Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,535 detections
Filters
Last updated
All Time
Detection languages
3,970
998
596
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,931
2,196
2,017
1,857
1,411
Platforms
39,926
7,251
6,535
3,864
3,632
Products / Services
4,107
2,418
1,585
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule detects the presence of Olymp Loader malware by identifying known malicious file hashes (SHA256) and network communication with associated distribution domains. It looks for these indicators across various data sources, normalizing fields for consistent output. The rule aims to identify systems infected with or communicating with Olymp Loader infrastructure.
This rule identifies Cisco network devices within Microsoft Defender for Endpoint (MDE) telemetry that are running Cisco IOS or Cisco XE operating systems, excluding version '17.15.4a'. The exclusion of a specific OS version suggests the rule is designed to pinpoint devices that may be vulnerable to a known security flaw, potentially CVE-2025-20352 as indicated by the rule's title. It helps in mapping exposure to specific vulnerabilities by identifying potentially unpatched or vulnerable network infrastructure components.
Detects known sensitive file extensions via Zeek
Detects Acreed infostealer's cryptocurrency clipper activity. This rule identifies when a host first communicates with a known Acreed C2 domain (`trustdomainnet.live`) to fetch malicious wallet addresses, and then communicates with a QR code generation API (`api.zile42o.dev`) used to replace legitimate QR codes with malicious ones.
This rule detects attempts to exploit CVE-2025-49706 in SharePoint by observing POST requests to a vulnerable aspx path, which could result in code execution or server compromise. Specifically, it looks for HTTP POST requests to URLs containing '/_layouts/1(5|6)/ToolPane.aspx' and 'DisplayMode=Edit' and 'a=/ToolPane.aspx', combined with a referrer URL ending in '/_layouts/1(5|6)/signout.aspx'. This combination of indicators suggests an attempt to leverage the vulnerability for unauthorized access or code execution.
This rule identifies DNS lookups associated with common Tor proxies and services. It detects queries for domains ending in '.onion' and various Tor gateway domains (e.g., '.hiddenservice.net', '.tor2web.com', '.tor-gateways.de'). This activity can indicate the use of the Tor network for anonymization, which adversaries may leverage for command and control, data exfiltration, or to obscure their malicious activities.
This analytic detects the use of `curl.exe` with insecure flags such as `-k`, `--insecure`, `--proxy-insecure`, or `--doh-insecure` which disable TLS certificate validation. It leverages Cisco Network Visibility Module (NVM) flow data and process arguments to identify outbound connections initiated by curl where TLS checks were explicitly disabled. This behavior may indicate an attempt to bypass certificate validation to connect to potentially untrusted or malicious endpoints, a common tactic in red team operations, malware staging, or data exfiltration over HTTPS.
Detects the execution of a packet capture command with a specific buffer size known to be used by the LINE VIPER malware on Cisco ASA devices. LINE VIPER is a sophisticated malware designed to target Cisco ASA devices, often deployed by the RayInitiator bootkit.
Detects exploitation attempts against common network edge devices (Cisco, Ivanti, Palo Alto) associated with Salt Typhoon's TTPs for initial access.
Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string and performs GET requests. This activity is indicative of reconnaissance or data scraping.
Detects attempts to bypass authentication in Fortra GoAnywhere MFT by exploiting a vulnerability (CVE-2025-10035). This is achieved by sending a crafted GET request to the Unlicensed.xhtml endpoint to trigger an exception and obtain a valid license request token, which is a prerequisite for further exploitation.
Detects potential LINE VIPER tasking activity via Cisco ASA WebVPN authentication requests. This involves looking for specific XML elements (<client-cert> or <client-cert-auth-signature>) containing large Base64-encoded data, which is indicative of embedded shellcode.
This detection rule identifies potential SEO poisoning activity associated with the Operation Rewrite campaign. It looks for a high volume of web requests from a single source IP where the HTTP referrer indicates the traffic originated from a search engine. This pattern can indicate a compromised host being used for malicious purposes or a user interacting with multiple poisoned search results.
This analytic detects the disabling of logging functionality on a Cisco ASA device through CLI commands. Adversaries or malicious insiders may attempt to disable logging to evade detection and hide malicious activity. The detection looks for specific ASA syslog message IDs (111009, 111010, 111008) associated with command execution, combined with suspicious commands such as `no logging`, `logging disable`, `clear logging`, or `no logging host`. Disabling logging on a firewall or security device is a strong indicator of defense evasion.
This analytic detects instances where an internal host attempts to communicate with over 500 ports on a single destination IP address. It includes filtering criteria to exclude applications performing scans over ephemeral port ranges, focusing on potential reconnaissance or scanning activities. Monitoring network traffic logs allows for timely detection and response to such behavior, enhancing network security by identifying and mitigating potential threats promptly.
NetworkSignatureInspected just means the network sensor saw and matched a signature (it inspected the packet) — it doesn’t mean the flow was blocked. That’s the problem.
If your machines are negotiating SMB or NTLM with unknown remote IPs, you’ve got a real risk on your hands: data leakage, credential relay, or worm-style propagation. SMB to the Internet is almost never legitimate; if you don’t recognize the remote IP, treat it as suspicious.
The KQL query includes multiple conditions to detect not only default connections on legacy (139) or modern (445) SMB ports, but also cases where SMB is running over non-standard ports (attempts to evade simple port-based detection). It also extracts the SMB negotiation state so you can spot repeated or incomplete negotiation attempts (useful to detect scanning, failed auths, or relay attempts).
If your machines are negotiating SMB or NTLM with unknown remote IPs, you’ve got a real risk on your hands: data leakage, credential relay, or worm-style propagation. SMB to the Internet is almost never legitimate; if you don’t recognize the remote IP, treat it as suspicious.
The KQL query includes multiple conditions to detect not only default connections on legacy (139) or modern (445) SMB ports, but also cases where SMB is running over non-standard ports (attempts to evade simple port-based detection). It also extracts the SMB negotiation state so you can spot repeated or incomplete negotiation attempts (useful to detect scanning, failed auths, or relay attempts).
Zloader Custom DNS C2
YARA-L
Detects Zloader's custom DNS tunneling protocol which uses multiple Base32 encoded subdomains for C2 communication.
This rule detects a high volume of DNS queries (over 50) from a single source IP to a limited number of destination IPs (2 or less) for non-standard domains. It excludes common legitimate domains like microsoft.com, google.com, apple.com, cloudflare.com, akamai.com, and amazonaws.com, as well as queries to private IP ranges. This pattern can indicate DNS tunneling, data exfiltration, or command and control activity.
In this case, I have been researching about the 'curve' value into AdditionalFields field of DeviceNetworkEvents table which I identified into iana.org as two groups 'Elliptic curve' and 'Diffie-Hellman groups'.
These 2 kinds of encryption groups work to secure communication over an insecure channel, are classified by Internet Assigned Numbers Authority (IANA), as if are 'recommended' and the Datagram Transport Layer Security status. In addition, to take into account, the mentioned site mention: "If an item is not marked as 'Recommended', it does not necessarily mean that it is flawed; rather, it indicates that the item either has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases"
Therefore, this KQL Query is oriented to identify if the current encryption to secure your communications is enough or if due to the level of sensitive of your information, would need to be reviewed.
These 2 kinds of encryption groups work to secure communication over an insecure channel, are classified by Internet Assigned Numbers Authority (IANA), as if are 'recommended' and the Datagram Transport Layer Security status. In addition, to take into account, the mentioned site mention: "If an item is not marked as 'Recommended', it does not necessarily mean that it is flawed; rather, it indicates that the item either has not been through the IETF consensus process, has limited applicability, or is intended only for specific use cases"
Therefore, this KQL Query is oriented to identify if the current encryption to secure your communications is enough or if due to the level of sensitive of your information, would need to be reviewed.
This analytic detects intrusion events from known threat activity using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where one or multiple Snort signatures associated with a known threat or threat actor activity have been triggered within a one-hour time window. The detection uses a lookup table (cisco_snort_ids_to_threat_mapping) to map Snort signature IDs to known threat actors and their techniques. When multiple signatures associated with the same threat actor are triggered within the time window, and the count of unique signatures matches or exceeds the expected number of signatures for that threat technique, an alert is generated. This helps identify potential coordinated threat activity in your network environment by correlating related intrusion events that occur in close temporal proximity. Currently, this detection will alert on the following threat actors or malware families as defined in the cisco_snort_ids_to_threat_mapping lookup: ArcaneDoor, Static Tundra, AgentTesla, Amadey, AsyncRAT, Chafer, DCRAT, Lumma Stealer, Nobelium, Quasar, Remcos, Snake, Xworm. To add or update threat actors, update the cisco_snort_ids_to_threat_mapping.csv lookup file with new or modified threat names and associated Snort signature IDs.
Detects network traffic to a known Command and Control (C2) server (136.243.146.46:8898) associated with the YiBackdoor malware.
Page 288 of 312