Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
85 detections
Filters
Last updated
All Time
Detection languages
64
14
3
3
1
Contributors
42
10
6
5
4
Categories
20,402
11,796
5,865
5,145
4,864
Platforms
44
25
15
12
10
Products / Services
29
16
15
12
9
MITRE Techniques
20
16
16
11
11
CVEs
2
This rule monitors for successful GlobalProtect gateway connections from users who have not successfully connected in the preceding 30 days, specifically identifying users connecting with a client fingerprint of 'Microsoft Windows 10 Pro 64-bit'. This behavior is indicative of potential initial access using compromised or new credentials, or specifically flagging suspicious activity patterns associated with specific exploit proof-of-concept client fingerprints.
This rule monitors for successful GlobalProtect gateway connections from users who have not successfully connected in the preceding 30 days, specifically identifying users connecting with a client fingerprint of 'Microsoft Windows 10 Pro 64-bit'. This behavior is indicative of potential initial access using compromised or new credentials, or specifically flagging suspicious activity patterns associated with specific exploit proof-of-concept client fingerprints.
Summarizes Zscaler NSSWeblog transactions where DeviceAction was Allowed but Zscaler still recorded a malware/threat verdict (ClickFix, MalURL, Trojan.Gen families), broken down by user, threat name, and malware category for triage.
Summarizes Zscaler NSSWeblog transactions where DeviceAction was Allowed but Zscaler still recorded a malware/threat verdict (ClickFix, MalURL, Trojan.Gen families), broken down by user, threat name, and malware category for triage.
This rule monitors Palo Alto Networks firewalls for files identified as malicious by the WildFire or ML-based threat detection engines. It filters out known allowed file hashes and aggregates events to provide a high-confidence alert. The rule categorizes threats based on the verdict ('malicious', 'malware', 'phishing', 'suspicious', 'c2') and distinguishes whether the threat was blocked or delivered to the network, providing context for incident response.
This rule detects instances where a user has overridden Microsoft SmartScreen warnings or bypassed Network Protection. This could indicate a user intentionally accessing potentially malicious content or an attempt to circumvent security controls.
Detects SSH, SFTP, or SCP connections originating from internal edge appliances such as pfSense firewalls or Synology NAS devices directed at internal network hosts. This activity is consistent with VerdantBamboo BRICKSTORM lateral movement, where compromised edge infrastructure is leveraged as a pivot point to gain access to the internal network.
This rule detects instances where a user has overridden Microsoft SmartScreen warnings or bypassed Network Protection. This could indicate a user intentionally accessing potentially malicious content or an attempt to circumvent security controls.
This rule alerts when Cato's inline Anti Malware engine identifies a file in transit as malicious. It fires on both blocked and allowed malware to catch cases where the engine detects but fails to block, indicating a potential compromise or a misconfiguration requiring immediate investigation.
This rule detects instances where a user has overridden Microsoft SmartScreen warnings or bypassed Network Protection. This could indicate a user intentionally accessing potentially malicious content or an attempt to circumvent security controls.
This KQL query identifies vulnerable VPN clients installed on endpoints that have High or Critical severity CVEs. VPN software is a high-value target for attackers because vulnerabilities can be exploited to bypass network access controls, intercept traffic, or gain remote access to internal networks.
Hunts for abuse of Microsoft 365’s Direct Send feature where attackers send spoofed emails appearing internal, bypassing filters. Includes detection of suspicious DNS queries, outbound network connections, and PowerShell abuse for insider misuse.
The analytic identifies allowed network traffic to The Onion Router (TOR), an anonymity network often exploited for malicious activities. It leverages data from Next Generation Firewalls to detect traffic where the application is TOR and the action is allowed. This activity is significant as TOR can be used to bypass conventional monitoring, facilitating hacking, data breaches, and illicit content dissemination. If confirmed malicious, this could lead to unauthorized access, data exfiltration, and severe compliance violations, compromising the integrity and security of the network.
Detects when the Palo Alto Networks firewall does not block traffic to a URL associated with malware distribution or operation. This typically indicates a lapse in the firewall's threat intelligence or a misconfiguration. An adversary can abuse this by using the unblocked URL to download malware onto a target system, establish a command and control channel, or exfiltrate data.
Detects when the Palo Alto Networks firewall does not block traffic to a URL known to be used in phishing attacks. An adversary can abuse this by directing victims to the phishing site, potentially stealing credentials, deploying malware, or conducting other malicious activities.
Detects active network communication associated with known malware that is being allowed by the Palo Alto Networks firewall. This may indicate an ongoing security threat, where malicious traffic is bypassing firewall protections, potentially leading to system compromise, data exfiltration, or further infiltration within the network.
Detects allowed network traffic to the TOR network. Adversaries can use TOR to anonymize their network activity, bypass security controls, and evade detection while conducting malicious operations. This could lead to unauthorized access, data exfiltration, and compliance violations if deemed malicious.
Microsoft Releases Guidance on Exploitation of SharePoint Vulnerability (CVE-2025-53770)
Visualises malicious URL clicks that were allowed through Safe Links over time, helping analysts identify when users bypass security controls and click on malicious content.
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
Based on Defender for Office 365 workbook: https://techcommunity.microsoft.com/blog/microsoftdefenderforoffice365blog/part-2-build-custom-email-security-reports-and-dashboards-with-workbooks-in-micr/4411303
'Discover all critical ports from a list having rules like 'Any' for sourceIp, which means that they are opened to everyone. Critial ports should not be opened to everyone, and should be filtered.'
The analytic detects instances where network traffic, identified by port and transport layer protocol as prohibited in the "lookup_interesting_ports" table, is allowed. It uses the Network_Traffic data model to cross-reference traffic data against predefined security policies. This activity is significant for a SOC as it highlights potential misconfigurations or policy violations that could lead to unauthorized access or data exfiltration. If confirmed malicious, this could allow attackers to bypass network defenses, leading to potential data breaches and compromising the organization's security posture.
Page 4 of 5