Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
8
1
Contributors
3
3
1
1
1
Categories
6
3
3
3
2
Platforms
8
1
1
1
Products / Services
7
6
1
1
1
MITRE Techniques
3
3
3
3
3
CVEs
1
1
IDS Classtypes
1,937
503
461
381
236
9
IDS Protocols
4
3
1
Detects and monitors sign-in events for specific high-privilege or sensitive accounts, such as break-glass accounts, within Microsoft Entra ID.
This rule detects attempts to exploit the Microsoft Support Diagnostic Tool (MSDT) vulnerability CVE-2022-30190, known as 'Follina'. The rules monitor for malicious HTTP traffic and payloads that leverage the 'ms-msdt' URI scheme to execute arbitrary commands, often delivered via weaponized documents or external references to remote malicious HTML files.
Detects phishing attempts related to 'Operation DoppelBrand' campaign using common email service providers (ESPs) to spoof legitimate-looking emails with fraud-themed subjects, such as invoices or payment requests, associated with the Brickstorm malware.
Detects phishing attempts related to 'Operation DoppelBrand' campaign using common email service providers (ESPs) to spoof legitimate-looking emails with fraud-themed subjects, such as invoices or payment requests, associated with the Brickstorm malware.
Detects phishing attempts related to 'Operation DoppelBrand' campaign using common email service providers (ESPs) to spoof legitimate-looking emails with fraud-themed subjects, such as invoices or payment requests, associated with the Brickstorm malware.
Detects high-frequency HTTP 401 Unauthorized responses associated with Basic Authentication attempts within a short timeframe, indicating a potential credential brute-force attack.
Detects high-frequency HTTP 401 Unauthorized responses associated with Basic Authentication attempts within a short timeframe, indicating a potential credential brute-force attack.
SSH Brute Force Attempt Detected
Suricata
Detects repeated failed SSH authentication attempts which may indicate brute force activity against SSH services. The rule specifically looks for 8 SSH connection attempts to port 22 within a 60-second window from the same source IP.
This rule detects an attempted remote code execution (RCE) vulnerability in Microsoft SharePoint, specifically CVE-2024-38018. The detection is based on an HTTP POST request targeting the `/_vti_bin/webpartpages.asmx` URI with a specific content pattern in the request body: `|3c|AttachedPropertiesShared|3e 2f|wE`. This pattern indicates an attempt to exploit a deserialization vulnerability within SharePoint's SPThemes functionality.
