Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
507 detections
Filters
Last updated
All Time
Detection languages
247
92
78
48
19
Contributors
141
113
53
46
41
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
210
138
110
82
78
Products / Services
147
74
62
41
28
MITRE Techniques
243
128
69
68
55
CVEs
10
9
5
5
5
IDS Classtypes
4
IDS Protocols
4
This rule detects potential unauthorized access and environment variable disclosure attempts against the Flowise API, specifically targeting the MCP (Model Context Protocol) endpoints. It monitors for path traversal-like patterns using case variants (e.g., /api/v1/env), unauthorized access to configuration endpoints, and the exposure of sensitive data like API keys, database URLs, and passwords in API responses or request headers.
Detects instances where a user account modifies sensitive payroll or banking information (e.g., direct deposit details) shortly after performing a sign-in from an unmanaged device or suspicious context. This behavior is indicative of an Adversary-in-the-Middle (AiTM) token replay attack targeting HR SaaS applications like Workday to perform financial fraud.
Detects the modification of VPN SSL Settings (for example, the modification of authentication rules).
This behavior was observed in pair with the addition of a VPN SSL Web Portal.
This behavior was observed in pair with the addition of a VPN SSL Web Portal.
This rule detects when a user or administrator grants consent to an Azure AD or Office 365 application for permissions that provide significant access to mail, files, contacts, or directory data. This activity is a common vector for illicit OAuth consent attacks, where adversaries gain persistent access to sensitive data without requiring direct user credentials.
Detects exploitation of CVE-2026-48558 in SimpleHelp RMM software. This vulnerability allows an attacker to bypass OIDC identity token signature verification, leading to unauthorized creation of a privileged Technician account and MFA bypass, as observed in the Sua Sponte / SHADOW#REACTOR campaigns.
Detects anomalous activity consistent with the Velvet Ant 'Operation Highland' methodology, which leverages Nginx/FastCGI to bridge external requests to internal SSH execution. The rule monitors three conditions: 1) HTTP POST requests to internal endpoints containing SSH-related command parameters; 2) suspicious Nginx configuration modifications or reload events; and 3) spawning of SSH processes by FastCGI handlers. Findings are correlated by time and entity to identify potential persistence or lateral movement mechanisms.
This rule detects potentially malicious activity related to browser extensions, specifically targeting configuration file modifications (manifest.json, rules files) or the use of sensitive browser APIs (declarativeNetRequest, updateDynamicRules) that are commonly abused by malicious extensions. It also flags activity that includes keywords associated with affiliate/ad-click fraud platforms within command line arguments of major browsers like Chrome and Edge.
Detects the addition of a VPN SSL Web Portal on a Fortinet FortiGate Firewall.
This behavior was observed in pair with modification of VPN SSL settings.
This behavior was observed in pair with modification of VPN SSL settings.
Detects the use of appcmd.exe to disable HTTP logging for an IIS site by setting 'dontLog' to True. Adversaries may perform this action to evade detection and prevent security logging of their activities on a compromised web server.
Detects the exploitation or configuration manipulation of the Firefox browser.smartwindow.enabled feature, which can be abused by an attacker to exfiltrate sensitive browser data such as history, tab URLs, and secret query-string parameters to a remote endpoint. The rule monitors for network connections containing known exfiltration path signatures, connections to hardcoded PoC server addresses, or the modification of configuration settings related to the SmartWindow feature.
Detects modifications to Chrome or Chromium browser preference files that indicate either the installation of a specific malicious extension or the overriding of the default search provider to a known suspicious domain (perplexity-ai.online). This indicates potential browser-based persistence or search hijacking.
Detects the presence of a known malicious Chromium extension (ID: flkebkiofojicogddingbdmcmkpbplcd) that masquerades as a legitimate 'Perplexity AI' extension. This malware hijacks the browser's default search provider to redirect traffic to 'perplexity-ai.online'.
This rule detects potential exploitation of the CVE-2026-48558 vulnerability in SimpleHelp servers by monitoring for specific sequences of log markers related to authentication bypass and unauthorized configuration changes. It flags anomalous technician registrations, OIDC attribute fetching, and 'New Anon' configuration saves within a 60-second window, which are indicative of an attacker attempting to gain unauthorized access or manipulate session security.
Detects modifications to Azure AD/Entra ID application configurations, specifically updating the 'RedirectUri' or 'ReplyUrls' to point to potentially external or unauthorized domains. This technique is often used in OAuth-based application-consent phishing campaigns to redirect authorization codes to adversary-controlled servers.
This rule detects two suspicious activities within a user's mailbox: (1) An email flood, where a recipient receives more than 500 emails within a 5-minute window, potentially indicating an attempt to overwhelm or hide secondary emails; and (2) The creation or modification of inbox rules that include actions like deleting or moving messages, which is a common persistence and evasion technique used by attackers to hide C2 or phishing communications.
Detects the use of the Microsoft IIS administrative tool, appcmd.exe, to uninstall ModSecurity WAF modules. This activity is a known technique used by adversaries to impair security defenses during post-exploitation, specifically observed in campaigns targeting ColdFusion servers.
Detects the use of the IIS command-line utility (appcmd.exe) to disable HTTP logging for an IIS site. Attackers may disable logging to conceal post-exploitation activities or unauthorized access attempts from forensic analysis and security monitoring.
Detects modifications to Azure AD/Entra ID application configurations, specifically updating the 'RedirectUri' or 'ReplyUrls' to point to potentially external or unauthorized domains. This technique is often used in OAuth-based application-consent phishing campaigns to redirect authorization codes to adversary-controlled servers.
This rule detects potentially suspicious modifications to Nginx configuration files or the usage of FastCGI directives such as fcgiwrap, fastcgi_pass, and proxy_pass. It specifically monitors for actions related to configuration changes (write, modify, create) or the establishment of backend communication via FastCGI parameters, which may indicate an attempt to gain remote code execution or persistence on a web server.
Detects the use of the appcmd.exe utility to disable IIS HTTP logging by setting the 'dontLog' configuration attribute to 'True'. This behavior is commonly used by attackers to hide malicious activity, such as webshell POST requests, from being captured in IIS logs.
Detects the creation or modification of Power Automate Flows that utilize non-Microsoft domains for HTTP or webhook connectors. Adversaries may abuse Power Automate to automate exfiltration or command-and-control tasks by connecting workflows to external malicious endpoints.
Page 16 of 25