Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects hosts exhibiting behavior consistent with an active ransomware or destructive attack in progress, by correlating five distinct attack-chain stages within a rolling 24-hour window: environment/AD enumeration, network share discovery, lateral movement via RDP, credential dumping, and backup/recovery destruction.
Detects a Node or Bun process reaching the cloud instance metadata service. The keyv/cacheable
stage-2 collector targets EC2 IMDS and ECS task metadata as the entry point to a broader sweep
covering AWS credential chains and Secrets Manager across all regions, GCP service account
keys, Azure client secrets, HashiCorp Vault tokens, Kubernetes service account tokens, GitHub
Actions OIDC request tokens and npm tokens. On a build agent this pattern is the clearest
signal that credential theft is in progress.
stage-2 collector targets EC2 IMDS and ECS task metadata as the entry point to a broader sweep
covering AWS credential chains and Secrets Manager across all regions, GCP service account
keys, Azure client secrets, HashiCorp Vault tokens, Kubernetes service account tokens, GitHub
Actions OIDC request tokens and npm tokens. On a build agent this pattern is the clearest
signal that credential theft is in progress.
Detects outbound network connections and DNS queries to a maintained list of known UNC6671 extortion-related domain names. The rule utilizes a temporal 'recency' window (aged IOCs) to filter out stale indicators, mitigating false positives caused by sinkholed or reassigned infrastructure.
This rule detects the use of the Frida dynamic instrumentation toolkit and the objection framework, specifically searching for command-line arguments and process names associated with their installation or use, as well as network activity on the default Frida server port (27042). It monitors for activities like SSL pinning bypass, mobile application patching, and remote agent deployment.
This rule detects potential NTLM relay activity directed toward WSUS servers by monitoring network connections. It specifically identifies Windows devices identified as 'wsus' that communicate over both SMB (TCP 445) and Microsoft SQL Server (TCP 1433) ports within a 10-minute window, suggesting an attacker attempting to relay authentication to the WSUS backend database.
Device Name Search
Cortex XDR
This rule performs a telemetry data retrieval query for a specific agent hostname. It outputs detailed fields related to network connections and process executions (including command lines, user context, and process image names) from the XDR dataset for auditing or investigative purposes.
Detects signs of Adversary-in-the-Middle (AiTM) token or session replay attacks by correlating device browsing activity on known phishing domains with subsequent user sign-in events. The rule triggers if a sign-in occurs within 10 minutes of a phishing-domain visit from a different, non-corporate IP address, or if a single session exhibits multiple distinct non-corporate IP addresses within that same window.
This rule detects password spray attempts against multiple accounts in Cisco ISE device
This rule detects potentially malicious outbound network activity associated with the ScreenConnect (ConnectWise Control) remote administration tool. It flags connections to a specific malicious domain or any connection made by the ScreenConnect process to destinations outside of a defined organizational allow-list domain.
No description available.
Detects network and DNS traffic targeting known infrastructure used by the Forg365 adversary-in-the-middle (AiTM) phishing kit. This kit clones Microsoft login pages to intercept credentials and session cookies via reverse proxy.
Detects Azure AD sign-ins using the OAuth device code authentication flow that are followed by impossible-travel patterns (country change within a short window) or that occur near captive-portal network connections on the same device, consistent with Midnight Blizzard's CaptiveCrunch device-code phishing tradecraft targeting corporate travelers.
UNC6671 AiTM passkey/SSO lookalike domain DNS query
This rule detects potential NTLM relay activity directed toward WSUS servers by monitoring network connections. It specifically identifies Windows devices identified as 'wsus' that communicate over both SMB (TCP 445) and Microsoft SQL Server (TCP 1433) ports within a 10-minute window, suggesting an attacker attempting to relay authentication to the WSUS backend database.
This rule detects potential malicious activity associated with the 'ClickFix' technique, commonly linked to Midnight Blizzard. It identifies a sequence of events where a device attempts to resolve or fetch a 'wpad.dat' file (a common indicator of proxy configuration manipulation or man-in-the-middle attempts) followed shortly thereafter by the execution of 'powershell.exe' or 'mshta.exe' spawned from 'explorer.exe' on the same host within a 30-minute window. This pattern is indicative of a user being coerced into executing malicious scripts under the guise of fixing connectivity or security prompts.
This rule detects potential Web Proxy Auto-Discovery (WPAD) abuse by monitoring for network requests to 'wpad.dat' or 'wpad' resources on port 80, specifically on endpoints that have been tagged as connected to untrusted or public networks (e.g., guest, hotel, public). WPAD abuse is a common technique used by attackers to force devices to use a malicious proxy, enabling traffic interception and potential credential theft.
Detects a process that queries a public IP lookup service (ipify.org, ifconfig.me) and, within 30 seconds, initiates a second distinct network connection from the same causality/actor process chain that transfers data, consistent with environmental-keying techniques used by DOUBLECUP to fetch secondary-stage payloads keyed to the victim's public IP.
UNC6671 AiTM Phishing Infrastructure - Maintained IOC Dataset Match with TTL-Based Expiry (High Confidence)
This rule detects potential Adversary-in-the-Middle (AiTM) activity by correlating network events indicating a connection to a known phishing domain with subsequent suspicious authentication behavior. Specifically, it identifies sessions associated with non-corporate IP addresses that show evidence of token reuse (e.g., multiple distinct IP addresses for the same session identifier) occurring within a short window after accessing a phishing portal.
This rule detects potentially malicious outbound network activity associated with the ScreenConnect (ConnectWise Control) remote administration tool. It flags connections to a specific malicious domain or any connection made by the ScreenConnect process to destinations outside of a defined organizational allow-list domain.
Detects dual remote-access activity initiated by PowerShell. The rule tracks two behaviors: the installation of an UltraVNC server listener on ports 5800/5900, and PowerShell-spawned executables dropped into common user-writable directories (Temp, AppData, etc.) establishing network connections to known Larva-24009 C2 infrastructure.
Page 82 of 246