Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,459
11,842
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule monitors for various types of events (user logons, network connections, API audits, cloud app events, and email traffic) originating from a specific CIDR block (160.79.104.0/21), which is flagged as suspicious or unauthorized.
This rule detects various event types (email, identity authentication, network connections, and cloud audit logs) originating from or interacting with the specific IP address range 160.79.104.0/22 to 160.79.111.0/22, which is associated with known malicious activity.
This rule detects potential Command and Control (C2) beaconing activity by identifying periodic outbound network connections from suspicious or non-browser processes. It analyzes the time deltas between successful network connections; if the standard deviation of these intervals is low (indicating consistent timing) and a sufficient number of connections occur, it flags the behavior as a potential C2 heartbeat.
Detects network connections from Windows hosts to known IP addresses and domain names associated with the exploitation infrastructure used in CVE-2026-18577, targeting N-able N-central servers.
This rule detects potential automated web scraping activity by identifying high-volume, repetitive network requests directed towards domains identified as government (.gov) or military (.mil). It correlates these network patterns with the execution of common browser automation frameworks (e.g., Puppeteer, Playwright) or headless browsers, indicating a likely coordinated scraping operation or bot activity.
This rule detects potential automated web scraping activity by identifying high-volume, repetitive network requests directed towards domains identified as government (.gov) or military (.mil). It correlates these network patterns with the execution of common browser automation frameworks (e.g., Puppeteer, Playwright) or headless browsers, indicating a likely coordinated scraping operation or bot activity.
This rule detects potential automated web scraping activity by identifying high-volume, repetitive network requests directed towards domains identified as government (.gov) or military (.mil). It correlates these network patterns with the execution of common browser automation frameworks (e.g., Puppeteer, Playwright) or headless browsers, indicating a likely coordinated scraping operation or bot activity.
Bigbear V2 Ioc Hunt
Sigma
CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. The investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure, and thousands of stolen credentials and session cookies, revealing how modern AiTM attacks can hijack authenticated sessions even after MFA.
Bigbear V2 Ioc Hunt
Sigma
CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. The investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure, and thousands of stolen credentials and session cookies, revealing how modern AiTM attacks can hijack authenticated sessions even after MFA.
CloudSEK researchers uncovered BigBear 2.0, a global Microsoft 365 phishing-as-a-service operation targeting hundreds of organizations across 40+ countries. The investigation exposed the attacker’s admin panel, affiliate network, phishing infrastructure, and thousands of stolen credentials and session cookies, revealing how modern AiTM attacks can hijack authenticated sessions even after MFA.
Detects network, HTTP, and DNS activity associated with the known three-tier delivery infrastructure (phishing sites, relay/dispatcher servers, and payload hosts) used by the threat actor UNC6671/SilverFox/Aurora. The rule distinguishes between high-confidence confirmed connections and low-confidence DNS-only events.
Detects network, HTTP, and DNS activity associated with the known three-tier delivery infrastructure (phishing sites, relay/dispatcher servers, and payload hosts) used by the threat actor UNC6671/SilverFox/Aurora. The rule distinguishes between high-confidence confirmed connections and low-confidence DNS-only events.
This rule detects attempts to download known malicious NPM packages from the public npm registry (registry.npmjs.org) by monitoring network connection logs. It specifically looks for tarball (.tgz) downloads of packages and versions that have been identified as compromised or malicious. The rule extracts the package name and version from the download URL and compares it against a predefined list of malicious packages for high-fidelity detection.
Detects network requests targeting Dahua devices that attempt to exploit CVE-2021-33044. The exploitation involves sending a crafted 'global.login' RPC call with specific parameters (clientType 'NetKeyboard', loginType 'Direct', authorityType 'Default') to bypass authentication and retrieve administrative session tokens.
Detects country-coded lure path requests (/eg, /ma) followed by a cloaking differential response (desktop UA blocked with 404, mobile UA served content). Fixed a regex bug where the original pattern matched any path merely starting with 'eg' or 'ma' (e.g. /egg.jpg, /mail, /manifest.json) instead of the exact path segment.
This rule monitors network traffic from internal devices and security logs for communication with a curated list of known malicious or suspicious scanner IP addresses, indicating potential reconnaissance or probing activity by external actors.
This rule monitors network traffic from internal devices and security logs for communication with a curated list of known malicious or suspicious scanner IP addresses, indicating potential reconnaissance or probing activity by external actors.
This rule monitors TLS traffic for a specific combination of certificate issuer Common Name (CN) matching 'YE1' and Server Name Indication (SNI) hostnames using known disposable or high-risk top-level domains (TLDs). This behavior is associated with the IronToll campaign, often indicative of command-and-control communication or malicious infrastructure staging.
This rule monitors TLS traffic for a specific combination of certificate issuer Common Name (CN) matching 'YE1' and Server Name Indication (SNI) hostnames using known disposable or high-risk top-level domains (TLDs). This behavior is associated with the IronToll campaign, often indicative of command-and-control communication or malicious infrastructure staging.
Detects anomalous outbound HTTP traffic directed to /cli/check containing a specific 'X-CLI-Token' header value. This pattern is indicative of a Command and Control (C2) beaconing mechanism used by a compromised CLI tool or supply chain implant to verify connectivity or receive instructions.
Detects OAuth2 JWT bearer-grant token requests to Google's OAuth endpoint using the attacker-controlled service-account identity and Sheets API scope observed in the fake GlobalProtect campaign
Page 72 of 246