Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
743 detections
Filters
Last updated
All Time
Detection languages
319
311
30
25
23
Contributors
208
198
121
84
25
Categories
20,440
11,814
5,871
5,145
4,864
743
Platforms
416
262
181
51
41
Products / Services
328
230
136
84
55
MITRE Techniques
204
124
121
111
109
CVEs
15
10
8
7
7
IDS Classtypes
124
84
26
23
12
IDS Protocols
168
91
30
11
4
This rule detects potential lateral movement attempts using Windows Remote Management (WinRM) by monitoring for specific WSMan SOAP protocol headers in HTTP traffic. It specifically looks for POST requests to the WSMan endpoint that contain suspicious keywords like 'winrs', 'MSRPC', or 's:Envelope', which are commonly associated with remote command execution via winrs or PSSession.
Detects remote system shutdown attempts initiated via the MSRPC winreg named pipe over SMB. This behavior is indicative of an attacker attempting to shut down or reboot a target system remotely to interrupt availability, often as a prelude to or consequence of destructive actions.
This rule detects exploitation attempts targeting CVE-2026-0300 in Palo Alto Networks PAN-OS. It identifies suspicious network connections to User-ID Authentication Portal ports (6081, 6082) from external IP addresses, excluding RFC1918 and loopback ranges. Additionally, it looks for a specific anomalous User-Agent string associated with the CL-STA-1132 threat actor, which has been observed during exploitation of this vulnerability.
This rule detects exploitation attempts targeting CVE-2026-0300 in Palo Alto Networks PAN-OS. It identifies suspicious network connections to User-ID Authentication Portal ports (6081, 6082) from external IP addresses, excluding RFC1918 and loopback ranges. Additionally, it looks for a specific anomalous User-Agent string associated with the CL-STA-1132 threat actor, which has been observed during exploitation of this vulnerability.
Detects potential exploitation of CVE-2026-20127 on SD-WAN controllers, specifically unauthorized SSH authentication to the vmanage-admin account followed by suspicious NETCONF activity, usage of unauthorized tenant list CSV files, or execution of suspicious tenant-upload scripts.
This rule detects potential rogue SD-WAN peering attempts by correlating successful SSH public key authentication using 'vmanage-admin' from known malicious IPs with subsequent network activity on SD-WAN control plane ports (e.g., 48373 for OMP, 830 for NETCONF). It also flags logs containing references to an 'evil_tenant.csv' artifact, which is associated with adversary persistence or unauthorized configuration management in SD-WAN environments.
Detects multiple failed SSH login attempts from a single source IP address, indicating a potential brute force attack. The rule identifies 'Invalid user' or 'Failed password' messages in syslog from the 'sshd' process and groups them by source IP and time to count unique attempted users and total attempts. A threshold of more than 5 attempted users from a single source IP within a 10-minute window triggers an alert.
Detects inbound network connections from a specific list of known suspicious or untrusted external IP addresses targeting sensitive management ports (SSH, NETCONF, and vManage-HTTPS-API). The rule identifies if the connection is made by a privileged account (e.g., admin, root) to highlight potential unauthorized management access attempts.
Detects potential exploitation of CVE-2026-0300 targeting PAN-OS and matches anomalous User-Agent string associated with CL-STA-1132 threat actor.
Detects an abnormally high volume of connections to the hidden IPC$ administrative share on a Windows host within a short time window. This activity is often associated with lateral movement techniques, scanning, or brute-forcing attempts where adversaries interact with SMB shares for reconnaissance or remote execution.
Detects instances where common administrative tools (such as PowerShell, cmd, or network utilities) are launched as child processes of the WinRM service process (wsmprovhost.exe) shortly after an inbound WinRM network connection is established on port 5985 or 5986.
Detects instances where common administrative tools (such as PowerShell, cmd, or network utilities) are launched as child processes of the WinRM service process (wsmprovhost.exe) shortly after an inbound WinRM network connection is established on port 5985 or 5986.
This rule detects potentially malicious inbound HTTP POST requests directed at an API endpoint associated with public build directories. The detection logic monitors for suspicious user agents (e.g., Python requests), specific known malicious flow identifiers, known attacker IP addresses, and payload indicators such as OS command injection or execution patterns (e.g., __import__, os.system).
Detects inbound network connections initiated by common Windows Nearby Sharing processes ('NearShare.exe', 'NearbySharing.exe', 'quickshare.exe', 'NearbyConnectionsService.exe') that occur on non-standard ports, potentially indicating unauthorized or malicious use of these utilities.
Detects high frequency inbound network connection attempts or accepted connections initiated by common file sharing processes (e.g., NearShare.exe, NearbySharing.exe, quickshare.exe, sharingd, airplayd). A high volume of inbound connection attempts may indicate brute force, discovery, or malicious scanning behavior using legitimate file sharing tools as a conduit.
Detects potential token manipulation attacks using SMB loopback connections. The rule identifies processes executing with privileges commonly associated with token impersonation (SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege) or running as SYSTEM that are not expected system processes, correlated with an SMB network connection to the local loopback address on port 445.
Detects unusual network connections or process creation events originating from the 'sharingd' daemon on macOS. 'sharingd' handles various Apple sharing features (AirDrop, Handoff, Shared Clipboard). Unusual child processes or network activity involving this daemon may indicate abuse for unauthorized data transfer, lateral movement, or remote service interaction.
Detects HTTP response bodies containing common PE/Shellcode magic headers (MZ, PE, or NOP sleds) which are associated with the delivery of payloads designed to exploit or utilize the Windows KernelCallbackTable for process injection. The detection focuses on suspicious content delivered over HTTP connections.
This rule detects potential SSH brute force attacks by identifying high-frequency authentication failures from sshd logs (more than 10 failures in 5 minutes) and rapid, potentially automated connection attempts on port 22 (more than 20 connections in 1 minute) originating from the same source IP on Linux systems.
This rule detects potential lateral movement attempts using Windows Remote Management (WinRM) by monitoring for specific WSMan SOAP protocol headers in HTTP traffic. It specifically looks for POST requests to the WSMan endpoint that contain suspicious keywords like 'winrs', 'MSRPC', or 's:Envelope', which are commonly associated with remote command execution via winrs or PSSession.
Detects multiple FTP login failures ('530 Login incorrect') from a single source IP address within a short time window, indicating a potential brute force or password guessing attempt against an FTP service.
Page 24 of 36