Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,146 detections
Filters
Last updated
All Time
Detection languages
679
377
340
230
173
Contributors
630
378
354
143
119
Categories
835
831
746
387
348
Platforms
1,580
584
492
263
118
Products / Services
10,680
9,761
6,694
4,418
3,744
2,146
MITRE Techniques
655
561
377
331
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
This analytic leverages alerts from Splunk AppDynamics SecureApp to identify and monitor exploit attempts targeting business applications. It specifically looks for vulnerabilities in web applications, including injection attacks (SQL, API abuse), deserialization vulnerabilities, remote code execution attempts, LOG4J, and zero-day attacks. These attacks typically aim to gain unauthorized access, exfiltrate sensitive data, or disrupt application functionality. Splunk AppDynamics SecureApp provides real-time detection by analyzing application-layer events and correlating attack behavior with known vulnerability signatures, categorizing attack severity, providing visibility into attacker tactics, and generating risk-based scoring and contextual alerts.
The analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. It leverages Palo Alto traffic logs mapped to the Network_Traffic data model in Splunk. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments. If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
This analytic detects network traffic associated with known remote access software applications, such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer, as identified by Cisco Secure Firewall Application Detectors. It leverages Cisco Secure Firewall Threat Defense Connection Events. This activity is significant because adversaries often use remote access tools to maintain unauthorized access to compromised environments. If confirmed malicious, this activity could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
The analytic identifies potential Remote Desktop Protocol (RDP) brute force attacks by monitoring network traffic for RDP application activity. It detects potential RDP brute force attacks by identifying source IPs that have made more than 10 connection attempts to the same RDP port on a host within a one-hour window. The results are presented in a table that includes the source and destination IPs, destination port, number of attempts, and the times of the first and last connection attempts, helping to prioritize IPs based on the intensity of activity.
Detects attempts to exploit multiple buffer overflow vulnerabilities (CVE-2025-8184, CVE-2025-8169, CVE-2025-8168) in D-Link DIR-513 routers via the 'curTime' parameter in formSetWan endpoints.
The analytic identifies the execution of the native mimikatz.exe binary on Windows systems, including instances where the binary is renamed. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and original file names. This activity is significant because Mimikatz is a widely used tool for extracting authentication credentials, posing a severe security risk. If confirmed malicious, this activity could allow attackers to obtain sensitive credentials, escalate privileges, and move laterally within the network, leading to potential data breaches and system compromise.
The analytic identifies allowed network traffic to The Onion Router (TOR), an anonymity network often exploited for malicious activities. It leverages data from Next Generation Firewalls to detect traffic where the application is TOR and the action is allowed. This activity is significant as TOR can be used to bypass conventional monitoring, facilitating hacking, data breaches, and illicit content dissemination. If confirmed malicious, this could lead to unauthorized access, data exfiltration, and severe compliance violations, compromising the integrity and security of the network.
The following analytic detects the execution of known remote access software within the environment. It leverages network logs mapped to the Web data model, identifying specific URLs and user agents associated with remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer. This activity is significant as adversaries often use these utilities to maintain unauthorized remote access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or further compromise the network, posing a severe security risk.
Detects large data transfers over SSH/SCP (port 22) to or from an ESXi host. This activity is highly suspicious and could indicate an attacker delivering a ransomware payload to the hypervisor or exfiltrating sensitive data (like VMDK files).
Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse this feature to establish a reverse shell, persistence, or exfiltrate data from a compromised machine.
š Description
Threat actors frequently register lookalike domains to support malicious activities such as phishing attacks, drive-by compromises, and command-and-control (C2) operations. This KQL hunting query is designed to help identify potential phishing and typosquatting domains that may be targeting your organization or its third-party vendors.
š Threat Intelligence Feed
The hunting query utilizes data from the SANS Internet Storm Center (ISC) API, which provides access to newly registered domains.
API Endpoint:
https://isc.sans.edu/api/recentdomains/today?json
Use Cases:
Threat intelligence enrichment
Detection of suspicious or malicious domains
Security log correlation
Returned Data Fields:
Domain name
Registration date
IP address
Type
Additional metadata (if available)
Query by Date (Optional):
Example: https://isc.sans.edu/api/recentdomains/2025-07-08?json
šÆ ATT&CK Framework Mapping
Technique: Acquire Infrastructure: Domains
ID: T1583.001
Reference: MITRE ATT&CK
Threat actors frequently register lookalike domains to support malicious activities such as phishing attacks, drive-by compromises, and command-and-control (C2) operations. This KQL hunting query is designed to help identify potential phishing and typosquatting domains that may be targeting your organization or its third-party vendors.
š Threat Intelligence Feed
The hunting query utilizes data from the SANS Internet Storm Center (ISC) API, which provides access to newly registered domains.
API Endpoint:
https://isc.sans.edu/api/recentdomains/today?json
Use Cases:
Threat intelligence enrichment
Detection of suspicious or malicious domains
Security log correlation
Returned Data Fields:
Domain name
Registration date
IP address
Type
Additional metadata (if available)
Query by Date (Optional):
Example: https://isc.sans.edu/api/recentdomains/2025-07-08?json
šÆ ATT&CK Framework Mapping
Technique: Acquire Infrastructure: Domains
ID: T1583.001
Reference: MITRE ATT&CK
Detects the download of a Java Archive (.jar) file from common file-sharing services like Dropbox or MediaFire. This behavior is associated with sophisticated email campaigns where attackers use PDF attachments with embedded links to trick users into downloading and executing Remote Access Trojans (RATs).
This rule identifies network traffic to known Command and Control (C2) infrastructure associated with the Katz Stealer malware family. It uses a list of hardcoded IP addresses and domains from threat intelligence to detect suspicious outbound connections.
Detects network traffic to or from IP addresses known to be associated with the active exploitation of the SharePoint vulnerability CVE-2025-53770.
This rule detects HTTP POST requests to specific SharePoint application paths, including ToolPane.aspx and SignOut.aspx. These paths have historically been associated with SharePoint vulnerabilities, particularly unauthenticated remote code execution (RCE) exploits. The rule aims to identify attempts to interact with these sensitive endpoints, which could indicate an attacker attempting to exploit known vulnerabilities or perform unauthorized actions.
This rule detects potential proxy bypass attempts by identifying network connections on common web ports (80, 443) that are allowed by the network firewall but do not appear in the proxy logs. It correlates network traffic from the Network_Traffic data model with proxy traffic from the Web data model. The rule specifically filters for external-bound traffic by excluding private and multicast IP addresses.
This package searches for evidence of Windows Shortcut (.lnk) files executing code to download a .wsf file from a remote WebDAV share hosted on a trycloudflare[.]com subdomain. This package searches in both web logs and endpoint process logs.
An ongoing malware campaign tracked as SERPENTINE#CLOUD has been identified as leveraging the Cloudflare Tunnel infrastructure and Python-based loaders to deliver memory-injected payloads through a chain of shortcut files and obfuscated scripts.
For initial access, the threat actors are luring users to execute malicious .lnk files (shortcut files) disguised as documents to silently fetch and execute remote code.
These payloads use cmd.exe to silently retrieve additional stages over WebDAV (via Cloudflare Tunnel subdomains) and invoke WSF or batch-based droppers.
trycloudflare[.]com allows a threat actor to expose a tunnel to the internet using legitimate infrastructure that will likely blend into benign traffic. trycloudflare dynamically generates subdomains formed of random words and so it's not enough to just look for such connections since they are also used by developers in testing. Therefore this search looks for further procedures attributed to the campaign.
An ongoing malware campaign tracked as SERPENTINE#CLOUD has been identified as leveraging the Cloudflare Tunnel infrastructure and Python-based loaders to deliver memory-injected payloads through a chain of shortcut files and obfuscated scripts.
For initial access, the threat actors are luring users to execute malicious .lnk files (shortcut files) disguised as documents to silently fetch and execute remote code.
These payloads use cmd.exe to silently retrieve additional stages over WebDAV (via Cloudflare Tunnel subdomains) and invoke WSF or batch-based droppers.
trycloudflare[.]com allows a threat actor to expose a tunnel to the internet using legitimate infrastructure that will likely blend into benign traffic. trycloudflare dynamically generates subdomains formed of random words and so it's not enough to just look for such connections since they are also used by developers in testing. Therefore this search looks for further procedures attributed to the campaign.
This analytic detects repeated blocked connection attempts from the same initiator to the same responder within a short time window. It leverages Cisco Secure Firewall Threat Defense logs and identifies connections where the action is set to Block, and the number of occurrences reaches or exceeds a threshold of ten within a one-minute span. This pattern may indicate a misconfigured application, unauthorized access attempts, or early stages of a brute-force or scanning operation. If confirmed malicious, this behavior may represent an attacker probing the network, attempting lateral movement, or testing firewall rules for weaknesses.
This analytic detects outbound connections from Cisco Secure Firewall Threat Defense to commonly abused file sharing and pastebin-style hosting domains. It specifically looks for allowed connections where the URL matches a predefined list of known data hosting or temporary storage services. These platforms are frequently used by adversaries for malware delivery, data exfiltration, command and control (C2) beacons, or staging of encoded payloads. Identifying such connections can indicate potential abuse of legitimate infrastructure as part of an attacker's kill chain, suggesting tool staging, credential dumping, or outbound data leaks over HTTP(S).
This analytic detects outbound network connections initiated by command-line tools such as `curl` or `wget` as observed in Cisco Secure Firewall Threat Defense logs. It specifically looks for allowed connections where the `EVE_Process` or `ClientApplication` fields indicate the use of these utilities. While these tools have legitimate uses, adversaries frequently abuse them to download malicious payloads, retrieve additional tools, or establish staging infrastructure on compromised systems. Detection of this activity may indicate the download phase of an attack chain or the retrieval of command-and-control utilities.
KQL Query from file: Hunting Exposed JDWP
Page 92 of 103