Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
9
1
1
1
Contributors
12
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
7
2
2
2
1
Products / Services
4
2
2
2
2
MITRE Techniques
5
2
2
2
1
CVEs
2
2
2
IDS Classtypes
1
IDS Protocols
1
Detects authentication to a web application using default/built-in account credentials followed by outbound mail sent from an internal address — the technique CISA's red team used to send phishing email from a trusted internal identity.
Detects computer-account creation (Event ID 4741) by a non-administrative user, indicative of abuse of the default Machine Account Quota to join unauthorized machine accounts for privilege escalation, as exploited by CISA's red team.
Surfaces entities generating an unusually high volume of low-fidelity alerts that can mask a true-positive escalation event — the alert-fatigue and untuned-tooling gap CISA identified as a root cause of Organization A's failed detection.
Correlation detection for the PureLogs Stealer / fake Adobe Sign campaign. Fires when 3+ of 6 distinct attacker behaviors (Downloads-sourced 'output_*.js' execution via wscript/cscript, UserinitMprLogonScript persistence pointing at a .js payload, PowerShell fileless env-var payload reconstruction via [System.Environment]::GetEnvironmentVariable+IEX, in-memory .NET Assembly.Load without a disk-based .dll/.exe argument, PowerShell-initiated PixelDrain PNG retrieval, and PowerShell-initiated C2 traffic to vm180012.hosted-by.qwins.co) occur on the same host within a 15-minute window. All network/PowerShell legs are scoped to powershell.exe specifically to avoid flagging benign browser traffic to the legitimate PixelDrain file-sharing service.
Detects command-history clearing and log-deletion events (history -c, PowerShell history wipe, Clear-EventLog, wevtutil cl) co-occurring with another suspicious indicator (credential access or lateral movement) on the same host within a 1-hour window, excluding scheduled group-policy retention jobs.
Detects deletion of Volume Shadow Copies and backup catalogs (vssadmin, wbadmin, wmic shadowcopy, bcdedit) consistent with Gunra ransomware's pre-encryption recovery-inhibition behavior, requiring correlated multi-command deletion sequences to reduce noise from routine backup retention.
Detects creation of the malicious persistent 'forticloud-sync' super-user account on FortiOS following an anomalous admin WebSocket session, consistent with post-exploitation of CVE-2024-55591/CVE-2025-24472.
Flags administrative, discovery, or reconnaissance-style actions occurring between 22:00-06:00 local time, suppressed during confirmed maintenance windows or valid on-call tickets, and requires co-occurrence with at least one other flagged detection before surfacing — a corroborating signal, not a standalone alert.
Network signature for the specific WebSocket/admin-API request sequence used to exploit the FortiOS/FortiProxy authentication-bypass vulnerabilities CVE-2024-55591 and CVE-2025-24472, as leveraged by Gunra ransomware affiliates for initial access.
Detects the drop of Gunra's static ransom note file R3ADM3.txt matched by exact filename and content signature, and exact-match usage of known Gunra ransom-negotiation email addresses.
Detects successful passkey/WebAuthn authentication or signing events where the User Verification (UV) flag is unset/false or no UV assertion accompanies a device-key signature, scoped to relying parties/credentials where UV is policy-required, or corroborated by a missing biometric/user-presence event or a static (unchanged) signature counter. This reduces noise from relying parties or lower-risk contexts that legitimately do not require UV on every assertion.
Detects successful passkey/WebAuthn authentication or signing events where the User Verification (UV) flag is unset/false or no UV assertion accompanies a device-key signature, scoped to relying parties/credentials where UV is policy-required, or corroborated by a missing biometric/user-presence event or a static (unchanged) signature counter. This reduces noise from relying parties or lower-risk contexts that legitimately do not require UV on every assertion.