Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
This rule detects an attempted Server-Side Request Forgery (SSRF) via External XML Entity (XXE) injection targeting Xerox FreeFlow Core. The detection is based on HTTP POST requests containing specific XML and entity declarations indicative of an XXE attack, followed by a SYSTEM entity referencing an HTTP URL, which is characteristic of an SSRF attempt.
This rule detects attempts to exploit an authentication bypass vulnerability (CVE-2025-54253) in Adobe Experience Manager Forms. The detection is based on specific HTTP URI patterns and content within the request, including '/adminui/updateLicense1.do', 'login. ', and 'debug=command', which are indicative of an exploit attempt against the application.
This query is oriented to identify and classify browser extensions by group and risk severity based on a well-known list of browser extension.
One of the ongoing threats that I feel we face daily is the use of multiple plugins and add-ons across various sites from devices so I focus on identifying common platforms where users might connect and utilize different features. I started with WordPress plugins to gather information and monitor user activity, particularly to stay informed about any connections to specific WordPress sites that employ unknown plugins.
Additionally, if you have installed a WordPress site on any of your devices and it is integrated with Microsoft Defender for Endpoint, this query can be adapted to detect the plugins in use by the users connectives —both from within and externally. It can also help identify potential attacks and vulnerabilities, such as outdated plugin versions.
Additionally, if you have installed a WordPress site on any of your devices and it is integrated with Microsoft Defender for Endpoint, this query can be adapted to detect the plugins in use by the users connectives —both from within and externally. It can also help identify potential attacks and vulnerabilities, such as outdated plugin versions.
Detects cast exceptions in Windows Server Update Services (WSUS) application logs that highly indicate exploitation attempts of CVE-2025-59287, a deserialization vulnerability in WSUS. The rule specifically looks for `System.InvalidCastException` and `System.Windows.Data.ObjectDataProvider` along with `Unable to cast object of type` and `System.Windows.Media.Brush` within EventID 7053 from the 'Windows Server Update Services' provider.
Detects when a user attempts to access an application in Okta without proper authorization. This could indicate an attacker trying to gain unauthorized access to resources or a legitimate user attempting to access an application they do not have permissions for.
https://www.proofpoint.com/us/blog/threat-insight/beyond-credentials-weaponizing-oauth-applications-persistent-cloud-access
Detects access or search activity in SharePoint or OneDrive involving keywords related to gift cards, IT workflows, and remote access. This is a reconnaissance technique used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539) to find sensitive internal documentation.
Detects global permissions change activity.
Detects unauthorized access attempts to a resource.
This rule detects the execution of the extended stored procedure backdoor named Maggie in the context of Microsoft SQL server by looking for specific event IDs and the string 'maggie' in the event message.
This rule detects when the Windows Software Restriction Policies (SRP) prevent an application from executing. This can indicate an attempt to run unauthorized software that is blocked by administrative policies, potentially signaling a policy violation, malware execution attempt, or an adversary attempting to bypass security controls. The rule specifically looks for Event IDs 865, 866, 867, and 868 from the 'Microsoft-Windows-SoftwareRestrictionPolicies' provider, which correspond to different reasons for access restriction (default policy, location-based rule, publisher policy, or general policy rule).
Detects a DNS server error indicating that a specified plugin DLL, configured in the registry, could not be loaded. This event can be triggered by an attacker attempting to load a malicious DLL for privilege escalation or persistence on a DNS server, often associated with techniques like DNSAdmin to DC compromise.
This rule detects a DHCP server error where a specified Callout DLL, configured in the registry, could not be loaded. This event can indicate an attempt to inject a malicious DLL into the DHCP server process for persistence, privilege escalation, or defense evasion.
Detects when full data export is attempted an unauthorized user.
Detects user data export activity.
Detects user permission data export attempt.
Detects when an organization member or an outside collaborator is added to or removed from a project board or has their permission level changed or when an owner removes an outside collaborator from an organization or when two-factor authentication is required in an organization and an outside collaborator does not use 2FA or disables 2FA.
Detects when a repository or an organization is being transferred to another location.
This detection identifies when a startup procedure is registered or executed in SQL Server. Startup procedures automatically execute when SQL Server starts, making them an attractive persistence mechanism for attackers. The detection monitors for suspicious stored procedure names and patterns that may indicate malicious activity, such as attempts to execute operating system commands or gain elevated privileges.
This rule detects the addition of an AppX package to the "to be processed" pipeline when the package is located in an uncommon directory. AppX packages are a Windows application packaging format. Adversaries may leverage this mechanism to deploy malicious applications or achieve persistence. The rule specifically filters out common and legitimate installation paths and sources, such as Program Files, WindowsApps, SystemApps, and Microsoft-related CDN URLs, to reduce false positives. Detection is based on Event ID 854 from the AppXDeployment-Server log source.
Page 70 of 83