Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,208 detections
Filters
Last updated
All Time
Detection languages
2,407
1,435
704
406
354
Contributors
1,092
1,080
584
392
348
Categories
2,143
1,818
1,759
1,290
889
Platforms
4,235
1,450
895
574
181
Products / Services
1,567
855
774
655
512
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
9
9
9
9
7
IDS Classtypes
412
174
39
29
25
IDS Protocols
342
113
110
103
15
Detects SILENTTRINITY stager dll loading activity
Detects a network connection initiated by the certutil.exe utility.
Attackers can abuse the utility in order to download malware or additional payloads.
Attackers can abuse the utility in order to download malware or additional payloads.
Detects a non-browser process communicating with the Notion API. This could indicate potential use of a covert C2 channel such as "OffensiveNotion C2"
Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389
Detects svchost hosting RDP termsvcs communicating to target systems on TCP port 80 or 443
Detects programs that connect to uncommon destination ports
Detects Silence EmpireDNSAgent as described in the Group-IP report
Detects usage of COM objects that can be abused to download files in PowerShell by CLSID
Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling activity
Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol.
Detects when a user downloads a file by using CertOC.exe
Detects usage of the "type" command to download/upload data from WebDAV server
Detects the desktopimgdownldr utility being used to download a remote file. An adversary may use desktopimgdownldr to download arbitrary files as an alternative to certutil.
Well-known DNS Exfiltration tools execution
Detects executable names or flags used by Htran or Htran-like tools (e.g. NATBypass)
Detects SILENTTRINITY stager use via PE metadata
Detects execution of the IEExec utility to download and execute files
Detects suspicious child processes of the "Manage Engine ServiceDesk Plus" Java web service
Download and compress a remote file and store it in a cab file on local machine.
Download or Copy file with Extrac32
Execution of plink to perform data exfiltration and tunneling
Page 293 of 296