Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects high-volume use of AI APIs potentially for generating attack content
Detects unauthenticated access to Docker daemon API for container escape
Detects forged Golden SAML tokens used for identity federation bypass
Detects bulk file reading from network shares for data collection
Detects bulk scraping of LinkedIn company profiles for employee intelligence
Detects cloud services being used to move laterally between cloud resources
Detects Sliver C2 framework based on default TLS certificate
Detects exploitation of Kerberos protocol for credential theft
Detects bulk Azure AD group membership enumeration via Graph API
Detects high-volume POST requests to login forms indicating credential harvesting
This rule detects network traffic containing keywords commonly associated with Indian payment gateways and financial transactions (NEFT, RTGS, IMPS, GST, PAN, IFSC). This could indicate data exfiltration or suspicious activity involving financial information, potentially related to malware like Remcos RAT.
Detects unexpected processes requesting AWS IMDSv2 tokens from the link-local address 169.254.169.254. This activity can indicate an attempt to steal temporary cloud credentials from compromised EC2 instances, as seen with malware like Miasma.
Detects unusual processes querying the AWS ECS metadata endpoint (169.254.170.2) to harvest container-level IAM roles and secrets. This rule specifically looks for network connections to the ECS metadata endpoint from processes commonly used for scripting or data transfer, such as node, bun, curl, and wget.
Detects a non-OneDrive process creating files, result, and job subdirectories associated with cloud-hosted tasking, indicative of GraphWorm or similar malware activity leveraging OneDrive for command and control or data staging.
Detects processes making network requests to the '/cf.js' endpoint, which is indicative of ErrTraffic activity. This rule specifically looks for network events where the remote URL ends with '/cf.js'.
Detects notepad.exe spawned by explorer.exe that immediately initiates network connections, which is a known behavior of Brute Ratel C4 (BRc4) when performing Parent PID Spoofing.
Detects network connections specifically targeting the /tasks/get_worker endpoint used by RMMProject, initiated by 'RunSearch.exe'. This activity could indicate an adversary utilizing or masquerading as RMMProject for tasking and control.
Detects the Cloudflared tunnel binary being renamed to svchost.exe and then used to establish a tunnel. This is indicated by the process name being 'svchost.exe' and the command line containing 'tunnel', '--url', and '--no-autoupdate'. This technique is often used by adversaries to masquerade malicious activity as legitimate system processes.
Identifies network connections to specific Azure-hosted authentication brokers used by the jupyter-powerdev malware to retrieve Graph API tokens for its SharePoint C2 channel. This rule specifically looks for connections to known malicious broker domains or a known associated IP address.
Inspects network connection URIs for the SKS= or MAP= parameters, which are used by the Showboat malware to initialize proxy tunnels. This rule specifically looks for these parameters in HTTP connection events.
Tracks processes (specifically hollowed svchost) generating high-volume, long-duration network sessions over port 4444, characteristic of Showboat's internal SOCKS5/Portmap routing.
Page 141 of 246