Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
507 detections
Filters
Last updated
All Time
Detection languages
247
92
78
48
19
Contributors
141
113
53
46
41
Categories
20,443
11,831
5,872
5,155
4,866
Platforms
210
138
110
82
78
Products / Services
147
74
62
41
28
MITRE Techniques
243
128
69
68
55
CVEs
10
9
5
5
5
IDS Classtypes
4
IDS Protocols
4
Detects the creation of Model Context Protocol (MCP) server configuration files (such as .mcp.json or those in .vscode/ and .amazonq/ directories) shortly after a Git operation (pull, fetch, merge, or clone). This pattern is indicative of a supply chain attack where a contributor introduces malicious MCP configurations into a workspace, which are subsequently loaded by development tools like VS Code, Cursor, or language servers to execute arbitrary code or exfiltrate data.
Fraud framework powering scam domains for crypto and gambling schemes
Detects modifications to Azure AD/Entra ID application configurations, specifically updating the 'RedirectUri' or 'ReplyUrls' to point to potentially external or unauthorized domains. This technique is often used in OAuth-based application-consent phishing campaigns to redirect authorization codes to adversary-controlled servers.
Detects the creation or modification of Power Automate Flows that utilize non-Microsoft domains for HTTP or webhook connectors. Adversaries may abuse Power Automate to automate exfiltration or command-and-control tasks by connecting workflows to external malicious endpoints.
This rule detects when a non-administrative user grants an application high-privilege OAuth scopes (such as mail reading, file access, or directory management) within an Azure/Microsoft 365 environment. Such consent grants can be used by attackers to maintain persistence and bypass MFA by gaining delegated access to sensitive resources.
Detects the removal or uninstallation of the ModSecurity Web Application Firewall (WAF) module across Windows (via appcmd.exe) and Linux (via package managers or apxs). Adversaries often disable security controls like ModSecurity to facilitate the exploitation of web vulnerabilities or to maintain persistence without triggering defensive alerts.
This rule detects the potential tampering of IIS logging configurations within a short duration following suspected web shell activity. It monitors for the execution of appcmd.exe or PowerShell commands that disable or modify IIS logging, specifically targeting sites or configurations after an IIS worker process (w3wp.exe) has performed activity associated with a webshell. This pattern is indicative of an attacker attempting to conceal their footprint after gaining access.
This rule detects the uninstallation or removal of the ModSecurity module from an IIS server, followed by suspicious POST requests to .aspx files within a 30-minute window. This behavioral pattern is indicative of an attacker disabling web application firewall (WAF) protections before attempting to exploit vulnerabilities or upload web shells.
This rule detects two suspicious activities within a user's mailbox: (1) An email flood, where a recipient receives more than 500 emails within a 5-minute window, potentially indicating an attempt to overwhelm or hide secondary emails; and (2) The creation or modification of inbox rules that include actions like deleting or moving messages, which is a common persistence and evasion technique used by attackers to hide C2 or phishing communications.
Lists all users who recently enabled Out-of-Office along with their latest sign-in activity. SOC analysts can reference this when triaging unfamiliar sign-in or impossible travel alerts to quickly determine if the user is on vacation.
Detects the creation or modification of '.config' or '.exe.config' files within commonly user-writable directories such as AppData, Temp, Downloads, or Desktop. These files are often used by .NET applications to define behavior, and attackers may manipulate them to perform activities such as assembly redirection, loading malicious DLLs, or altering security settings for elevated processes.
Fraud framework powering scam domains for crypto and gambling schemes
This rule detects when a user or administrator grants consent to an Azure AD or Office 365 application for permissions that provide significant access to mail, files, contacts, or directory data. This activity is a common vector for illicit OAuth consent attacks, where adversaries gain persistent access to sensitive data without requiring direct user credentials.
This rule detects modifications to Nginx configuration files (nginx.conf, or files within conf.d, sites-enabled, or sites-available directories) by processes other than authorized system management tools (e.g., nginx, apt, ansible). It further correlates these file modifications with subsequent Nginx configuration reloads, which is a common behavior when an adversary attempts to apply malicious configuration changes to a web server.
Detects unauthorized modifications to Nginx configuration files by processes other than the Nginx service itself, known package managers, or common configuration management tools. This behavior is indicative of potential malicious activity, such as the injection of proxy directives (e.g., fastcgi_pass, proxy_pass) as observed in the Velvet Ant Operation Highland, used to pivot traffic into protected or air-gapped network segments.
This rule detects potentially malicious modification or configuration changes to Azure Function Apps. It monitors for operations such as creation, updates, and configuration changes that contain suspicious indicators like hardcoded credentials (TOKEN, SECRET, PASS), potential reverse shell patterns, or large Base64 encoded payloads. The rule specifically excludes known CI/CD pipeline callers to minimize false positives.
This rule detects potentially malicious modification or configuration changes to Azure Function Apps. It monitors for operations such as creation, updates, and configuration changes that contain suspicious indicators like hardcoded credentials (TOKEN, SECRET, PASS), potential reverse shell patterns, or large Base64 encoded payloads. The rule specifically excludes known CI/CD pipeline callers to minimize false positives.
This rule detects when a non-administrative user grants an application high-privilege OAuth scopes (such as mail reading, file access, or directory management) within an Azure/Microsoft 365 environment. Such consent grants can be used by attackers to maintain persistence and bypass MFA by gaining delegated access to sensitive resources.
This rule detects sensitive modifications to payroll-related information in Workday, such as bank account details, direct deposit settings, or payment method changes. It flags instances where such modifications occur from multiple IP addresses for the same user account, which may indicate account compromise and unauthorized attempts to divert funds.
This rule detects potential lateral phishing attempts originating from a compromised Microsoft 365 account. It flags outbound internal emails containing payroll-related keywords, such as direct deposit or salary redirection, which are sent to HR or finance departments. This activity is correlated with recent mailbox rule modifications (like transport or inbox rules) by the same user, a technique often used by threat actors to hide communications or exfiltrate data, consistent with identified campaigns like Payroll Pirate.
Detects the silent activation of the 'Smart Window' feature in Mozilla Firefox. The rule monitors for a two-stage sequence where Firefox modifies its 'prefs.js' configuration file to enable the feature, followed shortly by a network connection to the local Smart Window AI API on localhost port 8765.
Page 17 of 25