Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
743 detections
Filters
Last updated
All Time
Detection languages
319
311
30
25
23
Contributors
208
198
121
84
25
Categories
20,440
11,814
5,871
5,145
4,864
743
Platforms
416
262
181
51
41
Products / Services
328
230
136
84
55
MITRE Techniques
204
124
121
111
109
CVEs
15
10
8
7
7
IDS Classtypes
124
84
26
23
12
IDS Protocols
168
91
30
11
4
Detects inbound Remote Desktop Protocol (RDP) connections targeting internal Windows devices from public IP addresses. This rule identifies potential unauthorized remote access, brute-force activity, or the exposure of RDP services to the public internet.
Detects sign-in activity in Entra ID where the application display name is blank, despite an Application ID being present, originating from known cloud service provider IP ranges (AWS or Cloudflare). This pattern is consistent with automated enumeration or discovery tools that leverage OAuth client ID spoofing or misconfigurations to identify valid tenants or users.
This rule monitors security logs for evidence of exploitation attempts targeting CVE-2025-2492 or malicious activity related to the 'AiCloud' platform. It scans incoming log messages for these specific indicators to identify potentially compromised network requests.
This rule detects potentially unauthorized access or activity related to MySQL databases. It monitors for external network connections to the MySQL default port (3306) that originate from non-private IP addresses, and identifies suspicious process command lines using Python's PyMySQL library that attempt to authenticate as the 'root' user.
Detects OS fingerprinting commands executed as child processes of a process that is actively listening on a network port, consistent with DOGLEASH.
This rule detects suspicious activity where a process initiates a network listening connection, launches a shell (sh, bash), and engages in file read or rename operations within a short 15-minute window. This behavior is indicative of a potential backdoor setup, lateral movement, or malicious script execution.
Detects indicators associated with CVE-2025-2492 or AiCloud activity in security logs.
This rule identifies successful user sign-ins originating from IP addresses known to belong to VPN services. It leverages an external list of VPN IP ranges to correlate with Azure AD SigninLogs. This can indicate an attempt to bypass geo-restrictions, hide true origin, or could be legitimate use of a VPN by an employee.
Detects network requests targeting port 8013 that generate an error message indicating a missing certificate in the request header. This pattern is associated with attempts to exploit vulnerability CVE-2026-35616.
Detects the execution of OS information gathering commands (e.g., uname, lsb_release) by a process that is also identified as having an active network listener. This pattern is indicative of passive backdoors or C2 agents performing reconnaissance of the host system after establishing a listener.
Detects anomalous access to Cisco SD-WAN Manager (vManage) infrastructure. This includes unauthenticated REST API access, unauthorized NETCONF sessions, and suspicious OMP/DTLS peering connections, which may indicate exploitation of vulnerabilities (such as CVE-2026-20127 or CVE-2026-20182) or unauthorized management access.
Detects unauthenticated POST requests directed at the '/accessv2' endpoint of an Azure Application Gateway originating from non-internal IP addresses. This behavior is associated with the exploitation of vulnerabilities like CVE-2026-8037.
Detects anomalous, oversized IKEv1 Phase 1 packets targeting Check Point VPN devices, indicative of an exploitation attempt for CVE-2026-50751.
This rule detects potential SSH brute force attacks by monitoring syslog for multiple failed SSH login attempts, connection closures, or invalid user attempts from a single source IP address within a short time frame. It specifically looks for keywords like 'error', 'Connection closed', 'authentication failure', and 'invalid user' in SSHD logs.
Detects malicious activities targeting Cisco Catalyst SD-WAN infrastructure, including connections from known malicious IP addresses (UAT-8616), unauthenticated vManage API access attempts indicative of exploitation (CVE-2026-20182), and anomalous control-plane signaling (OMP/DTLS/NETCONF) from unauthorized external sources.
Detects anomalous, oversized IKEv1 Phase 1 packets targeting Check Point VPN devices, indicative of an exploitation attempt for CVE-2026-50751.
Detects evidence of exploitation attempts related to the hypothetical CVE-2026-55200 vulnerability. The rule monitors for known exploit file names, command-line arguments, and specific network patterns targeting SSH ports (22, 2222) that indicate potential LibSSH2 exploitation.
Detects network traffic attempting to modify SSH authorized_keys or the sshd_config file using SCP or SFTP protocols, which is a common technique used by attackers to maintain persistence on compromised systems.
Detects network traffic attempting to exploit the SMBv1 vulnerability (CVE-2017-0144), commonly known as EternalBlue. The rule monitors for specific SMB Trans2 SESSION_SETUP packet structures associated with this remote code execution exploit.
Detects high-volume authentication failures originating from a single IP address with a large number of unique target accounts within a 30-minute window, indicative of a password spraying or brute force attack against network services.
Detects unauthenticated POST requests directed at the '/accessv2' endpoint of an Azure Application Gateway originating from non-internal IP addresses. This behavior is associated with the exploitation of vulnerabilities like CVE-2026-8037.
Page 19 of 36