Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
This rule detects instances where a user account performs a password update without any preceding or associated account verification events (such as email verification, reset requests, or action execution) within a short timeframe. This behavior can be indicative of account compromise where an adversary modifies credentials for a compromised user account.
This rule monitors the software inventory for outdated versions of the PostgreSQL database server. It identifies installations where the major and minor versions are below the threshold for current security releases (e.g., v18 < 6, v17 < 11, v16 < 15, v15 < 19, v14 < 24). Running outdated software increases the risk of exploitation of known vulnerabilities.
Detects a direct push to the protected 'gnutls_3_7_x' release branch with no associated merge request, bypassing code review even when the pusher's role technically satisfies branch-protection rules.
Detects a direct push to the protected 'gnutls_3_7_x' release branch with no associated merge request, bypassing code review even when the pusher's role technically satisfies branch-protection rules.
Detects a GitLab personal access token used from multiple distinct source IPs or from IPs associated with the leaked gitlab-triage token, inconsistent with expected CI runner infrastructure.
Detects a GitLab personal access token used from multiple distinct source IPs or from IPs associated with the leaked gitlab-triage token, inconsistent with expected CI runner infrastructure.
Detects the sensitive project-wide CI/CD variable API_TOKEN being exposed to job scopes other than the gitlab-triage automation job that is its only intended consumer, expanding the blast radius of the credential.
Detects the sensitive project-wide CI/CD variable API_TOKEN being exposed to job scopes other than the gitlab-triage automation job that is its only intended consumer, expanding the blast radius of the credential.
Detects the sensitive project-wide CI/CD variable API_TOKEN being exposed to job scopes other than the gitlab-triage automation job that is its only intended consumer, expanding the blast radius of the credential.
Detects a single GitLab token/account holding Owner-level access across an unusually large number of projects (50+), the standing-privilege condition that turned one leaked token into a 55-project supply-chain exposure.
Detects forged NDA documents used in Phantom Deal M&A fraud campaign, requiring co-occurrence of impersonated advisory firm branding, secrecy-clause language restricting communication to personal channels, and M&A-fraud-specific wire/payment indicators rather than secrecy-clause phrasing alone
Detects GitLab CI job shell commands that redirect the environment to a .tmp file, a pattern identified in the GnuTLS GitLab token leak.
Detects CI/CD job activity referencing shell commands that redirect the entire environment to a file (e.g. 'env > out.tmp'), the exact pattern that caused a GitLab CI job in the openconnect/ocserv project to dump secrets into a public build artifact, leaking a high-privilege personal access token with Owner access to GnuTLS and 55 other critical projects.
Detects CI/CD job activity referencing shell commands that redirect the entire environment to a file (e.g. 'env > out.tmp'), the exact pattern that caused a GitLab CI job in the openconnect/ocserv project to dump secrets into a public build artifact, leaking a high-privilege personal access token with Owner access to GnuTLS and 55 other critical projects.
Detects anomalous access to Microsoft 365 services (OneDrive, SharePoint, Mail) where the user activity is characterized by a high volume of operations (more than 30) across a diverse set of objects (more than 15) within a one-hour window. The detection focuses on activity originating from specific common automation/scripting User-Agents (Microsoft Graph, Python httpx/requests) that deviate from typical, focused service account behavior.
Detects unauthenticated execution of sensitive Grafana MCP tools (tools/call, grafana_api_request) by identifying session IDs that lack a corresponding authenticated handshake event. This behavior is indicative of potential session spoofing or abuse of the MCP protocol where an attacker attempts to interact with privileged tools without performing a valid authentication handshake.
Detects incoming Grafana API requests directed at vulnerable mcp-grafana server instances identified by an outdated version (pre-1.1.0). This rule correlates host-level version discovery with application-layer logs containing suspicious 'grafana_api_request' method calls, which may indicate an attempt to exploit Server-Side Request Forgery (SSRF) vulnerabilities.
Detects instances where unauthenticated users or sessions execute privileged 'tools/call' operations within the Grafana MCP dispatcher. This behavior is indicative of potential session spoofing attacks, specifically targeting vulnerabilities similar to CVE-2026-19516, where lack of an Authorization header allows unauthorized access to privileged tool functions.
Detects instances of an mcp-grafana server responding with an HTTP 200 status code to a 'tools/call' request without an Authorization header, indicating potential unauthenticated remote tool execution on a vulnerable or misconfigured server.
Detects the presence of the 'X_TRACE_' marker within Magento report files or system logs, which is characteristic of the StyleSmuggler threat actor's method of poisoning log files to facilitate subsequent code execution.
Detects cloud application events originating from suspicious or specific User-Agent strings, including 'python-requests' and identified outdated or potentially spoofed Chrome versions (146, 150, 151.0.0). This behavior often correlates with automated scripts or bot activity interacting with cloud services.
Page 44 of 83