Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
97 detections
Filters
Last updated
All Time
Detection languages
58
14
10
9
3
Contributors
31
14
8
8
5
Categories
47
40
26
19
14
Platforms
50
21
13
11
9
Products / Services
17
14
13
9
8
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
4
1
1
IDS Classtypes
6
6
2
IDS Protocols
4
4
3
2
This rule identifies and aggregates blocked requests from Imperva WAF logs, grouping them by source IP address and then by the owning organization (ASN). It helps to detect and analyze potential attack campaigns or coordinated malicious activity originating from specific organizations or IP ranges. The rule focuses on security, session, and visitor blocks, providing details on attack names, query strings, referrers, and URLs.
This rule detects a high rate of ICMP echo requests from a single source to a server within the home network, indicating a potential Denial of Service (DoS) attack. It triggers an alert if more than 50 ICMP echo requests are observed from the same source within a 1-second interval.
Detects potential Distributed Denial of Service (DDoS) attacks or rate limit abuse against Ollama API endpoints by identifying excessive request volumes from individual client IP addresses. This detection monitors GIN-formatted Ollama server logs to identify clients generating abnormally high request rates within short time windows, which may indicate automated attacks, botnet activity, or resource exhaustion attempts targeting local AI model infrastructure.
Detects attempts to exploit multiple vulnerabilities (CVE-2025-52905, CVE-2025-52906, CVE-2025-52907) in TOTOLINK X6000R routers. Attackers can leverage argument injection, unauthenticated command injection, and security bypasses through the '/cgi-bin/cstecgi.cgi' endpoint to achieve remote code execution or denial of service.
This detection identifies a single MAC address rapidly appearing on multiple switch ports within a short time frame. This behavior, known as MAC flapping, is a strong indicator of a network loop, which can cause broadcast storms and degrade or disable network services.
This KQL Query is oriented to extract the different bits of TCP Flags which helps to review the different state of the connections and identify possible threats associated.
In addition, it allows to filter by specific TCP Flag to detect specific threats based on every case.
In addition, it allows to filter by specific TCP Flag to detect specific threats based on every case.
No description available.
The following analytic detects a blocked connection event by identifying a "Block" value in the action field. It leverages logs from Cisco Secure Firewall Threat Defense devices. This activity is significant as it can identify attempts from users or applications initiating network connection to explicitly or implicitly blocked range or zones. If confirmed malicious, attackers could be attempting to perform a forbidden action on the network such as data exfiltration, lateral movement, or network disruption.
Analyze Mail Bomb Attack by ISP
KQL Query
KQL Query from file: CVE-2024-3393 DDOS Detection
KQL Query
This query helps reviewing recipients who are potentially victim of email bombing attacks
This query helps to hunt for possible email bombing attacks in Microsoft Defender for Office 365.
Microsoft has observed attackers exploiting vulnerabilities associated with Log4J.
'This hunting query looks for users who have multiple failed queries in a short space of time.'
'This query looks for Microsoft Defender AV detections related to Europium actor.
In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.
Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government '
In Microsoft Sentinel the SecurityAlerts table includes only the Device Name of the affected device, this query joins the DeviceInfo table to clearly connect other information such as Device group, ip, etc. This would allow the Microsoft Sentinel analyst to have more context related to the alert, if available.
Reference: https://www.microsoft.com/security/blog/2022/09/08/microsoft-investigates-iranian-attacks-against-the-albanian-government '
'Identifies instances where Wazuh logged over 400 '403' Web Errors from one IP Address. To onboard Wazuh data into Sentinel please view: https://github.com/wazuh/wazuh-documentation/blob/master/source/azure/monitoring%20activity.rst'
Detects command line patterns used by BlackByte ransomware in different operations
Detects command line patterns used by BlackByte ransomware in different operations
Microsoft has observed threat actors exploiting vulnerabilities associated with Log4J.
Page 4 of 5