Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects suspicious network connections or process activity targeting Discord webhooks or API endpoints, potentially indicating data exfiltration, command and control, or token validation by malicious actors. The rule specifically looks for non-Discord processes making these connections or using suspicious user agents.
Detects the execution of specific Python scripts associated with the FortiBleed campaign. These scripts include 'spray_da.py' for domain admin password spraying, 'smb_test.py' for SMB validation and lateral movement, 'spider.py' for Active Directory crawling, and 'ad_full_audit.py' for Active Directory auditing. Detection is based on the Python interpreter executing these specific script filenames.
Detects script content that invokes 'mshta.exe' from the 'SysWOW64' directory to access a remote resource ending with '.7z' via HTTP or HTTPS. This pattern is associated with the Animateclipper malware, which uses MSHTA for initial access or execution of malicious scripts.
This rule detects network connections or DNS queries related to the TON blockchain ecosystem, specifically targeting domains and API endpoints associated with TON network infrastructure. These communication patterns may indicate interaction with cryptocurrency-related services or potential malware utilizing TON-based infrastructure for command and control or data exfiltration.
This rule detects rapid scanning of local network subnets on SMB (port 445) and RDP (port 3389) by a single process on a device. It identifies instances where a process initiates connections to more than 20 unique local IP addresses within a one-minute window, which could indicate an attempt by ransomware, such as Nightspire, to identify adjacent victims for propagation prior to local encryption.
This rule detects network events where a device attempts to access the Kubernetes API '/api/v1/namespaces/*/secrets' endpoint. This activity could indicate an attempt to enumerate or exfiltrate sensitive information (secrets) stored within Kubernetes, potentially by an attacker who has gained initial access to a pod or compromised a service account.
Detects potential exploitation of the Zerologon vulnerability (CVE-2020-1472) by identifying a high volume of Netlogon authentication requests followed by a successful login by a Domain Admin, indicating a machine account password reset attack.
This rule detects potentially malicious search queries within Microsoft 365 network traffic. It monitors HTTP headers and request bodies for search parameters that contain common web injection markers, such as script, img, or svg tags, and other suspicious keywords indicative of attempted Cross-Site Scripting (XSS) or search-based exploitation.
Detects suspicious network traffic potentially associated with BeePRAT malware, identified by specific process image paths in temporary or TCC-related directories, connections to known malicious C2 IP addresses/ports, or non-standard TCP communication patterns involving suspicious domain queries.
Detects network activity associated with the Djinn Stealer malware, including connections to a known C2 IP address/port, the use of a specific 'telemetry-client/1.0' user agent, or HTTP POST requests to 'application/octet-stream' endpoints originating from suspicious parent processes such as SimpleHelp or TaskWeaver.
This rule monitors network traffic for the presence of the 'X-WebAuth-User' HTTP header, which is often used in authentication bypass scenarios. The rule specifically alerts when this header is present, especially if the username injected is 'admin', potentially indicating an attempt to impersonate a user or bypass authentication controls on exposed web services or proxy configurations.
Detects execution of the SharpADWS utility or anomalous network connections to the Active Directory Web Services port (9389) that are not initiated by legitimate processes such as lsass.exe, svchost.exe, or the legitimate Microsoft.ActiveDirectory.WebServices.exe binary.
Detects HTTP GET requests to the /api/device/gate/ path, a specific behavior associated with EvilTokens phishing kits. Attackers use this gate check endpoint to identify and potentially burn active phishing sessions for security researchers or automated scanners.
This rule detects network events where the 'AdditionalFields' contain keywords commonly associated with Multi-Factor Authentication (MFA) such as 'otp', 'verify', '2fa', or 'mfa', and the 'RemoteIP' is a valid IPv4 address. This could indicate attempts to interact with, or potentially bypass, MFA mechanisms.
This rule monitors DNS query events for domains known to be associated with phishing campaigns, specifically those spoofing Microsoft or other common service brands. These domains are frequently used in credential harvesting attacks to lure users to malicious landing pages.
Detects network activity and command line execution associated with known malicious browser extensions, specifically targeting AdBlock for Youtube-related extensions and associated command-and-control infrastructure.
Detects credential abuse patterns from FortiGate logs including administrative changes, tunneling activity, and anomalous source-IP behavior.
Detects network connections to known IP addresses associated with FortiBleed activity, including C2, pentest labs, credential validation, and sniffer nodes. This rule helps identify potential compromise or reconnaissance related to the FortiBleed vulnerability.
Detects domain account authentication anomalies over SMB from external sources
Detects cloud console credential spraying from suspicious IP addresses
Detects enumeration of email accounts via Exchange Web Services
Page 101 of 246