Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
292 detections
Filters
Last updated
All Time
Detection languages
131
68
27
24
14
Contributors
66
57
36
28
15
Categories
89
80
43
42
41
Platforms
103
90
45
42
29
Products / Services
69
46
31
25
25
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
10
8
5
5
5
IDS Classtypes
16
6
2
1
IDS Protocols
12
7
4
1
Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS
server, creates a file with suspicious file type, indicating that it may be an executable, script file,
or otherwise unusual.
server, creates a file with suspicious file type, indicating that it may be an executable, script file,
or otherwise unusual.
Detects instances where an SSH service on an OpenCanary node has had a login attempt.
Detects successful logon from public IP address via RDP. This can indicate a publicly-exposed RDP port.
Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.
Detects a failed logon attempt from a public IP. A login from a public IP can indicate a misconfigured firewall or network boundary.
This rule detects the presence of newly exposed risky web components, such as administrative panels or development tools, that have been discovered by Microsoft Defender External Attack Surface Management (EASM). The rule identifies components from a predefined list of 'risky_components' that have been seen for the first time within the last 7 days, indicating a recent exposure that could increase the attack surface.
Detects instances where an RDP service on an OpenCanary node has had a connection attempt.
This rule detects potential GraphRunner activity in Azure environments by identifying suspicious authentication attempts to Microsoft Graph using the 'deviceCode' authentication protocol, combined with specific user agent strings associated with the GraphRunner tool. It categorizes detections into high confidence (both device code and suspicious user agent), device code authentication only, or suspicious user agent only.
This rule detects Azure DevOps activities originating from new or rarely seen IP addresses outside of defined business hours. It establishes a baseline of historical IP addresses and flags activities from IPs that have been seen for fewer than a specified number of days, indicating potentially suspicious access.
This rule detects Microsoft Teams chat or call activity initiated by external users whose domains are not present in a pre-defined whitelist. It specifically looks for 'ChatCreated' or 'CallParticipantDetail' actions from external users and filters out activity from known, whitelisted external domains. This can help identify potentially unauthorized or suspicious communication with external entities.
Hunts for unusual external SSH access patterns indicating Technique T1133
Hunts for unusual external SSH access patterns indicating Technique T1133
This rule detects inbound SSH connections originating from external IP addresses to systems running SSH services. It specifically looks for successful incoming network connections where the destination port is commonly associated with SSH (22, 222, 2222, 8022) or the source process name is an SSH daemon (sshd, dropbear). The rule explicitly excludes connections from private IP ranges and certain common web server processes on standard web ports to reduce false positives. The threat model includes unauthorized external SSH access, brute-force/credential-stuffing attacks, backdoor SSH daemons, compromised servers accepting attacker sessions, and reverse shell callbacks.
This rule detects successful SSH authentication attempts originating from IP addresses that are not classified as private (non-RFC1918). It specifically looks for log entries indicating 'Accepted password' or 'Accepted publickey' and then filters out source IP addresses that fall within common private IPv4 ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16, 127.0.0.0/8, 169.254.0.0/16). The rule is designed to identify SSH access from external networks, which might be unusual in environments where SSH is expected to be primarily internal. It does not account for IPv6 private addresses.
Detects successful VPN connections from various common security devices logging to CommonSecurityLog. Monitoring successful VPN logins is crucial for tracking remote access and identifying potential unauthorized access, especially when correlated with other events like logins from unusual locations or impossible travel scenarios.
Detects network traffic on TCP port 18789, the default gateway port for OpenClaw. Monitoring for unauthorized external access to this port helps identify exposed admin dashboards or exploitation.
This rule detects successful sign-ins to Azure Active Directory (AAD) from IP addresses outside of Australia and New Zealand, where the User-Agent string matches a list of known suspicious User-Agents. It filters out many legitimate User-Agents to reduce false positives, including those from Microsoft applications, mobile devices, and common tools.
This rule detects successful sign-ins to Azure Active Directory (AAD) from IP addresses outside of New Zealand and Australia, where the User-Agent string matches a list of known suspicious User-Agents. It filters out many legitimate User-Agents to reduce false positives, including those from Microsoft applications, mobile devices, and common system services. The rule aims to identify potential unauthorized access attempts or compromised accounts leveraging unusual client software or scripts.
This rule detects Microsoft Teams chat or call activity initiated by external users whose domains are not present in a pre-defined whitelist. It specifically looks for 'ChatCreated' or 'CallParticipantDetail' actions from external users and filters out activity from known, whitelisted external domains. This can help identify potentially unauthorized or suspicious external communication within Microsoft Teams.
This rule detects successful user sign-ins to Azure AD from IP addresses located outside of New Zealand and Australia, where the User-Agent string matches a known list of suspicious user agents. It filters out common legitimate user agents to reduce false positives.
Detects incoming network traffic from external IP addresses to common AI agent and model gateway ports (e.g., Ollama, vLLM, ClawdBot). This could indicate an exposed, unauthenticated service vulnerable to hijacking, potentially leading to unauthorized access or data exfiltration.
Page 10 of 14