Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
247 detections
Filters
Last updated
All Time
Detection languages
114
83
40
6
2
Contributors
100
26
26
17
12
Categories
71
47
33
29
24
Platforms
93
89
54
28
8
Products / Services
10,665
9,758
6,692
4,418
3,749
247
MITRE Techniques
80
67
56
52
50
CVEs
4
4
3
2
2
This detection monitors for signs of a shared or potentially compromised root account on ESXi hosts by tracking the number of unique IP addresses logging in as root within a short time window. Multiple logins from different IPs in a brief period may indicate credential misuse, lateral movement, or account compromise.
This detection identifies changes to the syslog configuration on an ESXi host using `esxcli`, which may indicate an attempt to disrupt log collection and evade detection. Adversaries may modify logging configurations to hinder forensic analysis and remain undetected.
This detection identifies when Lockdown Mode is disabled on an ESXi host, which can indicate that a threat actor is attempting to weaken host security controls. Disabling Lockdown Mode allows broader remote access via SSH or the host client and may precede further malicious actions such as data exfiltration, lateral movement, or VM tampering.
This detection identifies when a user is granted the Administrator role on an ESXi host. Assigning elevated privileges is a critical action that can indicate potential malicious behavior if performed unexpectedly. Adversaries who gain access may use this to escalate privileges, maintain persistence, or disable security controls.
This analytic detects outbound network connections initiated by command-line tools such as `curl` or `wget` as observed in Cisco Secure Firewall Threat Defense logs. It specifically looks for allowed connections where the `EVE_Process` or `ClientApplication` fields indicate the use of these utilities. While these tools have legitimate uses, adversaries frequently abuse them to download malicious payloads, retrieve additional tools, or establish staging infrastructure on compromised systems. Detection of this activity may indicate the download phase of an attack chain or the retrieval of command-and-control utilities.
KQL Query
The following analytic identifies anomalous network traffic volumes between Kubernetes workloads or between a workload and external sources. It leverages Network Performance Monitoring metrics collected via an OTEL collector and pulled from Splunk Observability Cloud. The detection compares recent network metrics (tcp.bytes, tcp.new_sockets, tcp.packets, udp.bytes, udp.packets) over the last hour with the average over the past 30 days to identify significant deviations. This activity is significant as unexpected spikes may indicate unauthorized data transfers or lateral movement. If confirmed malicious, it could lead to data exfiltration or compromise of additional services, potentially resulting in data breaches.
The analytic identifies anomalous inbound network traffic volumes from processes within containerized workloads. It leverages Network Performance Monitoring metrics collected via an OTEL collector and pulled from Splunk Observability Cloud. The detection compares recent metrics (tcp.bytes, tcp.new_sockets, tcp.packets, udp.bytes, udp.packets) over the last hour with the average over the past 30 days. This activity is significant as it may indicate unauthorized data reception, potential breaches, vulnerability exploitation, or malware propagation. If confirmed malicious, it could lead to command and control installation, data integrity damage, container escape, and further environment compromise.
This analytic detects new UDP communication between a source and destination workload pair within a Kubernetes cluster. It uses Network Performance Monitoring (NPM) metrics from an OTEL collector via Splunk Observability Cloud. The detection compares network activity over the last hour with the past 30 days to identify new inter-workload communication. Such changes in network behavior can indicate potential security threats or anomalies, including unauthorized connections that may lead to data breaches, privilege escalation, lateral movement, or disruption of critical services.
'This query will determine multiple password resets by user across multiple data sources.
Account manipulation including password reset may aid adversaries in maintaining access to credentials and certain permission levels within an environment.'
Account manipulation including password reset may aid adversaries in maintaining access to credentials and certain permission levels within an environment.'
'This creates an incident in the event a client generates excessive amounts of DNS queries for non-existent domains.
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
'Matches domain name IOCs related to Forest Blizzard group activity published July 2019 with CommonSecurityLog, DnsEvents and VMConnection dataTypes.
References: https://blogs.microsoft.com/on-the-issues/2019/07/17/new-cyberthreats-require-new-ways-to-protect-democracy/.'
References: https://blogs.microsoft.com/on-the-issues/2019/07/17/new-cyberthreats-require-new-ways-to-protect-democracy/.'
'Identifies clients with a high NXDomain count which could be indicative of a DGA (cycling through possible C2 domains where most C2s are not live). Alert is generated when a new IP address is seen (based on not being seen associated with
NXDomain records in prior 10-day baseline period).
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
NXDomain records in prior 10-day baseline period).
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
'This script identifies password changes or resets across multiple host and cloud sources. Account manipulation, including password changes and resets, may help adversaries maintain access to credentials and permission levels.'
'Identifies IP addresses that may be performing DNS lookups associated with common currency mining pools.
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
This analytic rule uses [ASIM](https://aka.ms/AboutASIM) and supports any built-in or custom source that supports the ASIM DNS schema'
'Detects suspicious user agent strings used by known hack tools'
The query checks process command being placed into the script; CVE-2022-22960 allows a user to write to it and be executed as root.
This vulnerability of VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.
CVE: CVE-2022-22960.
Read more here:.
https://www.cisa.gov/uscert/ncas/alerts/aa22-138b
https://www.vmware.com/security/advisories/VMSA-2022-0011.html
Tags: #exploit #CVE-2022-22960
This vulnerability of VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts.
CVE: CVE-2022-22960.
Read more here:.
https://www.cisa.gov/uscert/ncas/alerts/aa22-138b
https://www.vmware.com/security/advisories/VMSA-2022-0011.html
Tags: #exploit #CVE-2022-22960
'Identifies a list of IP addresses with a minimum number(default of 5) of failed logon attempts to remote hosts.
Uses that list to identify any successful logons to Microsoft Entra ID from these IPs within the same timeframe.'
Uses that list to identify any successful logons to Microsoft Entra ID from these IPs within the same timeframe.'
'Query finds accounts recorded as disabled by AD in previous time period but still using proxy in current time period. Presumes default squid log format is used. http://www.squid-cache.org/Doc/config/access_log/'
'Threat actors can use JPEG files to hide malware, or other malicious code from inspection. This query looks for the downloading of abnormally large JPEG files from a source where large JPEG files have not been downloaded.
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
This analytic detects suspicious modifications to Unix shell configuration files, such as `.bashrc` or `.profile`, which may indicate an attempt to alter system behavior or gain unauthorized access. Unauthorized changes to these files can be used to execute malicious commands, escalate privileges, or hide malicious activities. By monitoring for unusual or unauthorized modifications to shell configuration files, this analytic helps identify potential security threats, allowing security teams to respond quickly and mitigate risks.
Page 9 of 12