Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
Detects anomalous activity in Microsoft 365 calendar events where potential C2 data is exfiltrated or synchronized. This is identified by the creation or modification of calendar events containing suspicious file names (e.g., File0.txt, File1.txt) or specific command-and-control markers within the event subject.
Detects Microsoft 365 Outlook calendar events with highly anomalous future dates (specifically the year 2050) or specific subject patterns, which are indicative of a command-and-control (C2) communication channel established via calendar item properties.
Detects Microsoft 365 Outlook calendar events being updated via Graph API where the subject is changed to a suspicious C2-like string (e.g., 'Boss Report ID:' or 'Boss update ID:'). This behavior is consistent with attackers using Outlook calendar events as a covert communication channel or for command and control signaling.
Detects Microsoft Graph API requests targeting user mailboxes within a tenant or organization structure likely associated with Israeli legal entities, identified by .co.il domain patterns in the Request URI.
Detects suspicious modifications or deletions of Outlook calendar events using the Microsoft Graph API, potentially indicating the use of calendar infrastructure as a command-and-control (C2) heartbeat or exfiltration channel. The rule monitors for specific pattern-based event updates or deletions following calendar enumeration, which is a technique used to maintain persistent communication or exfiltrate small amounts of data.
Detects Microsoft 365 Outlook calendar events being updated via Graph API where the subject is changed to a suspicious C2-like string (e.g., 'Boss Report ID:' or 'Boss update ID:'). This behavior is consistent with attackers using Outlook calendar events as a covert communication channel or for command and control signaling.
Detects unauthorized modifications to the 'wp_users' table in a WordPress database. The rule correlates specific WordPress REST API calls (oEmbed or batch processing endpoints) originating from the same source IP address that performs database inserts or updates, while explicitly excluding activity originating from verified Admin UI sessions.
Detects potential exploitation attempts targeting WordPress sites, specifically identifying unauthenticated REST API batch requests that attempt to forge posts with post_status 'parse' and post_type 'request' while including self-referential post_parent cycles. This pattern is associated with recent vulnerabilities enabling remote code execution.
Detects anomalous post-authentication activity in n8n where the authentication issuer for an account changes from historical norms. This identifies potential account takeover (ATO) scenarios where a hijacked token or cross-issuer session is used to perform lateral movement, workflow manipulation, credential access, or data exfiltration, consistent with behaviors associated with vulnerabilities like CVE-2026-59208.
Detects the unauthorized PyPI release of mrmustard 0.7.4 uploaded during the known malicious publish window following the maintainer account compromise.
Detects deletion of GitHub Actions workflow files combined with anomalous branch names/commit hashes, indicating the attacker concealing the malicious CI workflow used in this supply-chain compromise.
Detects instances where the Node.js runtime environment (node.exe) accesses sensitive configuration, settings, or message control protocol (mcp) files within directories associated with common developer IDEs and text editors like Claude, Cursor, Windsurf, Zed, and VS Code. This activity may indicate an attempt to exfiltrate IDE configuration, API keys, or environment settings.
This rule detects potential Active Directory enumeration activity by monitoring ADWS (Active Directory Web Services) port 9389. It captures activity where Microsoft.ActiveDirectory.WebServices.exe is engaged, and correlates this with Windows Event ID 1644, which identifies LDAP queries being executed. The rule specifically looks for local loopback connections often used to proxy and obfuscate the origin of these LDAP queries, helping to identify enumeration patterns that might be intended to hide the source workstation.
Detects unauthenticated exploitation attempts targeting WordPress sites using wp2shell techniques. The rule identifies malicious payloads attempting to leverage RSS, Navigation, or Calendar Gutenberg blocks in conjunction with the batch REST API to achieve Remote Code Execution.
Detects unauthenticated exploitation attempts targeting WordPress sites using wp2shell techniques. The rule identifies malicious payloads attempting to leverage RSS, Navigation, or Calendar Gutenberg blocks in conjunction with the batch REST API to achieve Remote Code Execution.
Detects a forged WordPress customize_changeset post that triggers wp_set_current_user with a mismatched or unauthenticated user context, the privilege-escalation bridge used in the wp2shell admin-takeover chain.
Detects a forged WordPress customize_changeset post that triggers wp_set_current_user with a mismatched or unauthenticated user context, the privilege-escalation bridge used in the wp2shell admin-takeover chain.
Detects anomalous activity in Microsoft 365 calendar events where potential C2 data is exfiltrated or synchronized. This is identified by the creation or modification of calendar events containing suspicious file names (e.g., File0.txt, File1.txt) or specific command-and-control markers within the event subject.
Detects Microsoft 365 Outlook calendar events with highly anomalous future dates (specifically the year 2050) or specific subject patterns, which are indicative of a command-and-control (C2) communication channel established via calendar item properties.
This rule detects anomalous activity where a 'post_save_repair' event is triggered multiple times for the same WordPress post ID within a short timeframe. Repeated post repair operations could indicate automated exploitation attempts, malformed content injection, or excessive resource usage causing application-layer instability.
Detects WordPress activity logs involving 'oembed' and 'cache' during a 'parse_request' action. This pattern can be associated with unauthorized attempts to manipulate or exploit the oEmbed cache mechanism within WordPress environments.
Page 54 of 83