Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects network connections to known Indicators of Compromise (IOCs) associated with the TraderTraitor campaign, including trojanized Terraform providers (FLATROOF/ROOFDECK malware families) using specific domains and URL paths.
Point-in-time sweep of the 16 published BraZetsu sample SHA-256 hashes across file, process and image-load telemetry. Hashes rotated across five versions, so absence of a hit does not rule out BraZetsu.
Detects network, file, process, and email interactions associated with known IOCs related to Power BI phishing and rogue ScreenConnect campaigns over a 30-day lookback period.
Detects endpoint and network activity matching known Indicators of Compromise (IOCs) associated with BPFDoor, AVERAT, and Rekoobe backdoors based on Rapid7 research. The query checks for specific file hashes, IP addresses, and domain names across process, file, image load, network, and DNS events.
This rule monitors endpoint telemetry (DNS queries, network connections, file creation, and process execution) to identify matches against a predefined list of known malicious indicators, including IP addresses, domains, and file hashes (SHA256). The rule differentiates between confirmed malicious activity and low-confidence indicators, providing a prioritized view of potential threats.
Performs an IOC sweep for a known XMRig cryptojacking campaign exploiting a REDCap vulnerability (CVE-2026-90817), detecting matching network connections, file hashes, and process activities across endpoints.
Performs an IOC sweep for a known XMRig cryptojacking campaign exploiting a REDCap vulnerability (CVE-2026-90817), detecting matching network connections, file hashes, and process activities across endpoints.
Point-in-time sweep of the 16 published BraZetsu sample SHA-256 hashes across file, process and image-load telemetry. Hashes rotated across five versions, so absence of a hit does not rule out BraZetsu.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
This rule monitors for known malicious file hashes, command and control (C2) domains, and specific download URLs associated with identified threats. It correlates these indicators across process execution, file activity, and network connection logs to identify potential compromises or malicious activity related to the aware-cr1 infrastructure.
This rule detects indicator of compromise (IOC) sweep events associated with the AhsayCBS campaign (CVE-2026-105133 and CVE-2026-105134) involving XMRig cryptominer activity. It checks for specific file and process SHA256 hashes, remote IP addresses, and domain connections related to known mining pools or attacker infrastructure using Sentinel Device tables.
This rule detects indicator of compromise (IOC) sweep events associated with the AhsayCBS campaign (CVE-2026-105133 and CVE-2026-105134) involving XMRig cryptominer activity. It checks for specific file and process SHA256 hashes, remote IP addresses, and domain connections related to known mining pools or attacker infrastructure using Sentinel Device tables.
Detects DNS lookups, TLS connections, and network traffic associated with the PoeLLM cryptominer communicating with Kryptex mining pools, as well as Stratum mining protocol login attempts.
Detects potentially highly relevant antivirus events in the application log based on known virus signature names and malware keywords.
Detects endpoint and network activity matching known Indicators of Compromise (IOCs) associated with BPFDoor, AVERAT, and Rekoobe backdoors based on Rapid7 research. The query checks for specific file hashes, IP addresses, and domain names across process, file, image load, network, and DNS events.
Detects indicators of compromise associated with malicious Firefox wallet-clone extensions (Rabby/OKX clones) by checking for known file hashes, extension file names in Firefox profile directories, and network connections to known C2 domains and workers.dev subdomains.
Detects the PoeLLM ELF payload (masquerading as libgcrypt) via Italian-language poem/agent log strings and embedded LiteLLM MCP exploit strings
The following analytic detects file downloads that were classified as malware by Cisco Secure Firewall Threat Defense. It relies on the `SHA_Disposition` field with a value of "Malware" and includes metadata such as file name, file_hash hash, and threat classification. This analytic is critical for surfacing file-based threats that are identified via Cisco's AMP or Threat Grid integrations. If confirmed malicious, this could indicate delivery of malware.
This rule monitors endpoint telemetry (DNS queries, network connections, file creation, and process execution) to identify matches against a predefined list of known malicious indicators, including IP addresses, domains, and file hashes (SHA256). The rule differentiates between confirmed malicious activity and low-confidence indicators, providing a prioritized view of potential threats.
Detects the presence of known Candiru Windows DLL implant IOC hashes across device file events, process events, image loads, and email attachments.
Page 3 of 232