresses, and unique JA4X TLS fingerprints associated with these threat actors.
This rule detects the installation of a new self-signed TLS certificate that might be used by a Command and Control (C2) server. It specifically looks for TLS certificates where both the issuer and subject Common Name (CN) are at least 5 alphanumeric characters long and the 'not before' date is in the current or future years (2024-2029). This combination of characteristics can indicate a newly generated, potentially malicious self-signed certificate.
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.
Detects the import or deletion of key material in AWS KMS, which can be used as part of ransomware attacks. This activity is uncommon and provides a high certainty signal.
Detects the installation and configuration of PowerShell Web Access, which could be used for remote access and potential abuse. The rule specifically looks for PowerShell script block text containing commands related to installing the Windows feature, installing the PSWA web application, and adding authorization rules.