Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
Detects the installation and execution of known APT36 Ghazwa spyware variants (com.ghazwa.updates, com.chragall, or com.chagall) that are sideloaded (not from the official Google Play Store) and attempt to request or activate Device Administrator privileges via intent actions or receiver class activation.
This rule detects suspicious audio capture activity associated with the APT36 Ghazwa spyware. It monitors for the execution of specific foreground services (MEATIER or ADSFEAM) from the package 'com.ghazwa.updates' simultaneously with the application requesting 'RECORD_AUDIO' permissions on the same device.
Detects the installation of specific browser extensions in Microsoft Edge followed by network connection activity to external IP addresses. This behavior is indicative of potential malicious browser extensions, such as those used for browser session hijacking, credential theft, or command and control (C2).
This rule detects potential rogue SD-WAN peering attempts by correlating successful SSH public key authentication using 'vmanage-admin' from known malicious IPs with subsequent network activity on SD-WAN control plane ports (e.g., 48373 for OMP, 830 for NETCONF). It also flags logs containing references to an 'evil_tenant.csv' artifact, which is associated with adversary persistence or unauthorized configuration management in SD-WAN environments.
Detects JavaScript using the 'ghost_once_footer_' key with localStorage read and write operations, indicative of potential web-based attacks leveraging compromised Ghost CMS instances. This rule specifically looks for the string 'ghost_once_footer_' in conjunction with 'localStorage.getItem' and 'localStorage.setItem', suggesting a mechanism for persistent or one-time data storage in the browser's local storage.
Detects the creation of new Inbox rules in Microsoft 365 that are configured to automatically move or delete emails containing payroll-related keywords such as 'direct deposit', 'bank', or 'hr'. This behavior is consistent with post-compromise activity by threat actors attempting to hide payroll fraud notifications or security alerts from the victim.
Detects network activity originating from popular web browsers (Chrome, Chromium, Edge, Brave) directed towards known malicious or suspicious browser extension domains. This rule flags beaconing, API requests, and remote configuration fetches associated with potentially malicious or unwanted browser extensions.
Detects high-volume LDAP queries or specific expensive LDAP search events (Event ID 1644) on Domain Controllers, which are often indicative of reconnaissance activities such as domain environment mapping or user/group enumeration.
Detects users who modify their MFA settings (registration/update/delete) and subsequently perform privileged actions (such as adding role members or service principal credentials) within a short timeframe, while simultaneously observed active in communication applications like Teams, Zoom, or Webex. This behavior is indicative of potential account takeover where an adversary modifies authentication methods to gain persistent access, followed by privilege escalation.
Detects unauthorized npm package publish events or file uploads associated with compromised maintainer accounts (czirker, llxlr) and specific malicious packages linked to the Miasma Mini Shai-Hulud supply chain attack.
Detects specific malicious activity patterns associated with the Miasma/Mini Shai-Hulud campaign targeting GitHub repositories. The rule monitors for unauthorized workflow creation, specific suspicious commit messages, and the use of orphan branches that impersonate dependabot or mimic specific campaign indicators.
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Detects suspicious activity within GitHub Actions, identifying potential exfiltration or malicious automation by correlating signals such as masquerading actors (e.g., bots like dependabot), specific IronWorm-associated commit message patterns, usage of secrets-related JSON expressions in logs, and the use of innocuous file names for artifact uploads.
This rule detects the use of system utilities (wevtutil.exe, auditpol.exe, PowerShell) to interact with, query, or check status of security event logs and auditing configurations. While these tools are standard for administration, their usage by non-system accounts can indicate an adversary attempting to understand, monitor, or manipulate system audit policies and event log configurations as part of a reconnaissance or defense evasion strategy.
This rule detects potential exploitation of SAP Remote Function Call (RFC) mechanisms, specifically targeting abuse of SXPG_CALL_SYSTEM and SXPG_COMMAND_INSERT which allow execution of OS commands via SAP. It identifies the execution of known malicious SAP-related scripts, suspicious OS commands (such as whoami, reading /etc/passwd or /etc/shadow) spawned by SAP work processes, and command line activity originating from privileged SAP service accounts.
Detects anomalous, unauthenticated access to API endpoints commonly associated with table enumeration, often targeting ServiceNow interfaces or similar REST APIs. The rule monitors for a high volume of unique API paths or tables requested by a single IP address without an authorization token present, as well as tracking access from known malicious IP addresses.
Detects a suspicious spike in Microsoft Teams external meeting or chat invitations directed at a single user within a 30-minute window. This behavior is consistent with UNC6692 tactics, where attackers impersonate internal IT helpdesk staff via Teams to perform vishing and social engineering attacks.
Detects the compromised user granting read/write permissions to a highly privileged, unfamiliar third-party application via the OAuth consent framework. Specifically looks for 'Consent to application' operations where granted permissions include 'Mail.ReadWrite', 'Contacts.Read', or 'offline_access'.
This rule detects Windows application crash events (Event IDs 1000 and 1001) specifically for 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. The detection triggers when the crash description contains indicators of memory-related instability, such as access violations, heap corruption, or invalid virtual calls, which may suggest exploitation attempts or service instability.
Detects the transmission of potential sensitive information, such as passwords, tokens, API keys, or private keys, within Microsoft Teams chat messages by matching message content against a regular expression pattern for common credential formats.
This rule monitors Android system logs for suspicious activity related to the NearbyConnections API. It specifically flags incomplete UKEY2 handshakes, unauthenticated frame processing, and pre-authentication frame requests, which may indicate attempts to intercept or interfere with local device discovery and connection protocols.
Page 60 of 83