Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects directory brute force tools like Gobuster, ffuf, feroxbuster
Detects browsers loading external anomalous scripts from known malvertising domains while visiting plaintext HTTP sites (Router injection). This rule specifically looks for network connections on port 80 (HTTP) that are joined with device network events where the remote URL matches a regex for known malvertising domains (.xyz, .top, .site) and ends with '.js', indicating an injected script.
Detects the multi-stage execution chain associated with the Gamaredon group's PteroEffigy loader. The rule monitors for PowerShell or scriptrunner instances originating from suspicious directories (AppData/Temp) that employ .NET reflection to load DLLs into memory. It then detects the subsequent creation of a scheduled task with a random alphanumeric name and the eventual execution of regsvr32 or rundll32 by that task to load the malicious DLL. Additionally, the rule identifies potential command-and-control activity by detecting specific Kazuar malware HTTP User-Agent strings.
Detects many unique, high-entropy URL paths that each receive a small number of requests before redirecting to authentication. This behavior is indicative of adversaries like Volt Typhoon (Tycoon) using one-time session paths for each victim in phishing campaigns.
Detects a user navigating to the Microsoft devicelogin portal immediately after clicking a link from an email, a precursor to Device Code OAuth phishing.
This rule monitors network logs (from proxies and firewalls) for web traffic (HTTP GET requests) containing suspicious JavaScript code injection patterns in the request context or message fields. It specifically looks for common XSS indicators such as <script tags, eval(), document.write(), fromCharCode(), and atob().
Detects a single source issuing at least eight HTTP PUT requests to five or more distinct Ghost Admin post objects within a ten-minute window. This activity is indicative of the Ghost ClickFix attack chain, which involves mass modification of blog posts.
Detects non-browser HTTP POST requests containing both 'access_token' and step-style parameters (e.g., 'step', 'stage', 'counter' followed by a number) in proxy or firewall telemetry. This rule specifically targets patterns associated with malware communication, such as SessionGate, Remus, or AnimateClipper, by excluding common browser user agents.
Detects curl.exe where system metadata is concatenated into User-Agent/Referer fields with specific delimiters.
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects a specific two-step HTTP pattern characteristic of OysterLoader's initial C2 communication. The malware first sends a registration request containing a 'WordPressAgent' User-Agent string, followed by a login request with a 'FingerPrint' User-Agent string to the same destination. This version checks for the User-Agent strings in the 'AdditionalFields' column.
Infostealer distributed via fake open-source tool impersonation sites
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
IoT botnet malware family used for DDoS and proxy infrastructure
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Lumma NetworkIOC
YARA
Infostealer-as-a-service targeting browser credentials and crypto wallets
Fraud framework powering scam domains for crypto and gambling schemes
AI-powered phishing-as-a-service abusing device-code authentication
Fraud framework powering scam domains for crypto and gambling schemes
Form-grabbing and credential stealing malware-as-a-service
Page 127 of 202