Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,208 detections
Filters
Last updated
All Time
Detection languages
2,407
1,435
704
406
354
Contributors
1,092
1,080
584
392
348
Categories
2,143
1,818
1,759
1,290
889
Platforms
4,235
1,450
895
574
181
Products / Services
1,567
855
774
655
512
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects potentially suspicious child processes launched via the ScreenConnect client service.
This rule detects when a known 'benign' binary, as identified by the Google Cloud Threat Intelligence (GCTI) Feed, initiates an outbound network connection to an IP address identified as a Tor exit node, also from the GCTI Feed. The rule also increases the risk score if the Tor exit node is located in specific high-risk countries (Cuba, Iran, North Korea, Russia, Syria). This indicates potential malicious activity where an otherwise legitimate program might be compromised or used for covert communication.
Detects the creation of a process that includes environment variables for HTTP or HTTPS proxy settings in its command line. This can indicate an attempt to route network traffic through a proxy, potentially for command and control or to bypass network restrictions.
This rule detects HTTP web access to domains that exhibit low prevalence within the monitored environment. It specifically filters out internal RFC 1918 IP addresses and ensures that only valid Fully Qualified Domain Names (FQDNs) are considered. The prevalence is determined by a rolling maximum count of unique days a domain has been observed, with alerts triggering for domains seen 3 or fewer times. The risk score is incremented based on how low the prevalence is, with the lowest prevalence (1 day) resulting in the highest risk score.
This rule detects when a file is downloaded from an IP address and subsequently created on a system, where both the file hash and the IP address are identified by VirusTotal Relationships as being associated with each other, specifically through a 'DOWNLOADED_FROM' relationship. This indicates that the downloaded file is known to have been served from that particular IP address, potentially flagging malicious file distribution.
This rule detects when a known malicious file, identified by its SHA256 hash through VirusTotal relationships, attempts to contact a domain that VirusTotal also associates with that file. It correlates DNS query events with VirusTotal intelligence to identify suspicious network communications originating from potentially compromised systems.
This rule detects DNS queries to domains identified as Command and Control (C2) infrastructure within a Threat Intelligence (TI) feed, specifically MISP. It correlates DNS events with MISP data where the entity type is 'DOMAIN_NAME' and the threat summary indicates 'C2 domains'. The rule is designed to identify potential C2 communications from internal hosts.
This rule detects web traffic to a recently expired domain followed by the creation of an executable (.exe) file on the same host. It correlates network access events with WHOIS data to identify expired domains and then looks for subsequent file creation events where the file path ends with '.exe'. The file creation must occur after the network access event on the same principal hostname.
Find web Traffic going to port 53
This rule detects when a file, identified by its SHA256 hash, initiates a network connection to an IP address that is identified as a Tor exit node. The rule leverages VirusTotal relationships to link the file hash to the contacted IP address and Google Cloud Threat Intelligence (GCTI) Feed to identify Tor exit nodes. The risk score is increased if the Tor IP's geolocation is in certain countries (Cuba, Iran, North Korea, Russia, Syria).
Detects successful installation of Atera Remote Monitoring & Management (RMM) agent as recently found to be used by Conti operators
Detects the presence and execution of Inveigh via dropped artefacts
Detects the usage of tsclient share to place a backdoor on the RDP source machine's startup folder
Detects piping the password to an anydesk instance via CMD and the '--set-password' flag.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.
An adversary may use legitimate desktop support and remote access software,to establish an interactive command and control channel to target systems within networks
Detects the execution of the Ammyy Admin RMM agent for remote management, specifically when rundll32.exe is used to load and execute the aa_nts.dll component.
Detects an initiated network connection by a non-browser process on the system to "azurewebsites.net". This domain has been frequently used by threat actors for malware hosting and data exfiltration. The rule filters out connections made by common web browsers and other legitimate applications to reduce false positives.
Detects potential Amazon SSM agent hijack attempts as outlined in the Mitiga research report.
Page 273 of 296