Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
Detects suspicious app installations, custom app creation, and bot additions within Microsoft Teams. This rule flags activities such as sideloaded app installations (which bypass Teams store vetting and can be used for persistence), custom app creation outside of typical development teams (potentially indicating C2 bots or data exfiltration apps), and the addition of bots, especially when combined with suspicious keywords in the app name. These actions can be indicative of an adversary establishing persistence or gaining unauthorized access and control within the Teams environment.
Detects unauthorized privilege escalation attempts within the MyBB Admin Control Panel (ACP) by monitoring limited-privilege accounts accessing restricted modules (e.g., plugins, templates, user groups). It correlates these web requests with file system changes in the plugin directory by the web server process and monitors application logs for suspicious administrative activity.
Detects behavior associated with the 'Adblock for YouTube' browser extension (ID: cmedhionkhpnakcndndgjdbohmhepckk) involving the injection of arbitrary JavaScript into the MAIN world of web pages. This occurs via remotely fetched script rules and the use of 'trusted-create-element' or similar methods to bypass browser sandboxing for script tag insertion and DOM access.
Detects the presence of known malicious browser extensions by their extension ID or extensions that declare overly permissive host access ('<all_urls>') in combination with suspicious naming conventions associated with common ad-blocking malware.
This rule detects anomalous access to cloud services, specifically Salesforce, Drift, Salesloft, HubSpot, and Marketo, that may indicate OAuth token abuse. It identifies scenarios where a high volume of actions (8 or more) occur within a short timeframe (3 hours or less) from a single IP address but with multiple unique user agents (2 or more). The detection is further refined by looking for actions related to 'Add delegated permission grant' or 'Create service principal', which are indicative of an attacker attempting to establish persistence or escalate privileges after gaining access through a compromised OAuth token.
Detects the instantiation of the Shell.Explorer.1 COM object via OLE in RTF documents, which is indicative of an attempt to exploit CVE-2026-21509 (PRISMEX). This vulnerability allows for potential arbitrary code execution.
This rule detects access attempts to SharePoint or Office 365 applications where the UserAgent string indicates the use of PowerShell or Python. This could signify suspicious scripting activity or automated access that might be indicative of malicious intent, such as data exfiltration or unauthorized configuration changes.
This rule monitors GitHub audit logs for potentially malicious activities in repository management and CI/CD workflows. It detects suspicious commits by specific maintainers, impersonation of the Dependabot bot, usage of non-standard snapshot branch naming conventions, execution of unauthorized workflows, and specific commit message patterns indicative of unauthorized system modifications or testing.
Detects an anomalous volume of NPM package publications by specific users associated with internal naming conventions (leo-*, @leoplatform/*, verana-blockchain*). The rule identifies potential supply chain compromise attempts by monitoring for burst activity (3+ publishes or 3+ unique packages within a 10-second window).
Detects the creation or opening of a named event (SyncedEventCreate, SyncedEventOpen, CreateEvent, OpenEvent) on Windows systems using the specific, potentially malicious, object name 'ShitSetupOn26126k'. This pattern often indicates inter-process communication associated with specific malware or unauthorized tool execution.
This rule detects potentially unauthorized or suspicious command execution originating from AI development assistant processes such as Claude, Cursor, Amazon Q, or Node-based environments. It specifically monitors for the invocation of shell commands (e.g., bash, sh -c) or package managers (npx) that interact with sensitive AI assistant configuration files (e.g., .amazonq, mcp.json), which could indicate an adversary attempting to leverage AI integration paths for unauthorized command execution or persistent configuration manipulation.
Detects unauthenticated ServiceNow Scripted REST Resource access attributed to Guest user or known attacker IP 51.159.98.241
Detects the presence of PIL exception messages in application logs that leak heap memory addresses. This is the first stage of the CVE-2026-22778 exploitation chain against vLLM instances used to bypass ASLR.
Identifies JavaScript environments writing randomized markers to localStorage to suppress repeated execution of the malicious ClickFix payload. This rule specifically looks for browser storage modifications combined with network events indicating a CDN-hosted JavaScript file.
Detects registration of potentially malicious OAuth applications in Azure AD
Detects suspicious commits pretending to be the Claude AI bot but pushing dependency updates, a tactic Miasma uses to blend in with legitimate automated pull requests.
This rule detects queries made within ServiceNow by accounts classified as 'Guest' or 'Unknown'. This could indicate unauthorized access or unusual activity from unprivileged or unidentifiable accounts attempting to query data within the ServiceNow environment.
This rule detects queries made within ServiceNow by accounts classified as 'Guest' or 'Unknown'. This could indicate unauthorized access or unusual activity from unprivileged or unidentifiable accounts attempting to query data within the ServiceNow environment.
Detects suspicious activity involving the upload of multiple unique packages to common CI/CD package repositories (like npmjs, pypi, Artifactory, Nexus, Maven) from a single device within a short timeframe. This could indicate a compromised build server or developer account attempting to inject malicious dependencies into the software supply chain.
Detects an appx package that was added to the pipeline of the "to be processed" packages which was downloaded from a file sharing or CDN domain.
Detects BITS transfer job downloading files from a file sharing domain.
Page 64 of 83