Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
734
214
105
78
51
Contributors
206
187
159
111
90
Categories
396
296
264
260
247
Platforms
492
314
281
204
110
Products / Services
379
234
152
109
106
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,235
CVEs
9
9
4
4
4
IDS Classtypes
11
6
4
2
1
IDS Protocols
10
5
3
Detects the deletion of a storage bucket immediately followed by the creation of a new bucket with the same name across different cloud providers (GCP, AWS S3, Azure). This rule specifically flags scenarios where the deleting actor or project differs from the creating actor or project, indicating a potential cross-account hijack or data exfiltration attempt.
This rule detects successful SSH sessions initiated on Linux systems that are immediately followed by the creation of new executable or script files in common temporary directories such as /tmp, /dev/shm, or /var/tmp. This behavior is indicative of potential post-exploitation activity where an attacker drops tools or malicious scripts after gaining remote access.
Detects sign-ins from additional IP ranges associated with Kali365 infrastructure and proxies, which could indicate token replay attacks or other unauthorized access attempts.
Detects instances where the sshd process or PAM-related processes create or write to files within temporary directories (/tmp/ or /var/). This behavior is often associated with the staging of malicious scripts, backdoors, or tools during an attack involving credential abuse or unauthorized access via SSH.
This rule monitors for administrative VMware operations (cloning, snapshotting, or process manipulation) performed on sensitive infrastructure servers (such as Domain Controllers, PKI, Vault, or ADFS) that occur outside of a designated maintenance window by non-authorized accounts. It leverages tools like vim-cmd, esxcli, or govc to detect potential unauthorized VM manipulation that could lead to data theft, snapshot-based credential extraction, or unauthorized system changes.
This rule detects suspicious activities related to AWS S3 buckets that could indicate a bucket hijacking attempt or unauthorized replication to an external account. Specifically, it looks for two scenarios: 1) an S3 bucket being deleted and then recreated by a different AWS account within a one-hour window, suggesting a namespace hijacking, or 2) an S3 bucket being deleted while a PutBucketReplication event references an external AWS account, indicating an attempt to exfiltrate data or maintain access through replication.
Detects the installation of the Kazuar backdoor, indicated by the creation of a scheduled task or service, following initial access via stolen credentials. This detection correlates suspicious persistence mechanisms with a remote session login on a host previously identified with StealC activity, suggesting a multi-stage attack where initial compromise (StealC) leads to credential theft, followed by remote access and persistence (Kazuar).
Detects malicious npm package propagation indicative of the Miasma/Mini Shai-Hulud worm. The rule identifies suspicious patterns in AuditLogs, specifically burst npm publishes by known malicious actors or involving known malicious package names, as well as the use of weaponized GitHub Actions workflows or unauthorized snapshot branches.
This rule detects an unusual number of local or remote interactive logons (LogonType 2 or 10) by the 'SYSTEM' account within a one-hour window. While the SYSTEM account is legitimate, direct interactive logons are rare and multiple occurrences could indicate an attempt to escalate privileges or maintain persistence by an attacker.
Detects a successful self-service password reset for a privileged or high-value account when the initiating context does not match an approved helpdesk workflow. This could indicate an attacker attempting to gain access to an account by resetting its password without proper authorization.
Detects anomalous logins (impossible travel/session anomalies) utilizing the Kali365 Live desktop application User-Agent combined with IP shifting. This rule identifies instances where a user logs in with the 'kali365-live/1.0.0' User-Agent from an IP address different from a previous successful login by the same user within a 4-hour window, where the previous login used a different User-Agent.
Detects sign-ins utilizing the Kali365 Live desktop application User-Agent, which is associated with the EvilTokens threat actor tooling. This rule specifically looks for the User-Agent string "kali365-live/1.0.0" in sign-in logs.
Detects the execution of pg_dump or pg_restore initiated by Splunk processes with unexpected remote hosts or custom directories. This behavior is indicative of CVE-2026-20253 exploitation, where an unauthenticated attacker can abuse the PostgreSQL Sidecar Service to achieve remote code execution.
Detects a successful Key Vault access policy or role change that grants secret-reading capability to a user or service principal. This could indicate an adversary attempting to gain access to sensitive credentials stored in Azure Key Vault.
Detects general Entra ID sign-ins originating from Railway.com PaaS IP space, which could indicate a token replay campaign or other unauthorized access.
Correlates the successful establishment of a reverse proxy (ngrok/cloudflared) with an incoming interactive logon event originating from the local loopback, indicating the tunnel is actively being used for malicious purposes such as Terminal Server Phishing.
Monitors Cisco SD-WAN (vManage, vBond, vSmart) appliance logs for authentication events against management accounts. It specifically identifies logins from known malicious IP addresses associated with threat actor activities and flags anomalous authentication methods such as PAM/keyboard-interactive and unvalidated administrative access.
Detects potential unauthorized or rogue peer connections within a Cisco SD-WAN infrastructure. The rule monitors certificate-based authentication events for indicators of rogue peers (e.g., certificate mismatches, invalid common names) or connections originating from known malicious IP addresses associated with rogue SD-WAN activity.
This rule detects administrative changes to Cisco SD-WAN environments, including policy pushes, template attachments, device onboarding, and tunnel modifications. It uses a risk-scoring mechanism based on the type of change and whether the activity occurs outside of standard business hours (06:00 to 22:00). High-risk events (score >= 65) trigger an alert, highlighting potential unauthorized infrastructure modifications or malicious device insertion.
Detects the modification of sensitive banking or payment election records (e.g., direct deposit details) in Workday or similar HR SaaS platforms shortly after a user login event from the same source IP. This behavior is consistent with 'Payroll Pirate' style attacks where adversaries use stolen session tokens (via AiTM phishing) to redirect employee salary payments.
Detects anomalous SSH lateral movement originating from the Cisco SD-WAN Manager (vManage) to other control plane components (vSmart/vBond). This rule correlates network connections on port 22 with successful SSH logins using privileged or service-related accounts, which is indicative of potential post-exploitation activity or pivoting within an SD-WAN control plane environment.
Page 32 of 59