Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
23
1
Contributors
17
4
1
1
1
Categories
12
10
6
5
3
Platforms
16
7
5
4
2
Products / Services
13
3
3
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
Detects exploitation attempts against the Ray AI framework's unauthenticated /api/jobs/ endpoint (CVE-2023-48022). The rule identifies specific Python requests using a known malicious contact address ('rondo2012@atomicmail.io') and detects the delivery of fileless payloads (rondo.wfh.sh) associated with the RondoDox / ShadowRay campaign originating from known malicious infrastructure.
Detects vLLM establishing outbound network connections to fetch external media files (e.g., .mov, .mp4, .jp2) from non-private IP addresses. This activity may indicate exploitation of CVE-2026-22778, allowing for remote code execution by fetching malicious content.
Detects process masquerading and resource abuse techniques used in the ShadowRay 2.0 campaign. This includes processes renamed to mimic legitimate system components (e.g., kworker, dns-filter) and the execution of known cryptominers from unusual locations.
KQL Query from file: Fortigate Belsen Leak KQL Check
KQL Query from file: Global Admin Entra Cookie with Chrome ZeroDay
KQL Query from file: Detecting Commvault Exploitation in Azure
KQL Query
KQL Query from file: Azure AI Security Finding Report
KQL Query
KQL Query
KQL Query
KQL Query
KQL Query from file: Vulnerability Profile: CVE-2024-30040 (Zero-day)
KQL Query from file: DefenderXDR Exposure Management for CVE-2024-3094
KQL Query
KQL Query
KQL Query from file: CVE-2025-24054 NTLM Exploit in the Wild Detection
KQL Query from file: CVE-2025-4664 Chrome flaw with public exploit
KQL Query
KQL Query from file: glibc critical vulnerability (CVSS 9.8)
Microsoft has observed threat actors exploiting vulnerabilities associated with Log4J.
Page 1 of 2