Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects a proxy process constructing forwarder-client identifiers and asynchronous queues for bidirectional web socket tunnelling, indicative of WormSocket or similar malware activity.
Detects a non-OneDrive client invoking createUploadSession after creating staged command output or archives, indicative of GraphWorm activity.
Detects Graph API or SharePoint activity interacting with specific lists or a site GUID used by the jupyter-powerdev backdoor for Command and Control (C2) operations. This activity is indicative of the jupyter-powerdev malware leveraging SharePoint as a C2 channel.
Detects the Gamaredon implant executing DNS resolution checks through the public proxy utility check-host.net to map active fast flux IPs. This activity is initiated by wscript.exe or mshta.exe.
This rule detects consecutive TLS application data records with 32-byte encrypted payloads. This specific record pattern has been observed during AsyncRAT encrypted communication. The rule is port-independent and serves as a supporting indicator for AsyncRAT activity, rather than a standalone high-confidence signature.
Detects the execution of the Chisel client establishing a reverse SOCKS tunnel with authentication. This activity is often associated with adversaries using Chisel for command and control or data exfiltration.
Detects deletion of MFA configurations to enable authentication bypass
Detects attempts to discover CDN origin servers to bypass WAF protection
Uses regex to identify CastleLoader's highly specific URI structure, which utilizes hardcoded UUIDs mapped to t#, scr#, or callback# task endpoints.
Detects Kerberos realm trust discovery queries
Detects phishing links delivered through URL shortening services
Detects WinRM remote management used for lateral movement
Detects unusual connections from IT subnets to known OT/ICS protocol ports (Modbus:502, DNP3:20000, EtherNet/IP:44818, S7Comm:102, OPC UA:4840, IEC 60870-5-104:2404, BACnet/IP:18245) within private IP ranges. This rule specifically looks for a high volume of connections (more than 5) from a single source IP to different destination IPs on these OT ports, excluding traffic from Rockwell devices, which might indicate lateral movement or reconnaissance by threat actors like TheGentlemen, who have historically targeted OT environments.
Detects abuse of Active Directory Certificate Services for credential forgery
Detects instances where 'Cursor.exe' initiates a process that attempts to download content from the internet using common command-line tools like cmd.exe, powershell.exe, curl.exe, wget.exe, certutil.exe, or bitsadmin.exe. This behavior can indicate malicious activity, such as malware downloading additional stages or tools.
This rule detects successful network connections to remote URLs associated with AlphV/BlackCat ransomware, including payment sites. It specifically looks for 'alphv', 'blackcat', 'noname', or 'ransom-payment' within the RemoteUrl field of DeviceNetworkEvents.
Detects network connections to URLs associated with the REvil ransomware family, including its payment and drop sites. This rule specifically looks for successful network connections.
Detects suspicious activity involving the upload of multiple unique packages to common CI/CD package repositories (like npmjs, pypi, Artifactory, Nexus, Maven) from a single device within a short timeframe. This could indicate a compromised build server or developer account attempting to inject malicious dependencies into the software supply chain.
Detects Telnet access to network devices for infrastructure compromise
Detects a high volume of successful network connections to multiple unique cloud storage services (Dropbox, Box.com, OneDrive) from a single device and user account within an hour. This could indicate data exfiltration or unauthorized access to cloud storage.
Detects endpoint connections to infrastructure utilized by SmartApeSG after compromising the Okendo Reviews widget. Specifically, this rule looks for network connections to the domains 'api.wigetticks.com' and 'api.wizzleticks.com', which have been associated with the SmartApeSG supply chain attack targeting the Okendo Reviews widget.
Page 137 of 246