Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
This rule detects unauthorized or suspicious direct access to sensitive SAP tables (such as USR02, which contains user credentials) when initiated specifically via an RFC (Remote Function Call) logon connection. This helps identify potential data exfiltration attempts or unauthorized reconnaissance of sensitive SAP security data.
This rule monitors SAP systems for high-privileged role assignments by correlating Change Documents (PFCG, AGR_USERS table) with Security Audit logs. It identifies instances where a non-administrative user account assigns a role to another user (or themselves), providing visibility into potential unauthorized privilege escalation or account manipulation within the SAP environment.
Detects direct access to highly sensitive SAP tables (USR02, PAYR, P0002) via RFC logon. This specifically monitors for potential theft of user hashes (USR02), payroll data (PAYR), or personal employee information (P0002).
Detects high-volume data downloads (AUY) from SAP to a local frontend file, potentially indicating exfiltration.
Detects instances where an RDP service on an OpenCanary node has had a connection attempt.
This rule detects the assignment of sensitive or highly privileged roles to users within an SAP environment by monitoring change documents. It focuses on identifying potentially unauthorized or high-risk configuration changes where specific sensitive roles are assigned, which could indicate a privilege escalation attempt.
Detects unauthorized in-memory data modifications occurring during an SAP ABAP debugging session. Specifically, it flags instances where a user modifies data (using the CUL action) while actively debugging their own or another session, excluding predefined SAP administrative accounts.
Detects the execution of high-risk SAP ABAP programs identified in a sensitive program list. These programs, often used for administrative or internal testing purposes, can bypass standard SAP transaction-level authorization checks, making them attractive targets for privilege escalation or unauthorized data access.
This rule detects the execution of sensitive SAP function modules via Remote Function Call (RFC) using SAP Security Audit logs (AUK). It monitors for specific function modules defined in a sensitive list being executed by non-administrative users. The rule provides context including the function group and transaction code involved in the execution.
Detects instances where an OpenCanary node has been targeted by a NMAP FIN Scan
Detects instances where an OpenCanary node has been targeted by a NMAP NULL Scan
Detects instances where an OpenCanary node has been targeted by a NMAP OS Scan
Detects instances where an OpenCanary node has been targeted by a NMAP XMAS Scan
Detects instances where an OpenCanary node has been targeted by a SYN port scan.
This rule detects various indicators associated with the Shai-Hulud supply chain attack. It identifies known malicious hashes, suspicious file creations in GitHub workflows, destructive commands on Linux/macOS and Windows systems, initial execution via npm preinstall scripts, and the installation of specific vulnerable application names or applications from known vulnerable vendors.
This Logic detects the presence of the malicious Chrome extension FreeVPN[.]One by identifying its unique extension ID across installed browsers. The logic further correlates this presence with network communications initiated by the extension to suspicious or untrusted domains. By combining extension enumeration with traffic analysis, the detection ensures high fidelity with minimal false positives. This layered approach strengthens visibility into malicious browser add-ons masquerading as VPN tools.
Detects a sudden spike in Windows RestartManager Event ID 10000. A proliferation of RestartManager events is a strong indicator of active file encryption by ransomware (like INC or Akira) attempting to kill processes that are locking target files.
This is highly adjustable script that tells us whether HTTPS request was successful, the reason why it was blocked or not, and on top of that, it explains the error code. This is still a work-in-progress but it already does 99% of the job.
This detection identifies the consent or addition of an OAuth application that may be impersonating a legitimate, well-known brand. The logic flags applications whose names mimic major brands (e.g., Adobe, Microsoft, DocuSign) and use a reply URL hosted on a shared or free platform, a common tactic in consent phishing campaigns.
Detects attempts to exploit the authentication bypass vulnerability (CVE-2026-29000) in the pac4j-jwt library. An attacker can craft a JWE token containing an unsigned PlainJWT, which causes the library to skip signature verification. This is often indicated by a successfully authenticated token with an 'alg' (algorithm) claim of 'none'. This detection requires application logs to be configured to record the claims of successfully authenticated JWTs.
Identifies consent grants to OAuth applications with Application IDs matching known malicious campaigns. The IOCs are sourced from Wiz Research on campaigns from 2019-2025 involving brand impersonation and consent phishing.
Page 68 of 83