Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,208 detections
Filters
Last updated
All Time
Detection languages
2,407
1,435
704
406
354
Contributors
1,092
1,080
584
392
348
Categories
2,143
1,818
1,759
1,290
889
Platforms
4,235
1,450
895
574
181
Products / Services
1,567
855
774
655
512
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant known for stealing sensitive information. In enterprise environments, such DNS queries may indicate potential malicious activity or compromise.
Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.
Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents
IOC IP Target
YARA-L
Detect network events that indicate communication to a watchlisted IP address
Detect network connection to an ip address that was only seen for the first time in the past 24 hours
Alert on known Hash querying a known hostname with VT Relationships
Detects execution of the Notepad++ updater (gup) from a process other than Notepad++ to download files
Detects the use of Windows Defender MpCmdRun.EXE to download files
Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation
PUA - Nimgrab Execution
YARA-L
Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.
Detects a suspicious curl process start on Windows and outputs the requested document to a local file
Detects a suspicious call to Invoke-WebRequest cmdlet where the and output is located in a suspicious location
Detects port forwarding being enabled using netsh command and registry settings created or modified in support of portproxy v4tov4
GCTI Remote Access Tools
YARA-L
Alert process and file create events that are associated with hashes from the GCTI Remote Access Tool list
GCTI Tor Exit Nodes
YARA-L
Alert traffic destined for known Tor exit nodes
Alert on known Hash contacting Tor IP with VT Relationships.
Remote File Copy
Sigma
Detects the use of tools that copy files from or to remote systems
This rule detects suspicious usage of the 'curl' command on Linux systems that indicates a file upload or data transfer to a web service. It specifically looks for the 'curl' executable being run with command-line arguments such as '--form', '--upload-file', '--data', or their variations ('--data-ascii', '--data-binary', '--data-raw', '--data-urlencode'), or the shorthand options '-F', '-T', '-d'. The rule filters out connections to localhost or 127.0.0.1 to reduce false positives from legitimate local development or testing activities.
This rule detects network connections initiated by an executable to sub-domains associated with the "LocaltoNet" tunneling service. LocaltoNet is a reverse proxy that exposes localhost services to the internet. Adversaries have been observed leveraging this service for command-and-control (C2) activities, often to bypass multi-factor authentication (MFA) and perimeter security controls.
This rule detects attempts to proxy web pages through the HTTPPROXY service on an OpenCanary honeypot. This indicates that an attacker or automated tool has interacted with the honeypot's HTTP proxy, potentially attempting to use it for further malicious activity or reconnaissance.
Alert on Benign Binary contacting a TOR IP
Page 275 of 296