Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
734
214
105
78
51
Contributors
206
187
159
111
90
Categories
396
296
264
260
247
Platforms
492
314
281
204
110
Products / Services
379
234
152
109
106
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,235
CVEs
9
9
4
4
4
IDS Classtypes
11
6
4
2
1
IDS Protocols
10
5
3
Detects login or authentication attempts to a Cisco Firewall Management Center (FMC) management interface from non-authorized source IP addresses. The rule specifically flags connections targeting potential low-privilege or service accounts that may indicate unauthorized access attempts or brute-force behavior directed at critical network infrastructure.
This rule monitors for suspicious activity by detecting two distinct patterns: first, network connections initiated by Java processes located in tomcat/catalina directories on high-risk ports; second, suspicious administrative audit actions (Add admin, Modify credential, Export device list) within N-central where the initiating user context is missing.
PKINIT DC Impersonation from Non-DC Host
Cortex XDR
This rule detects potential Kerberos PKINIT (Pre-Authentication Type 16) authentication requests where a Domain Controller account (identified via User Account Control bit 8192) is targeted by an authentication attempt originating from a non-DC client address. This behavior may indicate an attempt to impersonate or misuse a high-privilege account for lateral movement or persistence.
Detects login or authentication attempts to a Cisco Firewall Management Center (FMC) management interface from non-authorized source IP addresses. The rule specifically flags connections targeting potential low-privilege or service accounts that may indicate unauthorized access attempts or brute-force behavior directed at critical network infrastructure.
This rule monitors Zscaler web proxy logs to identify potential unauthorized account access by flagging two types of anomalous geographic activity: Impossible Travel (user access from two different countries within a short time window) and New Country for Identity (the first instance of an account accessing resources from a specific country).
This rule monitors Zscaler web proxy logs to identify potential unauthorized account access by flagging two types of anomalous geographic activity: Impossible Travel (user access from two different countries within a short time window) and New Country for Identity (the first instance of an account accessing resources from a specific country).
Detects registry-level signals of the SleeperGem RubyGems supply chain attack:
a long-dormant maintainer account publishing a new gem version, the trusted Dendreo gem receiving a new version that adds git_credential_manager as a dependency, and an unrelated maintainer (fastlane-plugin-run_tests_firebase_testlab) publishing a version referencing the same dependency within a short window - indicating coordinated, multi-account compromise rather than a single takeover.
a long-dormant maintainer account publishing a new gem version, the trusted Dendreo gem receiving a new version that adds git_credential_manager as a dependency, and an unrelated maintainer (fastlane-plugin-run_tests_firebase_testlab) publishing a version referencing the same dependency within a short window - indicating coordinated, multi-account compromise rather than a single takeover.
Detects registry-level signals of the SleeperGem RubyGems supply chain attack:
a long-dormant maintainer account publishing a new gem version, the trusted Dendreo gem receiving a new version that adds git_credential_manager as a dependency, and an unrelated maintainer (fastlane-plugin-run_tests_firebase_testlab) publishing a version referencing the same dependency within a short window - indicating coordinated, multi-account compromise rather than a single takeover.
a long-dormant maintainer account publishing a new gem version, the trusted Dendreo gem receiving a new version that adds git_credential_manager as a dependency, and an unrelated maintainer (fastlane-plugin-run_tests_firebase_testlab) publishing a version referencing the same dependency within a short window - indicating coordinated, multi-account compromise rather than a single takeover.
This rule monitors Okta system logs for lifecycle events related to inbound Identity Providers (IdP), specifically creation, modification, activation, deactivation, or deletion. It flags these changes when initiated by clients identified as proxies or associated with known abused ASNs. This activity is indicative of potential cross-tenant impersonation where an attacker with administrative access adds a malicious IdP to federate and impersonate organizational users.
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
Detects a POST to the WordPress REST API batch endpoint whose request body embeds a nested /wp/v2/users call granting the administrator role, consistent with the wp2shell exploit chain where a forged customize_changeset/parse_request replay temporarily assumes an existing admin's identity to pass current_user_can('create_users') and create a new administrator account without any preceding authenticated login. To reduce false positives from legitimate onboarding of administrator accounts, this rule now requires either the absence of an authenticated WordPress session cookie on the request, or a newly created username matching the randomized/generated wp2shell naming pattern (wp2_*, w2s_*).
Detects instances where a WordPress customization changeset is published by a session user that differs from the user associated with the changeset, specifically when the changeset owner holds an administrator role. This behavior may indicate account hijacking or unauthorized privilege escalation within the WordPress administration interface.
Detects a POST to the WordPress REST API batch endpoint whose request body embeds a nested /wp/v2/users call granting the administrator role, consistent with the wp2shell exploit chain where a forged customize_changeset/parse_request replay temporarily assumes an existing admin's identity to pass current_user_can('create_users') and create a new administrator account without any preceding authenticated login. To reduce false positives from legitimate onboarding of administrator accounts, this rule now requires either the absence of an authenticated WordPress session cookie on the request, or a newly created username matching the randomized/generated wp2shell naming pattern (wp2_*, w2s_*).
Detects registry-level signals of the SleeperGem RubyGems supply chain attack:
a long-dormant maintainer account publishing a new gem version, the trusted Dendreo gem receiving a new version that adds git_credential_manager as a dependency, and an unrelated maintainer (fastlane-plugin-run_tests_firebase_testlab) publishing a version referencing the same dependency within a short window - indicating coordinated, multi-account compromise rather than a single takeover.
a long-dormant maintainer account publishing a new gem version, the trusted Dendreo gem receiving a new version that adds git_credential_manager as a dependency, and an unrelated maintainer (fastlane-plugin-run_tests_firebase_testlab) publishing a version referencing the same dependency within a short window - indicating coordinated, multi-account compromise rather than a single takeover.
Detects Microsoft Entra ID sign-in events using the Resource Owner Password Credentials (ROPC) flow where the client application displays a blank name. This pattern is commonly associated with attackers spoofing OAuth client IDs to bypass security controls or perform user enumeration.
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
Detects a POST to the WordPress REST API batch endpoint whose request body embeds a nested /wp/v2/users call granting the administrator role, consistent with the wp2shell exploit chain where a forged customize_changeset/parse_request replay temporarily assumes an existing admin's identity to pass current_user_can('create_users') and create a new administrator account without any preceding authenticated login. To reduce false positives from legitimate onboarding of administrator accounts, this rule now requires either the absence of an authenticated WordPress session cookie on the request, or a newly created username matching the randomized/generated wp2shell naming pattern (wp2_*, w2s_*).
Detects a forged WordPress customize_changeset post that triggers wp_set_current_user with a mismatched or unauthenticated user context, the privilege-escalation bridge used in the wp2shell admin-takeover chain.
Detects which privileged users have signed in recently, how often, from how many IPs/apps, what authentication methods they used, and whether any password-only sign-ins occurred?
Detects cred_exec/token_run command tokens within the TAG-195 WebSocket C2 message schema, used for credential/token-backed lateral movement.
Page 25 of 59