Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects network connections over port 3389 (RDP) initiated by processes other than standard Remote Desktop clients (mstsc.exe). This rule specifically looks for suspicious indicators such as execution from non-standard or temporary file paths, or the use of common living-off-the-land binaries (like powershell.exe, cmd.exe, rundll32.exe) that might be acting as a proxy for remote access or lateral movement.
This rule detects activities associated with credential dumping, specifically targeting techniques that abuse the Directory Replication Service (DRS) protocol, such as DCSync or the use of tools like secretsdump. It monitors both process execution command lines and network traffic for keywords indicative of these credential extraction behaviors, which are commonly used by attackers to obtain domain credentials.
Detects the execution of SSH or Plink processes with command-line arguments indicating local, remote, or dynamic port forwarding. Adversaries may use port forwarding to tunnel traffic through a compromised host to bypass network segment restrictions or access internal resources.
Detects the execution of specific Python scripts associated with the FortiBleed campaign. These scripts include 'spray_da.py' for domain admin password spraying, 'smb_test.py' for SMB validation and lateral movement, 'spider.py' for Active Directory crawling, and 'ad_full_audit.py' for Active Directory auditing. Detection is based on the Python interpreter executing these specific script filenames.
Detects the execution of the 'diagnose sniffer packet' command on FortiOS devices. This command can be abused by malware, such as FortigateSniffer, to intercept authentication traffic, as observed in campaigns like FortiBleed.
This rule detects suspicious activity related to high-volume Server Message Block (SMB) share enumeration and the execution of a specific Python script named 'backup_dfs.py'. It combines three detection logics: identifying processes executing 'backup_dfs.py', detecting an unusual number of SMB network connections to common administrative shares (SYSVOL, NETLOGON, DFS), and flagging high-volume SMB-related identity directory events targeting SYSVOL or NETLOGON. This behavior could indicate an adversary performing discovery of network shares, collecting data, or preparing for data exfiltration.
Identifies execution of the Windows PowerShell cradle used by GLASSWORM's WASM loader. It looks for 'irm' fetching a URL containing the specific '/win32/i/_' path structure, piped to 'iex'.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
This rule checks if a given IP address falls within the known IP ranges used by Apple's iCloud Private Relay service. It retrieves a list of IPv4 and IPv6 ranges from a GitHub repository and then uses KQL's `ipv4_is_in_any_range` and `ipv6_is_in_any_range` functions to determine if the provided IP address is part of these ranges. This can be used to identify traffic potentially obfuscated by iCloud Private Relay.
This rule detects DNS queries with suspicious characteristics that may indicate DNS tunneling, data exfiltration, or command and control activity. It identifies queries with unusually long names, long first labels combined with high entropy, or a high number of subdomains combined with a long first label. Exclusions are made for common legitimate DNS suffixes and specific service-related domains.
Detects a single host serving materially different status codes, body sizes, or redirects to automated user agents (bots, crawlers, scanners, curl, wget, headless browsers, python, go-http) compared to normal browsers. This behavior can indicate an Adversary-in-the-Middle (AiTM) attack where the adversary is attempting to serve different content to different user agents to evade detection or deliver malicious payloads.
Identifies outbound C2 connections to domains generated by MLTBackdoor DGA.
Detects EvilTokens phishing kit gate check requests to /api/device/gate/ used to identify and burn phishing pages for security researchers
This rule detects potential cleartext leakage of usernames and passwords over FTP (port 21) by identifying HTTP requests containing common credential-related keywords in the URL, while explicitly excluding HTTPS traffic. This could indicate sensitive information being transmitted insecurely.
Detects anomalous web session traffic that proxies enterprise authorization endpoints (e.g., oauth, saml, login) while simultaneously interacting with session-related cookies. This behavior is indicative of an Adversary-in-the-Middle (AiTM) proxy setup used to capture session tokens and bypass authentication.
This rule detects outgoing network connections from the IIS worker process (w3wp.exe) to public-facing URLs that match common Microsoft Office WOPI (Web Application Open Platform Interface) request patterns, but are directed to domains other than trusted Microsoft-affiliated infrastructure. This behavior can be indicative of a Server-Side Request Forgery (SSRF) attempt, where an attacker tries to coerce the server into making unauthorized requests to external resources.
This rule detects network connections over WinRM ports (5985, 5986) originating from potentially suspicious processes that are not standard Windows remote management binaries. It explicitly identifies activity where SharePoint-related processes initiate WinRM, which may indicate lateral movement patterns such as those seen in activity attributed to Storm-2603.
This rule detects network connections over WinRM ports (5985, 5986) originating from potentially suspicious processes that are not standard Windows remote management binaries. It explicitly identifies activity where SharePoint-related processes initiate WinRM, which may indicate lateral movement patterns such as those seen in activity attributed to Storm-2603.
This rule detects network communication (connections, DNS queries, or proxy logs) between endpoints and a list of known malicious domains and IP addresses associated with Mistic and Woodgnat/KongTuke threat families. It identifies these activities across network event logs, DNS queries, and security logs.
Detects unusually fast response times for FTP LIST commands, which could indicate an automated or programmatic interaction with an FTP server, potentially related to a vulnerability exploitation or data exfiltration attempt. The rule specifically looks for network events on port 21 (FTP) where the URL contains 'LIST' and the response time is less than 100 milliseconds.
Page 113 of 246