Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects enumeration of domain trusts via LDAP queries
Detects internal spearphishing emails used to spread within an organization
Detects the creation of specific suspicious files (result.dll, KKN, ND8) in the C:\ProgramData directory, immediately followed by a network connection to known malicious IP addresses. This pattern is indicative of malware dropping and subsequent command and control communication.
Detects use of Telegram Bot API for bidirectional C2 communications
Detects drive-by download via malicious advertisement networks
Detection of persistent WebSocket connections using libwebsockets to C2.
Detects curl.exe exfiltrating screenshots to .onion domains via proxy.
Detects serialized system metadata being transmitted on port 8443 by MsBuild.
Detects the hollowed MsBuild.exe making POST requests to data-harvesting endpoints.
Detects network connections to 'bsc-testnet.drpc.org', which has been associated with ClearFake and Etherhiding malware campaigns. This domain is used for command and control or data exfiltration related to these threats.
Detects requests to ErrTraffic's /api/index.php endpoint, which is known to be used for delivering dynamic payloads. This rule specifically looks for the query parameter '?a=ctx'.
Detects non-Discord processes downloading from Discord CDN attachment endpoints (cdn.discordapp.com/attachments or media.discordapp.net). This activity is often associated with malware families like Lumma and AsyncRAT using Discord CDN to host and deliver stage-2 payloads.
This rule detects instances where 'wscript.exe' or 'cscript.exe' (VBScript interpreters) initiate processes that attempt to download files from the internet (HTTP, HTTPS, FTP) or from network shares, or execute common system utilities often used for file transfer or execution like 'net.exe', 'certutil.exe', or 'bitsadmin.exe'. This pattern is indicative of multi-stage VBScript loaders often used in phishing campaigns to retrieve and execute further malicious payloads.
Detects suspicious AWS Lambda function invocations
Detects ARP poisoning via gratuitous ARP responses for MITM attacks
Detects exploitation of application vulnerabilities for denial of service
Detects bulk Azure AD user account enumeration via Graph API
Detects repeated SSH authentication failures indicating brute force
Udm Mail Raw Ip Https
YARA-L
This rule detects network connections made by processes commonly associated with mail collection, archiving, or data export (e.g., mail, archive, collector, export, rclone, winscp, curl executables). The detection specifically looks for these processes making HTTPS connections where the command line contains keywords related to email data files (.pst, .ost) or email processing (aspose.email, mailbox). The rule aims to identify potential exfiltration or collection of email data over HTTPS.
This rule detects unauthenticated POST requests to Serv-U that utilize 'deflate' content encoding, as described in a vendor advisory. It aims to identify exploitation attempts related to CVE-2026-28318 by filtering network events for specific HTTP POST request patterns. The XQL view retains actor and causality fields to aid in investigation.
This rule detects attempts at path traversal within JRPC (JSON-RPC or RPC) requests targeting FortiSandbox, including plain, encoded, double-encoded, and mixed-separator path traversal patterns. It focuses on network events and provides causality fields for investigation.
Page 135 of 246