Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
Detects loading of diagcab packages from a remote path, as seen in DogWalk vulnerability
Detects a successful export of an Exchange mailbox to untypical directory or with aspx name suffix which can be used to place a webshell or the needed role assignment for it
Detects scenarios where an attacker enables the OpenSSH server and server starts to listening on SSH socket.
Detects external disk drives or plugged-in USB devices.
Detects suspicious Django web application framework exceptions that could indicate exploitation attempts
Generic rule for SQL exceptions in Python according to PEP 249
Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts
Detects suspicious Spring framework exceptions that could indicate exploitation attempts
Detects potential SpEL Injection exploitation, which may lead to RCE.
Detects when a Microsoft Cloud App Security reported users were active from an IP address identified as risky by Microsoft Threat Intelligence.
These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.
These IP addresses are involved in malicious activities, such as Botnet C&C, and may indicate compromised account.
Detects when a Microsoft Cloud App Security reported suspicious email forwarding rules, for example, if a user created an inbox rule that forwards a copy of all emails to an external address.
Detects when a Microsoft Cloud App Security reported when an app downloads multiple files from Microsoft SharePoint or Microsoft OneDrive in a manner that is unusual for the user.
Detects suspicious session with two users present
Detects suspicious SSH / SSHD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts
Detects suspicious DNS error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts
Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts
Ntdsutil Abuse
Sigma
Detects potential abuse of ntdsutil to dump ntds.dit database
An application has been removed. Check if it is critical.
Detects MSI package installation from suspicious locations
Detects when the a stored procedure is set or cleared for automatic execution in MSSQL. A stored procedure that is set to automatic execution runs every time an instance of SQL Server is started
Detects when the MSSQL "xp_cmdshell" stored procedure is used to execute commands
Page 82 of 83