Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
338 detections
Filters
Last updated
All Time
Detection languages
120
98
40
28
21
Contributors
66
66
65
53
13
Categories
148
107
105
82
53
Platforms
254
113
56
29
5
Products / Services
10,670
9,758
6,693
4,421
3,749
338
MITRE Techniques
158
96
45
41
35
CVEs
3
3
2
2
2
IDS Classtypes
17
3
3
2
2
IDS Protocols
18
4
3
2
2
The analytic detects cloud API calls executed by user roles that have not previously run these commands. It leverages the Change data model in Splunk to identify commands executed by users with the user_type of AssumedRole and a status of success. This activity is significant because new commands from different user roles can indicate potential malicious activity or unauthorized actions. If confirmed malicious, this behavior could lead to unauthorized access, data breaches, or other damaging outcomes by exploiting new or unmonitored commands within the cloud environment.
The analytic detects the creation of cloud compute instances using previously unseen image IDs. It leverages cloud infrastructure logs to identify new image IDs that have not been observed before. This activity is significant because it may indicate unauthorized or suspicious activity, such as the deployment of malicious payloads or unauthorized access to sensitive information. If confirmed malicious, this could lead to data breaches, unauthorized access, or further compromise of the cloud environment. Immediate investigation is required to determine the legitimacy of the instance creation and to mitigate potential threats.
The following analytic detects the suspicious sysmon service stop. This behavior is critical for a SOC to monitor because it may indicate attempts to gain unauthorized access or maintain control over a system. Such actions could be signs of malicious activity. If confirmed, this could lead to serious consequences, including a compromised system, unauthorized access to sensitive data, or even a wider breach affecting the entire network. Detecting and responding to these signs early is essential to prevent potential security incidents.
The analytic identifies DNS queries to domains associated with the 3CX supply chain attack. This activity is significant because it can indicate a potential compromise stemming from the 3CX supply chain attack, which is known for distributing malicious software through trusted updates. If confirmed malicious, this activity could allow attackers to establish a foothold in the network, exfiltrate sensitive data, or further propagate malware, leading to extensive damage and data breaches.
This rule detects outbound network connections to IP addresses that have been observed for the first time within the last 24 hours. It specifically excludes connections to private IP address ranges (RFC1918). The detection relies on correlating current network connection events with historical 'first seen' data for IP addresses from an entity graph.
This rule detects attempts to access domains that have been registered within the last 30 days. It correlates network HTTP or generic network connection events with WHOIS data to identify recently created domains. The rule leverages WHOIS enrichment to determine the creation time of the accessed domain and flags any access to domains created within the specified 30-day window.
The following analytic identifies network traffic where the higher layer protocol does not match the expected port, such as non-HTTP traffic on TCP port 80. It leverages data from network traffic inspection technologies like Bro or Palo Alto Networks firewalls. This activity is significant because it may indicate attempts to bypass firewall restrictions or conceal malicious communications. If confirmed malicious, this behavior could allow attackers to evade detection, maintain persistence, or exfiltrate data through commonly allowed ports, posing a significant threat to network security.
This rule detects connections to an RDP listener where the source IP address is not a private or link-local IP address. This indicates that the RDP service is publicly accessible from the internet, which is generally not recommended due to security risks.
This rule detects outbound network connections to IP addresses that exhibit low prevalence within the monitored environment. Specifically, it flags connections to IPs that have a rolling maximum prevalence of 1 to 3 occurrences over a 10-day period. This behavior can be indicative of command and control (C2) communication, data exfiltration, or other suspicious activities where adversaries might use newly registered or rarely seen infrastructure.
The following analytic identifies the use of cleartext protocols that risk leaking sensitive information. It detects network traffic on legacy protocols such as Telnet (port 23), POP3 (port 110), IMAP (port 143), and non-anonymous FTP (port 21). The detection leverages the Network_Traffic data model to identify TCP traffic on these ports. Monitoring this activity is crucial as it can expose credentials and other sensitive data to interception. If confirmed malicious, attackers could capture authentication details, leading to unauthorized access and potential data breaches.
This rule detects HTTP web access to domains that exhibit low prevalence within the monitored environment. It specifically filters out internal RFC 1918 IP addresses and ensures that only valid Fully Qualified Domain Names (FQDNs) are considered. The prevalence is determined by a rolling maximum count of unique days a domain has been observed, with alerts triggering for domains seen 3 or fewer times. The risk score is incremented based on how low the prevalence is, with the lowest prevalence (1 day) resulting in the highest risk score.
This rule detects when a file is downloaded from an IP address and subsequently created on a system, where both the file hash and the IP address are identified by VirusTotal Relationships as being associated with each other, specifically through a 'DOWNLOADED_FROM' relationship. This indicates that the downloaded file is known to have been served from that particular IP address, potentially flagging malicious file distribution.
This rule detects web traffic to a recently expired domain followed by the creation of an executable (.exe) file on the same host. It correlates network access events with WHOIS data to identify expired domains and then looks for subsequent file creation events where the file path ends with '.exe'. The file creation must occur after the network access event on the same principal hostname.
Detects network connections with a suspicious user-agent string containing "katz-ontop", which may indicate Katz Stealer activity. This specific user-agent string is likely hardcoded or characteristic of the malware's C2 communication.
Detect network connection to an ip address that was only seen for the first time in the past 24 hours
Detects connections from routable IPs to an RDP listener. Which is indicative of a publicly-accessible RDP service.
This analytic detects Lumma Stealer download attempts using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signatures with specific IDs have been triggered. If confirmed malicious, this behavior could indicate an active infection of Lumma Stealer.
IP Target Prevalence
YARA-L
Detect events that are communicating to IP addresses that have a low rolling max prevalence.
The following analytic identifies potential DLL side-loading instances involving unsigned DLLs mimicking Microsoft signatures. It detects this activity by analyzing Sysmon logs for Event Code 7, where both the `Image` and `ImageLoaded` paths do not match system directories like `system32`, `syswow64`, and `programfiles`. This behavior is significant as adversaries often exploit DLL side-loading to execute malicious code via legitimate processes. If confirmed malicious, this activity could allow attackers to execute arbitrary code, potentially leading to privilege escalation, persistence, and unauthorized access to sensitive information.
This analytic aggregates and summarizes alerts from Microsoft Defender for Endpoint. It extracts details such as source, file name, severity, process command line, IP address, registry key, signature, description, and unique ID. The detection is not intended to identify new activity from raw data but rather to leverage existing Microsoft Defender for Endpoint alerts for correlation and risk-based alerting. It filters out alerts with a 'clean' verdict and dynamically maps MITRE techniques and assigns risk scores based on the alert's severity.
This analytic identifies internal systems that generate a high volume of intrusion detection events within a 30-minute window, specifically leveraging Cisco Secure Firewall Threat Defense logs. It counts hosts that trigger 15 or more Snort-based signatures. A sudden increase in intrusion alerts from a single host can indicate malicious activity such as malware execution, command-and-control communication, vulnerability scanning, or lateral movement. It may also be caused by misconfigured software. Systems exhibiting this pattern require prompt investigation as repeated Snort rule matches are often early indicators of compromise or active exploitation.
Page 13 of 17