Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects DNS queries for domains that exhibit characteristics of Domain Generation Algorithms (DGAs). Specifically, it looks for DNS queries where the queried domain consists of a random-looking subdomain (12 to 24 lowercase alphanumeric characters) followed by common top-level domains such as .com, .net, .org, .info, or .biz. The rule uses a thresholding mechanism to trigger an alert if 10 such queries are observed from the same source IP within a 60-second window, indicating potential DGA activity often associated with botnets or malware for command and control.
This rule detects network connections initiated by VBScript (wscript.exe or cscript.exe) to external IP addresses. This behavior can be indicative of malicious VBScript execution attempting to communicate with command and control servers or exfiltrate data, often associated with phishing attacks.
This rule monitors for suspicious activity originating from the DHCP Client service process (svchost.exe running with 'Dhcp' in the command line). It detects unauthorized child processes (such as cmd.exe or powershell.exe), unexpected child processes that deviate from established baselines, service crashes potentially indicative of exploitation, and anomalous network connections to non-standard DHCP ports or external IP addresses.
This rule detects communication patterns indicative of the ErrTraffic webshell by searching for specific parameters ('wp_debug_session=' and 'mode=php') within web server URI/URL fields. The presence of these parameters suggests an active webshell connection, likely used for remote access and command execution on a compromised web server.
This rule detects internal HTTP PUT requests that contain the 'MZ' header, which is indicative of an executable file. This combination suggests a possible lateral movement scenario where an attacker is transferring a tool or malware within the internal network using HTTP PUT.
This rule detects potential mass email collection activity over IMAP (port 143). It triggers when a client sends a 'FETCH' command followed by 'BODY[]' content at least 20 times within 60 seconds from the same source IP address. This behavior is indicative of an adversary attempting to download a large number of email bodies, which is a common method for email collection.
This rule detects network connections to known IP addresses associated with FortiBleed activity, including C2, pentest labs, credential validation, and sniffer nodes. It identifies both successful connections and connection attempts.
Detects unusually fast response times for FTP LIST commands, which could indicate an automated or programmatic interaction with an FTP server, potentially related to a vulnerability exploitation or data exfiltration attempt. The rule specifically looks for network events on port 21 (FTP) where the URL contains 'LIST' and the response time is less than 100 milliseconds.
This rule detects network events originating from 'squid.exe' that involve DNS query responses or network signature inspections, specifically looking for reverse DNS lookups to an IPv4 address. This could indicate attempts to resolve IP addresses back to hostnames, potentially for reconnaissance or C2 communication.
Detects network events where FTP (port 21) traffic contains specific timestamp-like patterns in the RemoteUrl, which could indicate an attempt to exploit the Squidbleed vulnerability related to timestamp-to-filename parsing anomalies. The rule looks for 'LIST' command combined with '12:34:56', '2026-', or 'timestamp' in the URL.
Detects suspicious process command lines associated with WebRTC, STUN, TURN, or ICE protocols when initiated by common web browsers (Chrome, Firefox, Opera) and having a parent process identified as 'Remcos'. This behavior could indicate the Remcos RAT attempting to establish peer-to-peer communication or exfiltrate data.
This rule detects network activity associated with the Hashtopolis agent. Specifically, it looks for the string "hashtopolis" within the HTTP User-Agent header of traffic flowing from a client to a server. This activity is linked to the 'FortiBleed campaign', which involves distributed offline cracking of SHA-256 FortiGate administrator credential hashes.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
Detects attempts to inject shell metacharacters or command substitution into VNC-related operations, specifically targeting the 'start vnc' command within network connection URLs or process command lines. This rule aims to identify potential command injection vulnerabilities being exploited.
This rule detects potential leakage of HTTP Authorization headers (including 'Authorization', 'Basic', 'Bearer', 'Digest', and 'X-API-Key') over FTP (port 21) within network traffic. This could indicate a misconfiguration or an attempt to exfiltrate credentials or sensitive API keys in an unencrypted manner.
Detects network connections originating from a Squid proxy process (squid.exe or processes containing 'squid' in their name) attempting to connect to an FTP server (port 21). This could indicate a reachability test or other activity related to the Squidbleed vulnerability, or general proxy misuse.
This rule detects attempts to inject shell metacharacters or command substitution into JSON associated with a 'start vnc' operation within FortiSandbox. It specifically looks for patterns indicative of command injection vulnerabilities in network events, either in the event_sub_type or action_remote_ip fields. The rule aims to identify malicious activity targeting FortiSandbox, potentially leveraging a vulnerability like the one described in FG-IR-26-141.
Lateral Movement via VPN
Cortex XDR
This rule detects post-VPN activity indicative of discovery or lateral movement targeting directory services. It specifically looks for commands associated with LDAP, Kerberos, SMB, or WinRM activity to multiple internal systems, often seen after an initial VPN compromise. The rule focuses on processes like PowerShell, cmd, net, nltest, adfind, ldapsearch, wmic, and winrs executing commands related to network enumeration and directory service interaction.
This rule detects instances where mshta.exe is used to execute a remote resource with a .7z file extension. This behavior is often indicative of an adversary attempting to bypass traditional security controls by disguising malicious script content as a compressed archive, as observed in some malware distribution campaigns.
Detects the execution of newly seen binaries containing valid Digital Signatures from issuers identified in Fox Tempest's malware signing service. This rule specifically looks for process creation events where the binary has a valid digital signature and a global prevalence of less than 50, and then joins these events with network connection events from the same device, indicating execution and beaconing activity.
Identifies PDF readers spawning web browsers that navigate to intermediary Cloudflare/reCAPTCHA domains, which are often used to mask the actual phishing landing page in tax-related phishing campaigns.
Page 127 of 246