Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Correlates a delivered PDF attachment with the same user's browser visiting Mir0Auth C2-style paths within 4 hours. Restricted to browser processes and successful connections, excludes dev/code-hosting domains, and matches users by mailbox alias (DeviceInfo LoggedOnUsers holds UserName, not full email).
Detects endpoint connections to known DarkSword/Coruna exploit-host and C2 infrastructure. The shared AWS IP is only matched on C2 ports 8881/8882 to reduce collateral hits.
Unsigned LDAP Bind
Cortex XDR
Detects Lightweight Directory Access Protocol (LDAP) binds that are performed without signing or encryption. Attack tools such as NetExec, ldapdomaindump, and Impacket frequently use simple, unencrypted LDAP binds over port 389, which can result in the transmission of credentials in cleartext. This rule monitors Windows Event ID 2889 on Domain Controllers, which logs cleartext LDAP bind attempts.
This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of malware. This activity can signify possible compromised hosts on the network.
Detects a suspicious two-stage browser activity sequence where a user accesses a Maze survey-builder lure (t.maze.co) followed by a navigation to a Cloudflare Workers subdomain hosting a spoofed Microsoft Authentication device-code phishing page. This pattern is indicative of a multi-stage phishing attack aimed at credential or device token theft.
This rule monitors network traffic for communication with known malicious IP addresses (143.198.7.94 and 157.254.167.12) associated with the exploitation of NetScaler CVE-2026-88772 as part of the WHIPSHOT_SLAPSHOT campaign. These IPs are linked to staging, exploitation, and web shell backdoor installation activities.
Detects a network connection handshake indicating the use of Chisel, a fast TCP/UDP tunnel over HTTP, specifically identifying potential command-and-control beaconing activity.
Detects a network connection handshake indicating the use of Chisel, a fast TCP/UDP tunnel over HTTP, specifically identifying potential command-and-control beaconing activity.
Detects a network connection handshake indicating the use of Chisel, a fast TCP/UDP tunnel over HTTP, specifically identifying potential command-and-control beaconing activity.
This rule monitors network traffic for TLS SNI and HTTP URI indicators associated with known typo-squatted or spoofed Google Drive and Google Meet phishing domains. It also detects the download of a specific ZIP archive used as a phishing lure.
This rule monitors network traffic for TLS SNI and HTTP URI indicators associated with known typo-squatted or spoofed Google Drive and Google Meet phishing domains. It also detects the download of a specific ZIP archive used as a phishing lure.
Identifies repeated Ollama inference requests with long response times on /api/generate, /api/chat, and /v1/chat/completions.
Long response time can result from model size, prompt length, host resources, or normal workload. GIN access logs do not include prompt content and cannot establish a prompt injection or jailbreak attempt, so use this as an exploratory performance signal.
Long response time can result from model size, prompt length, host resources, or normal workload. GIN access logs do not include prompt content and cannot establish a prompt injection or jailbreak attempt, so use this as an exploratory performance signal.
Detects network activity associated with the TA419 threat group's 'Frameless' Browser-in-the-Browser (BitB) Adversary-in-the-Middle (AitM) phishing campaign. The rules identify unauthorized OAuth2 authorization requests to non-Microsoft hosts that match known malicious client IDs, the delivery of BitB overlay scripts, and the subsequent execution of malicious scripts correlated with OneDrive-themed lookalike redirects, indicating a credential theft attempt.
This rule performs a retrospective sweep for indicators of compromise (IOCs) associated with the DragonForce TURN/MQTT campaign, as detailed in Lab52 threat research. It monitors for file and process activity matching known malicious hashes, as well as network connections to specific domains and URLs associated with the campaign's command-and-control infrastructure.
Detects historical network connections, URL clicks, browser launches, email URLs, and process command lines associated with Wazza phishkit infrastructure IOCs including boegl-krysl.eu, coppietersrecherche.eu, and beacon-surge-sync.workers.dev.
Detects indicators of compromise associated with malicious Firefox wallet-clone extensions (Rabby/OKX clones) by checking for known file hashes, extension file names in Firefox profile directories, and network connections to known C2 domains and workers.dev subdomains.
Detects indicators of compromise associated with malicious Firefox wallet-clone extensions (Rabby/OKX clones) by checking for known file hashes, extension file names in Firefox profile directories, and network connections to known C2 domains and workers.dev subdomains.
Detects indicators of compromise associated with malicious Firefox wallet-clone extensions (Rabby/OKX clones) by checking for known file hashes, extension file names in Firefox profile directories, and network connections to known C2 domains and workers.dev subdomains.
This rule monitors for the presence of the PoperBlocker browser extension or network traffic directed to associated domains, which are often used by potentially unwanted programs (PUP) or adware.
Page 10 of 246