Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
564 detections
Filters
Last updated
All Time
Detection languages
464
49
14
12
11
Contributors
217
119
88
54
41
Categories
20,443
11,831
5,872
5,155
4,866
564
Platforms
494
55
21
17
14
Products / Services
467
195
64
23
14
MITRE Techniques
180
93
65
63
59
CVEs
4
4
4
4
3
IDS Classtypes
303
37
23
23
21
IDS Protocols
449
3
This rule detects attempts to exploit CVE-2024-30043, a vulnerability in Microsoft SharePoint's SPXmlDataSource. The detection is based on the presence of specific content in HTTP response bodies, including '<!DOCTYPE', '<SharePoint:SPXmlDataSource', and 'DataFile="', combined with a PCRE regex matching file or SMB paths, indicating an attempt to fetch data via XML External Entity (XXE) injection.
ET ATTACK_RESPONSE Braodo Loader Inbound
ET ATTACK_RESPONSE KoiStealer Payload Inbound
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound
This rule detects the presence of the PowerShell cmdlet 'Register-ScheduledTask' within an HTTP response body. This could indicate an attacker attempting to establish persistence on a compromised system by creating a scheduled task, potentially delivered via a web-based command and control channel or a malicious download.
This rule detects the presence of the PowerShell cmdlet 'New-ScheduledTask' and related parameters ('-action', '-trigger', '-taskname', '-settings') within the HTTP response body. This could indicate a system receiving instructions to create a scheduled task, potentially for persistence or execution of malicious code. The detection specifically looks for successful HTTP status code 200 responses.
This rule detects HTTP responses (status code 200) that contain the string 'schtasks' followed by '/run' and '/tn' (case-insensitive) in the response body. This pattern indicates the potential for a client system to receive instructions to execute a scheduled task, which could be used for persistence, lateral movement, or other malicious activities.
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M2
ET ATTACK_RESPONSE ReverseLoader Base64 Encoded Executable In Image M1
ET ATTACK_RESPONSE Observed AsyncRat Installer Inbound
ET ATTACK_RESPONSE TA399 Fake 404 WebPage Inbound
Lumma Stealer Payload Inbound
Suricata
This rule detects the inbound transfer of a Lumma Stealer payload over HTTP. Specifically, it looks for a unique content string within the HTTP response body, indicating the download of a DLL file associated with Lumma Stealer. The content string 'filename="fuckingdllENCR.dll"' is a strong indicator of this specific malware.
Detects network traffic to an ERMAC banking trojan exfiltration server by identifying a unique 'WWW-Authenticate' header in the HTTP response. This indicates a client device is communicating with a known ERMAC command and control server for data exfiltration.
Microsoft Releases Guidance on Exploitation of SharePoint Vulnerability (CVE-2025-53770)
This rule identifies a source that repeatedly fails to authenticate to a web service (HTTP response code 403). This may indicate a [brute force](https://en.wikipedia.org/wiki/Brute-force_attack) or [credential stuffing](https://en.wikipedia.org/wiki/Credential_stuffing) attack.
This rule uses the [Advanced Security Information Model (ASIM)](https://aka.ms/AboutSIM) and supports any web session source that complies with ASIM.
This rule uses the [Advanced Security Information Model (ASIM)](https://aka.ms/AboutSIM) and supports any web session source that complies with ASIM.
This rule detects HTTP 400 Bad Request errors when attempting to interact with the Microsoft Graph API's /v1.0/groups endpoint via a POST request. This specific activity can indicate a failed attempt to duplicate a group, potentially by tools like GraphRunner's Invoke-SecurityGroupCloner function. It focuses on identifying issues during group creation or modification operations within Azure AD through the Graph API.
This detects when a 401 Unauthorized status is received on multiple attempts of the same file when attempting to download from OneDrive and may indicate a permissions issue for the user.
This detects when a 401 Unauthorized status code is returned when attempting to download multiple unique files from OneDrive and may indicate a permissions issue for the user.
Page 27 of 27