Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
452 detections
Filters
Last updated
All Time
Detection languages
251
100
69
13
8
Contributors
113
74
46
46
44
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
302
94
46
43
29
Products / Services
317
231
88
54
28
MITRE Techniques
171
167
100
60
59
CVEs
4
3
2
2
2
IDS Classtypes
5
3
3
1
1
IDS Protocols
7
6
Detects anomalous activity where AI-enabled browser agents or extensions perform email summarization or access actions without corresponding user UI interaction, subsequently sending or sharing the information to an external recipient address distinct from the mailbox owner.
Detects network traffic associated with the SparroWocky/FamousSparrow C2 framework, including HTTP CONNECT proxy tunneling, SOCKS5 handshakes, and established TLS sessions to known malicious infrastructure.
Detects network activity and HTTP traffic associated with the Iron Man System kit, specifically targeting hardcoded C2 infrastructure (IP-based) and lure domain patterns involving specific brand tokens combined with disposable TLDs.
Detects network activity and HTTP traffic associated with the Iron Man System kit, specifically targeting hardcoded C2 infrastructure (IP-based) and lure domain patterns involving specific brand tokens combined with disposable TLDs.
Detects outbound network traffic to the GitHub API, a known communication channel for the RUSTYSHADE malware and APT36 (Transparent Tribe) threat group, occurring outside of a previously observed operational cadence (weekdays 04:00-11:00 UTC). Deviations from this baseline pattern on weekends or off-hours suggest unauthorized C2 activity or changes in actor infrastructure.
This rule detects potentially malicious use of residential proxies by monitoring for outbound HTTP CONNECT requests originating from consumer devices in the internal network. The use of HTTP CONNECT is a common method for establishing tunnels through proxies to mask C2 communication or facilitate unauthorized access, often associated with botnets or malicious proxy networks.
This rule detects potentially malicious use of residential proxies by monitoring for outbound HTTP CONNECT requests originating from consumer devices in the internal network. The use of HTTP CONNECT is a common method for establishing tunnels through proxies to mask C2 communication or facilitate unauthorized access, often associated with botnets or malicious proxy networks.
This rule monitors for user interactions with specific domains and URLs known to be associated with suspicious or malicious activity. It aggregates data from multiple sources, including email clicks (UrlClickEvents), device network activity (DeviceNetworkEvents), device browser events (DeviceEvents), and DNS queries (DnsEvents), to identify potential exposure to these indicators of compromise.
This rule monitors for user interactions with specific domains and URLs known to be associated with suspicious or malicious activity. It aggregates data from multiple sources, including email clicks (UrlClickEvents), device network activity (DeviceNetworkEvents), device browser events (DeviceEvents), and DNS queries (DnsEvents), to identify potential exposure to these indicators of compromise.
Detects requests to a LiteLLM proxy that have been assigned the 'PROXY_ADMIN' role despite the absence of valid authentication credentials (Authorization headers, JWT tokens, or OAuth2 tokens). This pattern typically indicates that the LiteLLM instance is misconfigured, specifically that a 'master_key' is missing, causing the proxy to default to a permissive mode where every request is treated as having administrative privileges.
Detects instances where a LiteLLM proxy is utilized to invoke sensitive Model Context Protocol (MCP) tools (e.g., database, github, slack, jira, ci/cd) while authentication is bypassed ('allow_all_keys=true') and no explicit API key is provided. This indicates a potential unauthorized access attempt to sensitive integrations via a misconfigured proxy.
This rule detects attempts to exploit the LiteLLM proxy pass-through endpoint to interact with the cloud Instance Metadata Service (IMDS). Specifically, it identifies configuration attempts to route traffic to the IMDS IP (169.254.169.254) and subsequent requests to retrieve IAM security credentials, which is indicative of a Server-Side Request Forgery (SSRF) attack to steal cloud identity tokens.
Detects network activity and HTTP traffic associated with the Iron Man System kit, specifically targeting hardcoded C2 infrastructure (IP-based) and lure domain patterns involving specific brand tokens combined with disposable TLDs.
Detects network activity and HTTP traffic associated with the Iron Man System kit, specifically targeting hardcoded C2 infrastructure (IP-based) and lure domain patterns involving specific brand tokens combined with disposable TLDs.
Detects potential installation of compromised Admin Menu Editor Pro plugin updates by identifying sequential download events for specific plugin versions from the 'adminmenueditor.com' domain within a 24-hour window. This behavior is indicative of a supply chain attack where a legitimate update mechanism is leveraged to deliver malicious payloads without integrity verification.
This rule monitors for user interactions with specific domains and URLs known to be associated with suspicious or malicious activity. It aggregates data from multiple sources, including email clicks (UrlClickEvents), device network activity (DeviceNetworkEvents), device browser events (DeviceEvents), and DNS queries (DnsEvents), to identify potential exposure to these indicators of compromise.
Detects instances where a user or entity accessing a file (download, access, or preview) originates from an IP address identified as an anonymous proxy. This rule is designed to be used with a downstream aggregation tool to identify potentially unauthorized data exfiltration or access via anonymization services.
This rule detects potential OAuth 2.0 device code phishing attempts by monitoring network activity for requests to common Microsoft OAuth device authorization endpoints. It flags requests that utilize a specific hardcoded client_id associated with known suspicious application registrations, combined with requested scopes for graph.microsoft.com and a Python-based user agent. This behavior is indicative of an adversary attempting to gain unauthorized access by tricking a user into authorizing a malicious application.
This rule detects potential OAuth 2.0 device code phishing attempts by monitoring network activity for requests to common Microsoft OAuth device authorization endpoints. It flags requests that utilize a specific hardcoded client_id associated with known suspicious application registrations, combined with requested scopes for graph.microsoft.com and a Python-based user agent. This behavior is indicative of an adversary attempting to gain unauthorized access by tricking a user into authorizing a malicious application.
This rule detects potentially malicious use of residential proxies by monitoring for outbound HTTP CONNECT requests originating from consumer devices in the internal network. The use of HTTP CONNECT is a common method for establishing tunnels through proxies to mask C2 communication or facilitate unauthorized access, often associated with botnets or malicious proxy networks.
This rule detects potentially malicious use of residential proxies by monitoring for outbound HTTP CONNECT requests originating from consumer devices in the internal network. The use of HTTP CONNECT is a common method for establishing tunnels through proxies to mask C2 communication or facilitate unauthorized access, often associated with botnets or malicious proxy networks.
Page 6 of 22