Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects ARP cache poisoning attacks used for man-in-the-middle credential interception
Detects use of forged web credentials for unauthorized application access
Detects upload of offensive security tools to cloud storage for staging
Detects downloads of typosquatted packages from npm or PyPI
Detects bulk registry queries over SMB for system discovery
Detects fingerprinting of web application CMS versions for vulnerability research
Detects phishing links with credential harvesting redirects
Detects Kerberos realm trust discovery queries
Detects suspicious AWS Lambda function invocations
Detects attempts to discover CDN origin servers to bypass WAF protection
Detects bulk file reading from network shares for data collection
Detects downloads of typosquatted packages from npm or PyPI
Detects fingerprinting of web application CMS versions for vulnerability research
Detects phishing links with credential harvesting redirects
Detects exploitation of Kerberos protocol for credential theft
Detects the execution of known Living-off-the-Land Binaries (LOLBins) such as certutil.exe, msiexec.exe, regsvcs.exe, and regasm.exe when their command line contains suspicious keywords like 'download', 'http', or 'encode'. This activity can indicate an attempt to download malicious payloads or bypass security controls.
This rule detects Bluetooth Object Exchange (OBEX) Protocol data transfer activity on TCP port 3232. The rule is configured to alert when five such data transfers are observed from the same source IP within a 60-second window, indicating potential exfiltration or unauthorized data movement over Bluetooth.
SniperDz Domain IOCs
Cortex XDR
Detects network connections or DNS queries to known domain names associated with the SniperDz core monetization and redirection infrastructure. This rule specifically looks for traffic to 'win.feezossl.xyz', 'win.anababayala.com', 'aff.bnaosf1he.shop', and 'offer.raviral.com' in DNS query names or HTTP network metadata.
This rule detects NBT-NS (NetBIOS Name Service) poisoning responses. NBT-NS poisoning is a technique used by attackers to intercept network traffic by responding to NetBIOS name queries with their own IP address, effectively redirecting traffic. The rule specifically looks for UDP traffic on port 137 (NetBIOS Name Service) destined for the home network, containing the byte sequence '|85 00|' at a depth of 4 bytes, which is indicative of a NetBIOS Name Service response. A threshold of 5 such responses within 10 seconds from the same source IP triggers the alert, aiming to reduce false positives from legitimate, but infrequent, NBT-NS responses.
Detects hidden iframes used for drive-by download attacks
Detects enabling of reversible password encryption in Active Directory
Page 143 of 246