Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
17 detections
Filters
Last updated
All Time
Detection languages
11
5
1
Contributors
9
3
2
2
1
Categories
8
7
5
3
3
Platforms
7
6
5
2
1
Products / Services
5
5
3
2
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
4
2
1
1
Detects unauthorized GlobalProtect VPN logins from known malicious IPs.
Detects unauthorized GlobalProtect VPN logins from known malicious IPs.
Detects both specific Indicators of Compromise (IOCs) and generic anomalous authentication activity associated with the exploitation of the PAN-OS GlobalProtect authentication bypass vulnerability (CVE-2026-0257).
Detects exploitation attempts of the PAN-OS GlobalProtect authentication bypass vulnerability (CVE-2026-0257) by monitoring for specific Indicators of Compromise (IOCs) including source IPs, machine names, and MAC addresses.
Detects exploitation attempts against common network edge devices (Cisco, Ivanti, Palo Alto) associated with Salt Typhoon's TTPs for initial access.
KQL Query from file: Detecting Commvault Exploitation in Azure
KQL Query
KQL Query
KQL Query
KQL Query
KQL Query
KQL Query from file: DefenderXDR Exposure Management for CVE-2024-3094
KQL Query
KQL Query
Detects suspicious file creations within the Palo Alto Networks PAN-OS' parent telemetry folder, specifically looking for filenames containing patterns indicative of OS command injection attempts related to CVE-2024-3400. These files are processed by the 'dt_curl' script, which can lead to arbitrary command execution if device telemetry is enabled and filenames are crafted to bypass shell-subprocess restrictions.
Detects the creation of Python path configuration files (.pth) within Python library folders on macOS. These files can be maliciously used for code execution and persistence, as modules referenced by them are executed at every Python startup (v3.5+), regardless of whether they are explicitly imported by a script. The rule specifically looks for files ending with '.pth' in the '/lib/python3.([5-9]|[0-9]{2})/site-packages/' directory structure.
Detects potential exploitation attempts of CVE-2024-3400, an OS command injection vulnerability in Palo Alto GlobalProtect. The rule looks for suspicious strings indicating directory traversal or command injection within Palo Alto GlobalProtect logs.