Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
16 detections
Filters
Last updated
All Time
Detection languages
9
4
2
1
Contributors
5
4
3
2
1
Categories
7
4
4
3
3
Platforms
9
3
1
1
1
Products / Services
5
5
4
3
3
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
1
IDS Classtypes
3
1
IDS Protocols
4
Detects the use of the 'diagnose sniffer packet' command on a FortiGate network device, which is indicative of an administrator or attacker performing network traffic capture and analysis directly from the device's management interface.
Detects the use of the 'diagnose sniffer packet' command on FortiOS, or evidence of the FortigateSniffer tool (associated with past FortiGate vulnerabilities). This behavior is indicative of unauthorized packet capture and potential credential sniffing on network infrastructure devices.
This rule detects suspicious file creation/modification events in common temporary or library directories, or suspicious process creation/execution events, that contain specific developer-related strings. These strings, such as 'OOMWorker process killed by OOM killer', 'Token expiration handling', 'Refresh token logic seems flaky', 'Build failed on main', and 'SQL Injection vulnerability', could indicate the presence of development tools, debugging activity, or potentially malicious scripts/binaries attempting to mimic legitimate development processes or exfiltrate sensitive information. The rule also looks for a specific SHA256 hash, which might be associated with known malicious or suspicious files.
Detects network device configuration commands via SSH
Detects modification of network device AAA authentication to allow bypass
This rule detects events generated by Microsoft Defender for Endpoint's Attack Surface Reduction (ASR) rules in either Audit or Block mode.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
(**Toggle by commenting out line 94/95. Default is both Audit & Block**).
It covers all 19 ASR rules by matching ActionType patterns or falling back to GUIDs found in AdditionalFields. The rule extracts the friendly name of the ASR rule, the mode (Audit/Block), and relevant process information.
This rule is especially noisy when ran over an entire environment. It's recommended to scope using Audit/Block, Machine Group, and filtering to the rules you want by commenting others out.
This rule detects network traffic on TCP port 830, which is commonly used for NETCONF (Network Configuration Protocol) sessions. The rule specifically looks for the string "<rpc" within the traffic, indicating an RPC (Remote Procedure Call) request, which is a fundamental part of NETCONF communication. This suggests an attempt to establish a CLI (Command Line Interface) session with a network device using NETCONF.
This rule detects attempts to access the command-line interface (CLI) of a network device via Telnet, specifically looking for the 'enable' and 'configure terminal' commands. This indicates an administrative attempt to configure or manage a network device.
This rule detects attempts to retrieve the running configuration of a network device via an SSH session. It specifically looks for the case-insensitive string "show running-config" in TCP traffic destined for port 22 (SSH) on the home network, indicating a potential administrative action or reconnaissance activity.
Detects web requests containing common SQL injection payloads or specific PoC metacharacters embedded within JSON:API filter array keys targeting Drupal CVE-2026-9082. The rule specifically looks for requests to Drupal's JSON:API that include 'filter[' and '[condition][value][' in the URI query, combined with SQL injection indicators such as '--', 'UNION', 'SELECT', '$$', '.$', or 'RAPTORMARKER42'.
Detects potential command injection attempts against Citrix NetScaler ADC and Gateway devices. This detection is based on the patterns described in a hypothetical proof-of-concept for CVE-2025-7775, which involves injecting shell commands and referencing sensitive system paths in HTTP requests.
This analytic detects the configuration of TFTP services on Cisco IOS devices that could be used to exfiltrate sensitive configuration files. Threat actors like Static Tundra have been observed configuring TFTP servers to make device configuration files accessible for exfiltration after gaining initial access. The detection specifically looks for commands that expose critical configuration files such as startup-config, running-config, and other sensitive system information through TFTP. This activity is particularly concerning as it may represent an attempt to steal credentials, network topology information, and other sensitive data stored in device configurations.
'Identifies a match for SQL Injection attack in the Application gateway WAF logs. The Threshold value in the query can be changed as per your infrastructure's requirement.
References: https://owasp.org/Top10/A03_2021-Injection/'
References: https://owasp.org/Top10/A03_2021-Injection/'
In this query, we are looking for emails containing malware accessed on a unmanaged device
Microsoft has observed threat actors exploiting vulnerabilities associated with Log4J.
This query searches for not onboarded devices with a specific Suffix