Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects potential lateral movement by monitoring successful network logons using NTLM authentication across multiple distinct destination hosts within a short time window. It calculates the frequency of connections to unique hosts to identify anomalous, rapid traversal through a network by a single user account, excluding known system accounts.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting DNS queries, TLS SNI, HTTP Host headers, and direct IP connections to known malicious infrastructure domains (cdnsuicaches.com, mnl.ac) and exfiltration endpoints (23.227.198.199).
Detects indicators associated with the exploitation of CVE-2025-3248 in Langflow. The rule identifies anomalous web requests targeting the /api/v1/validate/code endpoint, subsequent suspicious process creation (base64 encoded payloads in Python/shell), and network communication with identified command and control (C2) or data exfiltration IP addresses. It also includes alerts for observed contact with known extortion email addresses.
Detects indicators associated with the exploitation of CVE-2025-3248 in Langflow. The rule identifies anomalous web requests targeting the /api/v1/validate/code endpoint, subsequent suspicious process creation (base64 encoded payloads in Python/shell), and network communication with identified command and control (C2) or data exfiltration IP addresses. It also includes alerts for observed contact with known extortion email addresses.
Detects outbound network connections from internal devices to a set of known malicious IP addresses (45.151.45.31 and 46.166.79.31) which may indicate command and control communication or other malicious activity.
This rule monitors endpoint telemetry for known indicators of compromise associated with the Casbaneiro/Ousaban banking trojan. It identifies activity across network connections (IPs and domain patterns), DNS queries for specific C2 domains, and the presence or execution of known malicious file hashes (e.g., PDF lures, HTA, AutoIt scripts, and payload binaries).
Detects network connections or DNS queries to known suspicious domains associated with command and control infrastructure.
This rule monitors network traffic for requests directed at a specific domain ('luizestrelhashapr.online') and path ('/google_api/b83fa72d.css'), which is identified in threat intelligence as an indicator of browser history exfiltration.
Detects potential AI-targeted cloaking, a technique where a web server serves different content to AI crawlers versus human users, identified by comparing HTTP response sizes or hashes across session logs. The rule uses Microsoft Sentinel's ASIM Web Session schema to correlate web requests, identifying discrepancies that suggest malicious or evasive intent. Covers T1036 & T1027
Detects potential AI-targeted cloaking, a technique where a web server serves different content to AI crawlers versus human users, identified by comparing HTTP response sizes or hashes across session logs. The rule uses Microsoft Sentinel's ASIM Web Session schema to correlate web requests, identifying discrepancies that suggest malicious or evasive intent. Covers T1036 & T1027
Detects potential AI-targeted cloaking, a technique where a web server serves different content to AI crawlers versus human users, identified by comparing HTTP response sizes or hashes across session logs. The rule uses Microsoft Sentinel's ASIM Web Session schema to correlate web requests, identifying discrepancies that suggest malicious or evasive intent. Covers T1036 & T1027
Detects rapid, machine-speed, sequential attack-path adaptation by suspected AI agent binaries. The rule monitors for a correlation of four stages occurring within a tight 20-minute window: 1) Failed service connections across three or more distinct protocols (SMB, SSH, HTTP, RDP, WinRM), 2) Credential access attempts (Logon events or execution of known credential-dumping tools), and 3) A lateral movement pivot to a new, previously un-targeted internal destination. The rule specifically keys on the InitiatingProcessId and InitiatingProcessCreationTime to ensure the sequence is attributed to a single process instance, distinguishing it from human manual penetration testing activity. Covers T1190, T1210, T1078
Detects anomalous DNS traffic patterns indicative of command-and-control (C2) or data exfiltration over the DNS protocol. The rule identifies suspicious queries containing long, high-entropy subdomain labels that suggest payload encoding, as well as the use of TXT records for unauthorized data transmission.
Detects potential DNS tunneling or Command and Control (C2) communication patterns. The rule calculates subdomain entropy to identify unusually long or randomized subdomain labels, monitors for excessive DNS query volume per client, and flags the use of specific record types (TXT, NULL) often associated with C2 frameworks like dnscat2 or iodine.
This rule detects potential DNS tunneling activity used for Command and Control (C2). It monitors DNS query traffic for indicators such as excessively long or high-entropy subdomain labels, the use of specific record types often used in tunneling (TXT and NULL records), and high volumes of DNS requests to a single parent domain from a specific host within a 10-minute window.
This rule detects potential Device Code Phishing (OAuth 2.0 device authorization) attempts by monitoring HTTP requests to the Microsoft device authorization endpoint (login.microsoftonline.com/common/oauth2/deviceauth) that originate from a suspicious referrer domain ending in .de. This behavior is indicative of an attacker-controlled landing page directing users to authenticate their device.
This rule detects network communication patterns indicative of the Kimsuky threat group using compromised WordPress sites hosted on wasmer.app for command and control (C2). It specifically looks for established HTTP requests to the .wasmer.app domain, targeting a specific WordPress uploads path and a unique token format in the URI string.
Detects a multi-stage attack pattern against publicly exposed AI service endpoints. The detection correlates: (1) Enumeration of sensitive AI/MCP-related API endpoints (minimum 3 distinct hits) in a 10-minute window; (2) Subsequent POST requests to AI service endpoints within 15 minutes of the enumeration; and (3) A spike of 5 or more server errors (HTTP 5xx) within 10 minutes following the POST activity. This pattern suggests automated reconnaissance followed by attempted exploitation of exposed AI model interfaces or orchestration services. Covers T1595.002, T1190
Detects a multi-stage attack pattern against publicly exposed AI service endpoints. The detection correlates: (1) Enumeration of sensitive AI/MCP-related API endpoints (minimum 3 distinct hits) in a 10-minute window; (2) Subsequent POST requests to AI service endpoints within 15 minutes of the enumeration; and (3) A spike of 5 or more server errors (HTTP 5xx) within 10 minutes following the POST activity. This pattern suggests automated reconnaissance followed by attempted exploitation of exposed AI model interfaces or orchestration services. Covers T1595.002, T1190
Detects a multi-stage attack pattern against publicly exposed AI service endpoints. The detection correlates: (1) Enumeration of sensitive AI/MCP-related API endpoints (minimum 3 distinct hits) in a 10-minute window; (2) Subsequent POST requests to AI service endpoints within 15 minutes of the enumeration; and (3) A spike of 5 or more server errors (HTTP 5xx) within 10 minutes following the POST activity. This pattern suggests automated reconnaissance followed by attempted exploitation of exposed AI model interfaces or orchestration services. Covers T1595.002, T1190
Page 50 of 246