Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
A USB device with Vendor ID 0E90 is associated with vendor WiebeTech (a.k.a "CRU"), which is known to manufacture "mouse jigglers." These hardware devices can be used to prevent a computer from automatically locking the screen or going to sleep. Illegitimate use can range from policy violation to nefarious activity like remote desktop abuse.
Ngrok is a legitimate tool that creates secure tunnels to localhost servers through NAT/firewalls, often used by developers.
Additionally, Ngrok tunnels have been used by Iranian APT groups, among others, to support their operations particularly for Command and Control (C2), data exfiltration, and initial access staging.
Additionally, Ngrok tunnels have been used by Iranian APT groups, among others, to support their operations particularly for Command and Control (C2), data exfiltration, and initial access staging.
This rule looks for the usage of the torsocks process which can be used by threat actors to proxy connections through the Tor network to exfiltrate data or download further payloads. The usage of this process should always be considered suspicious.
The following EQL query can be used to hunt for XMRIG executions within your environment.
Detects the installation of specific malicious npm packages associated with the North Korean "Contagious Interview" campaign. These packages are known to deliver the XORIndex malware loader.
This rule detects the execution of common command-line utilities (wget, curl, nc, bash, python, perl, php, sh) within web server directories. This activity is highly suspicious as it could indicate an attacker attempting to download malicious files, execute web shells, or perform other post-exploitation activities on a compromised web server.
Detects unauthorized or suspicious USB device connections based on manufacturer, product, and device ID indicators.
Primary focus is on known identifiers associated with IP-KVM devices. The search utilizes the CrowdStrike event feed, specifically focuses on the following event types:
- DcUsbDeviceConnected
- DcUsbDeviceDisconnected
- DcUsbDeviceBlocked
The device identifiers are sourced from publicly available sources (primarily GitHub).
Primary focus is on known identifiers associated with IP-KVM devices. The search utilizes the CrowdStrike event feed, specifically focuses on the following event types:
- DcUsbDeviceConnected
- DcUsbDeviceDisconnected
- DcUsbDeviceBlocked
The device identifiers are sourced from publicly available sources (primarily GitHub).
KQL Query from file: Hunting Exposed JDWP
This analytic processes and enriches alerts from CrowdStrike Falcon Event Stream, specifically `DetectionSummaryEvent` and `IdpDetectionSummaryEvent`. It normalizes fields such as user, destination, severity, and MITRE ATT&CK information. The rule dynamically generates drilldown links and constructs a descriptive title and message for each alert. It is designed to provide a standardized view of various CrowdStrike detections, including NGAV, Intel Detection, and Identity Protection alerts, ensuring proper risk scoring and analyst queue population.
Detects suspicious script download attempts initiated by a Java process, indicative of potential JDWP exploitation leading to Remote Code Execution (RCE). Attackers often leverage exposed JDWP interfaces to execute commands like downloading and running malicious scripts.
Detects the execution of the `sudo` command with the `chroot` option (`-C` or `--chroot`). This could be an indicator of an attempt to exploit privilege escalation vulnerabilities like CVE-2025-32463.
KQL Query from file: Suspicious CLI Obfuscation
KQL Query from file: Remote code execution exploit chain in OpenVPN
KQL Query
KQL Query
KQL Query
KQL Query
KQL Query from file: CVE-2024-7971 Patch Prioritization
KQL Query from file: DefenderXDR Exposure Management for CVE-2024-3094
KQL Query
KQL Query from file: CVE-2024-3094 with CVSS Score 10
Page 319 of 347