Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Advanced detection correlating RuntimeHost.exe spawning suspended InstallUtil.exe to inject miner. This rule specifically looks for 'RuntimeHost.exe' initiating 'InstallUtil.exe' without command-line arguments, followed by network activity from the 'InstallUtil.exe' process, indicating potential process hollowing and cryptojacking.
Correlates a PDF reader (Adobe, Foxit) executing a native network utility (cURL, certutil) to fetch a secondary payload, indicative of malicious PDF links or exploits.
This rule detects potential AI-obfuscated phishing attempts by correlating the launch of a local HTML file (likely from an email attachment or download) with immediate network connections to highly randomized or AI-generated subdomains. These subdomains are often used to host Adversary-in-The-Middle (AiTM) proxies or credential POST endpoints in sophisticated phishing campaigns.
Correlates the execution of the initial dropper script (setup.cjs) to the hardcoded C2 IPs, indicating potential compromise by the Mastra NPM malware.
Detects pages impersonating IT support staff for social engineering attacks
Detects network connections to known REvil ransomware domains
Detects access to Kubernetes secret objects containing sensitive configuration data
Detects repeated SSH authentication failures indicating brute force
Detects WinRM remote management used for lateral movement
Detects enabling of ESXi host shell via vSphere API for remote execution
Detects LDAP queries enumerating user accounts in Active Directory
Identifies network attempts to communicate with the vulnerable AutoGen Studio MCP WebSocket endpoint using the exploited server_params parameter, indicating potential exploitation of the AutoJack vulnerability.
This rule detects potential session token leakage through network proxy responses. It specifically looks for network events where the action type is 'NetworkSignatureInspected', the remote port is 21 (commonly FTP), and the remote URL contains keywords indicative of session tokens such as 'session', 'cookie', 'JSESSIONID', 'PHPSESSID', or 'ASP.NET_SessionId'. This could indicate a vulnerability where session information is inadvertently exposed in proxy logs or network traffic.
This rule detects network connections where the remote URL contains keywords commonly associated with financial transactions or sensitive financial information, such as 'neft', 'rtgs', 'imps', 'gst', 'pan', and 'ifsc'. This could indicate data exfiltration, unauthorized access to financial systems, or other malicious activities targeting financial data.
This rule detects attempts to extract authorization headers (Bearer, Basic, or X-API-Key) over FTP (port 21) by inspecting network signatures. This could indicate an attempt to exploit a vulnerability or misconfiguration where sensitive credentials are being transmitted in an insecure manner.
This rule detects network connections on port 21 (FTP) where the remote URL contains keywords indicative of NetWare directory listings or related services (netware, NDS, bindery, ncf). This could indicate an attempt to discover or interact with NetWare services, potentially exploiting vulnerabilities like Squidbleed.
Detects web requests containing the custom X-Antibot-Token header utilized by EvilToken proxies, indicating potential malicious activity related to AI-enabled device code phishing campaigns.
Detects unusual FTP command sequences where common file listing commands (LIST, NLST, MLSD) are used without specifying a filename parameter, and the RemoteUrl length is unusually short, potentially indicating reconnaissance or an attempt to exploit a vulnerability like Squidbleed. The rule specifically excludes common file extensions to reduce false positives.
This rule detects network connections from devices to a list of known malicious domains. These domains are associated with various threats including phishing, C2 beacons, data exfiltration, ransomware, cryptominers, and credential harvesting. The rule aggregates connections by remote URL and time, flagging any domain with at least one connection.
Detects bulk Azure AD group membership enumeration via Graph API
Detects Sliver C2 framework based on default TLS certificate
Page 132 of 246