Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule monitors for internal network connection attempts initiated by the 'mcp-grafana' process to destinations it has not contacted in the previous 14 days. By establishing a baseline of legitimate data source connections, the rule alerts when the process performs a rapid fan-out or discovery against multiple new internal hosts, which may indicate unauthorized network reconnaissance or lateral movement attempts by the Grafana service.
Detects network connection attempts or established connections to a specific remote IP (103.141.13.26) on UDP port 3479. This pattern is often associated with command and control infrastructure or unauthorized data communication.
Detects network connection attempts or established connections to a specific remote IP (103.141.13.26) on UDP port 3479. This pattern is often associated with command and control infrastructure or unauthorized data communication.
This rule detects outbound connections from internal devices to domains and IP addresses linked to the “SysScan” fake Microsoft security scanner campaign. These connections may indicate exposure to malicious infrastructure used for tricking victims into disabling legitimate antivirus solutions, as reported in recent threat intelligence.
Detects network-based command signaling shared by the Fire Ant/REPTILE-derivative backdoor and its reverse-tunneling implant capability. Identifies the 'magic string' activation sequence and matching 'kill marker' termination sequence over TCP and UDP — indicative of packet-triggered backdoor activation, port-knocking style C2, or reverse-tunnel establishment via raw socket communication.
Detects network activity initiated by the QUICAgent backdoor (Windowsupdate.exe), which is utilized for file exfiltration and payload delivery. The detection is triggered by identifying the specific file name 'Windowsupdate.exe' in conjunction with the known malicious SHA-256 hash associated with this backdoor.
Detects network traffic within the internal network that matches the initial handshake phase of a SOCKS proxy connection. This is a common indicator of an attacker using an internal system to proxy command and control (C2) traffic or pivot within the network using tools like HTRAN, ZXProxy, or custom implementations.
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Detects requests for files with names suggesting sensitive content (password, secret, apikey, etc.).
This rule detects OAuth authorization requests (targeting Microsoft or Google identity providers) that use 'prompt=none' (silent authentication) and redirect the user to an unexpected or untrusted domain. This pattern is commonly used in OAuth consent phishing or token theft attacks, where an attacker attempts to silently acquire an authorization code by redirecting it to a malicious application server instead of the legitimate service provider's domain.
This rule detects a multi-stage attack pattern associated with Akira ransomware, including AD enumeration using PowerShell, data staging with WinRAR, S3 exfiltration via s5cmd, AnyDesk service installation, registry manipulation for persistence via Safe Mode, and boot configuration changes to facilitate EDR bypass. It also incorporates detection for specific IOCs like attacker jump host RDP connections and malicious file hashes.
This rule detects command and control (C2) communication patterns utilized by the GoCaracal malware family, specifically its fallback mechanism which leverages Ethereum blockchain RPC calls (eth_getStorageAt) to interact with known malicious smart contracts or wallet addresses.
Detects S7comm protocol network connections (default port 102) initiated outside of standard business hours (06:00 to 18:00). S7comm is the proprietary protocol used by Siemens S7 PLCs; unauthorized or anomalous interaction with these devices, especially during off-hours, may indicate reconnaissance or manipulation of industrial control systems.
Detects network connections using the S7comm protocol (port 102) targeting Programmable Logic Controllers (PLCs) originating from IP addresses not present in the defined allowlist of authorized engineering workstations. This behavior may indicate unauthorized access, reconnaissance, or malicious activity within an Industrial Control System (ICS) environment.
Detects potential exploitation or unauthorized discovery of Programmable Logic Controllers (PLCs) by identifying the use of default SNMP community strings or unauthenticated S7comm protocol sessions.
Detects the ERAAgent.exe process creating raw sockets (SOCK_RAW) and enabling promiscuous mode (SIO_RCVALL) on a non-loopback interface while lacking corresponding listening port activity. This behavior is indicative of passive magic-packet sniffing, often associated with the SLEEPWALKER backdoor/trojan.
CVE-2026-65400 affects the macOS Screen Sharing service and can allow an attacker on the network to authenticate without valid credentials. Huntress' research goes further, describing the pre-authentication path and opportunities to obtain root-level file access and ultimately code execution. First thing first: patch. Update affected devices to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9. Apple released these versions on August 6 to address CVE-2026-65400. If patching is not immediately possible, disable Screen Sharing. After patching, we still need to answer the hunter's question: was any of this activity already happening before the update? The KQL below hunts across Microsoft Defender XDR telemetry for activity around the observed attack path: Screen Sharing file activity, SSH sessions, privileged file writes, LaunchDaemon persistence, process masquerading, Packet Filter changes, XMRig artefacts and related network activity. One process particularly worth reviewing is SSFileCopyReceiver / SSFileCopySender. Huntress notes that these are privileged Screen Sharing helpers, and their research highlights root-context activity and filesystem operations as useful hunting opportunities.
This rule detects the use of raw sockets by 'ERAAgent.exe' by monitoring for socket I/O control (Ioctl) operations involving 'SIO_RCVALL'. This configuration, often associated with promiscuous mode, allows an application to capture all network traffic received by the network interface, a behavior commonly used by network sniffing tools or malicious implants to intercept sensitive data.
Detects anomalous network connections to the local Chrome DevTools Protocol (CDP) debugging interface (127.0.0.1) associated with suspicious commands or function calls. This pattern is indicative of msaRAT malware attempting to perform process injection, bypass Content Security Policy (CSP), or execute code within a target browser process.
Page 78 of 246