Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
Detects anomalous outbound network connections from the Grafana MCP (Model Context Protocol) server process to internal private IP address ranges. The rule compares current network activity against a 14-day baseline to filter out known data sources, identifying potentially unauthorized lateral movement or internal network probing via server-side request forgery (SSRF) vulnerabilities.
Detects the presence of PHP code execution patterns (eval, base64_decode, system, shell_exec) injected into Magento log or report files (var/report/, var/log/system.log), indicative of log poisoning used for web shell staging.
This rule detects the installation of browser extensions that occur during an idle user session (greater than 7 minutes). This behavior is consistent with automated, remote-driven synthetic input injection, often utilized by malware (e.g., NinjaMare) to install malicious extensions without user consent while the system is unattended.
Detects anomalous unauthenticated password reset requests targeting the Keycloak reset-credentials endpoint. The rule monitors for high-volume password reset attempts from single source IP addresses, specifically flagging those that target common administrative usernames or attempt to reset passwords across multiple distinct user accounts, which may indicate exploitation attempts (e.g., CVE-2026-18963).
Detects anomalous, high-volume search query activity across multiple SharePoint sites or OneDrive locations, potentially indicating an adversary performing broad data discovery or enumeration across an organization's cloud document repositories.
Detects anomalous, high-volume search query activity across multiple SharePoint sites or OneDrive locations, potentially indicating an adversary performing broad data discovery or enumeration across an organization's cloud document repositories.
Detects anomalous, high-volume search query activity across multiple SharePoint sites or OneDrive locations, potentially indicating an adversary performing broad data discovery or enumeration across an organization's cloud document repositories.
Detects anomalous, high-volume search query activity across multiple SharePoint sites or OneDrive locations, potentially indicating an adversary performing broad data discovery or enumeration across an organization's cloud document repositories.
Detects anomalous access to Microsoft 365 services (OneDrive, SharePoint, Mail) where the user activity is characterized by a high volume of operations (more than 30) across a diverse set of objects (more than 15) within a one-hour window. The detection focuses on activity originating from specific common automation/scripting User-Agents (Microsoft Graph, Python httpx/requests) that deviate from typical, focused service account behavior.
Detects instances where a single account adds a large volume of users (over 50) to a Microsoft Teams chat within a one-hour window. This behavior could indicate automated activity, potential bulk addition by an attacker to facilitate phishing or spam, or unauthorized group modifications.
This rule detects potential unauthenticated access or unauthorized configuration modifications to an AI agent management backend. It monitors HTTP logs for requests targeting configuration endpoints that lack proper authentication, specifically identifying attempts to retrieve sensitive information like Dify or Coze keys, or attempts to inject new agent configurations via unauthenticated POST requests.
Detects a PHP TypeError in Magento system logs where array_merge() is called with an integer argument following an include statement. This signature is indicative of exploitation attempts targeting Magento sites using the StyleSmuggler vulnerability, which often involves malicious file inclusion and code execution.
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Detects instances of an mcp-grafana server responding with an HTTP 200 status code to a 'tools/call' request without an Authorization header, indicating potential unauthenticated remote tool execution on a vulnerable or misconfigured server.
Detects anomalous outbound network connections from the Grafana MCP (Model Context Protocol) server process to internal private IP address ranges. The rule compares current network activity against a 14-day baseline to filter out known data sources, identifying potentially unauthorized lateral movement or internal network probing via server-side request forgery (SSRF) vulnerabilities.
KQL Query from file: grafana-mcp-grafanaapirequest-call-without-prior-bearer-auth.kql
Detects anomalous actions within the Coder registry, such as template creation, version updates, or dry-run/workspace builds with module caching disabled, that occurred during a known registry compromise window on August 31, 2026.
Detects anomalous access to Microsoft 365 services (OneDrive, SharePoint, Mail) where the user activity is characterized by a high volume of operations (more than 30) across a diverse set of objects (more than 15) within a one-hour window. The detection focuses on activity originating from specific common automation/scripting User-Agents (Microsoft Graph, Python httpx/requests) that deviate from typical, focused service account behavior.
Detects CI/CD job activity referencing shell commands that redirect the entire environment to a file (e.g. 'env > out.tmp'), the exact pattern that caused a GitLab CI job in the openconnect/ocserv project to dump secrets into a public build artifact, leaking a high-privilege personal access token with Owner access to GnuTLS and 55 other critical projects.
Detects anomalous, high-value wire transfers involving keywords related to advance-payment or M&A-related fraud (e.g., 'advance retainer'), directed towards beneficiaries in Hong Kong using previously unseen bank accounts. The rule effectively filters out known, approved beneficiary accounts to focus on potentially malicious transactions.
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Page 42 of 83