Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects automated bulk account registration for establishing fake identities
Detects domain fronting technique to hide C2 behind CDN providers
Detects phishing links delivered through URL shortening services
Detects use of WHOIS web services for domain property enumeration
Detects access to Kubernetes secret objects containing sensitive configuration data
Detects forged Golden SAML tokens used for identity federation bypass
Detects active development and probing behavior by a VAPT tool using embedded test strings ("MediaVault Asset Portal" and "Reverb Studio") against local networks. This rule looks for these specific strings within network event fields like 'AdditionalFields' or 'RemoteUrl'.
Correlates a script connecting to an LLM API and immediately piping the response or executing rapid shell commands (cmd/bash) representing AI-generated reconnaissance or exploit execution.
Detects Kazuar executing process hollowing into legitimate Windows binaries like taskhostw.exe to blend in with normal OS behavior. This rule specifically looks for instances where 'taskhostw.exe' is the target process but its command line does not contain 'taskhostw.exe', indicating a potential suspended or hollowed launch, combined with network activity originating from that process.
Correlates the targeted reading of USERDNSDOMAIN and COMPUTERNAME environment variables with network connections to a known malicious domain (kleymarket.ru), indicating potential data exfiltration by the Silent Rotor malware.
Detects several related module processes on one host while a single process accounts for all external network connections. This behavior is indicative of the Kazuar malware, which uses a botnet-like structure where one 'leader' process handles C2 communications.
Detects an executable, which is not an internet browser or known application, initiating network connections to legit popular websites, which were seen to be used as dead drop resolvers in previous attacks.
In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.
In this context attackers leverage known websites such as "facebook", "youtube", etc. In order to pass through undetected.
Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.
Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.
Detects PowerShell connecting to an IP to download an image file containing embedded Base64 markers (<<BASE64_START>>). This behavior is associated with the Vidar stealer, which uses steganography to hide its payload within image files.
Detects Python executing a compiled Python file (.pyc) with PySoxy SSL arguments, indicating potential SOCKS proxy activity over SSL.
Detects msiexec.exe silently downloading and installing an MSI payload from an external URL. This behavior is often indicative of malicious activity where an attacker uses msiexec to fetch and execute a malicious installer without user interaction.
Detects the execution of Python with the '-remote_port' command-line argument, which is indicative of a SOCKS proxy tunnel being established, potentially by PySoxy or similar tools.
This rule detects network connections to known dead drop resolver domains (letsdiskuss.com or digitalpoint.com) that originate from processes other than common web browsers (Chrome, Edge, Firefox, Internet Explorer). This behavior is indicative of command and control (C2) activity where malware uses legitimate web services to retrieve further instructions or C2 infrastructure details.
Detects repeated HTTP PUT operations targeting the Ghost CMS admin API for post updates. This rule focuses on network connections or process command lines indicating such activity, retaining principal and target context for further correlation. This activity could be indicative of exploitation of vulnerabilities like CVE-2026-26980, leading to mass compromise and content manipulation.
Detects Server-Side Request Forgery (SSRF) attempts targeting Cisco WebDialer by identifying network connections or process command lines that include WebDialer and attempt to access loopback addresses (127.0.0.1, localhost, ::1), link-local addresses (169.254.169.254), private IP ranges (10.0.0.0/8, 192.168.0.0/16, 172.16.0.0/12), or 'file://' and 'gopher://' schemes. This rule leverages UDM for principal and target context.
Page 138 of 246