Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,208 detections
Filters
Last updated
All Time
Detection languages
2,407
1,435
704
406
354
Contributors
1,092
1,080
584
392
348
Categories
2,143
1,818
1,759
1,290
889
Platforms
4,235
1,450
895
574
181
Products / Services
1,567
855
774
655
512
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects remote binary or command execution via the ScreenConnect Service. This rule is intended for hunting anomalous executions originating from ScreenConnect, which is a legitimate remote administration tool that can be abused by threat actors.
Detects DNS queries for specific command and control (C2) domains known to be used by DPRK (Democratic People's Republic of Korea) threat actors. The rule specifically looks for 'connection.lockscreen.kro.kr' and 'updating.dothome.co.kr' in DNS query names.
Detects the execution of a system command, specifically 'cmd.exe', initiated by the ScreenConnect remote management service. This rule looks for 'cmd.exe' being spawned as a child process of 'ScreenConnect.ClientService.exe' and further refines the detection by looking for command lines that include the pattern '\TEMP\ScreenConnect\', which is indicative of temporary script execution by ScreenConnect.
Detects potentially suspicious file downloads directly from IP addresses and stored in suspicious locations using Wget.exe. This rule looks for executions of 'wget.exe' where the command line includes an IP address, 'http', and specific suspicious paths often used for temporary files or public user directories. This could indicate an adversary downloading malicious tools or files directly to a system.
An adversary may use legitimate desktop support and remote access software, such as Team Viewer, Go2Assist, LogMein, AmmyyAdmin, etc, to establish an interactive command and control channel to target systems within networks.
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
These services are commonly used as legitimate technical support software, and may be allowed by application control within a target environment.
Remote access tools like VNC, Ammyy, and Teamviewer are used frequently when compared with other legitimate software commonly used by adversaries. (Citation: Symantec Living off the Land)
Detects the execution of rundll32.exe that leads to an external network connection, specifically looking for known processes used by the Pikabot malware family for command and control (C2) communication. This rule identifies suspicious network activity originating from rundll32.exe when its parent process is one of the specified Windows binaries, which Pikabot has been observed to hijack for C2.
Detects potential Command and Control (C2) communication activity associated with the Peach Sandstorm APT group. The rule specifically looks for HTTP GET requests to '/api/Core/Command/Init' or '/api/Core/Command/Restart' endpoints, which are indicators of this group's C2 infrastructure.
Detects the execution of Fast Reverse Proxy (FRP) client or server binaries, or command-line arguments indicative of FRP configuration files. FRP is a legitimate tool that can be used by adversaries to establish command and control (C2) channels by exposing local services behind NAT or firewalls to the internet, effectively creating a proxy.
This rule detects the execution of the IOX tunneling tool, which is used for port forwarding and intranet proxy purposes. It specifically looks for the executable name 'iox.exe' and common command-line arguments associated with its forwarding and proxy functionalities, such as '.exe fwd -l', '.exe fwd -r', '.exe proxy -l', and '.exe proxy -r'. Additionally, it includes specific MD5, SHA1, and SHA256 hashes for version 0.4 of the tool to enhance detection accuracy.
Detects the execution of 'nimgrab.exe', a tool often bundled with the Nim programming framework and used for downloading files. This activity can indicate an adversary transferring tools or other files into a compromised environment.
Detects the execution of 'npc.exe', the client component of NPS (a port forwarding and intranet penetration proxy server). Detection is based on the executable name, specific command-line arguments indicative of server connection and authentication, or known hashes of the 'npc.exe' client.
Detects the execution of 'client32.exe', a component of the NetSupport Remote Control tool, when it is launched from an unusual directory outside of the standard 'C:\Program Files' or 'C:\Program Files (x86)' paths. This behavior can indicate an adversary attempting to evade detection by placing legitimate remote access tools in non-standard locations.
Detects the use of NPS, a port forwarding and intranet penetration proxy server
Detects the use of Fast Reverse Proxy. frp is a fast reverse proxy to help you expose a local server behind a NAT or firewall to the Internet.
Detects the use of IOX - a tool for port forwarding and intranet proxy purposes
Detects the usage of nimgrab, a tool bundled with the Nim programming framework and used for downloading files.
Detects the execution of the "cloudflared" tool with command-line arguments indicative of establishing or running a tunnel. This activity has been observed in post-compromise scenarios by threat actors, such as the Akira ransomware group, to maintain persistence and remote access to compromised networks by creating covert communication channels.
Detects a network connection initiated by "wordpad.exe" over uncommon destination ports. This might indicate potential process injection activity from a beacon or similar mechanisms.
Detects the execution of the Cloudflared Quick Tunnel utility, which can be used by adversaries to establish tunnels for various services like HTTP, RDP, SSH, and SMB. This tool has been observed in use by threat groups, including Akira ransomware, to create ad-hoc tunnels that generate random subdomains on trycloudflare.com.
This rule detects the execution of the 'cloudflared' binary when it has been renamed. It looks for specific command-line arguments associated with Cloudflare Tunnel operations ('tunnel cleanup', 'tunnel run', '-url tunnel') in conjunction with a list of known SHA256 hashes for legitimate cloudflared executables. The rule triggers if these conditions are met and the executable's name is NOT one of the known legitimate 'cloudflared.exe' names, indicating a potential attempt to disguise its execution.
This rule detects the execution of the 'cloudflared.exe' binary from any location other than the standard installation paths ('Program Files (x86)\cloudflared\' or 'Program Files\cloudflared\'). Adversaries often use portable versions of legitimate tools like Cloudflared for command and control (C2) or data exfiltration, executing them from non-standard directories to evade detection. This behavior is frequently observed in ransomware campaigns, such as those by Akira, where Cloudflared is leveraged to establish tunnels for malicious traffic.
Page 281 of 296