Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
34 detections
Filters
Last updated
All Time
Detection languages
12
11
6
4
1
Contributors
13
6
5
3
2
Categories
14
12
8
7
5
Platforms
18
17
8
6
5
Products / Services
12
10
6
6
3
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
IDS Classtypes
6
IDS Protocols
4
2
Detects wildcard TLS certificates on cheap TLDs commonly used for attack infrastructure
This rule detects HTTP POST requests where the URI contains both 'wp-content' and 'uploads', indicating potential command and control (C2) communication from a compromised website, likely a WordPress site. The rule specifically looks for requests with a body size greater than 500 bytes, suggesting data exfiltration or command execution.
This detection identifies the execution of suspicious shell commands (such as download cradles, reverse shells, or unexpected GUI applications like Calculator) spawned as child processes of the Claude Code CLI ('claude'). This activity is indicative of potential Remote Code Execution (RCE) through the exploitation of malicious hooks in `.claude/settings.json` or malicious MCP server commands, as described in CVE-2025-59536.
Detects network traffic to known Tier One Command and Control (C2) domains used by IPIDEA-affiliated SDKs (PacketSDK, CastarSDK, EarnSDK, HexSDK) for device enrollment and tasking.
This rule detects the execution of known proxyware applications such as Infatica, Honeygain, and IPRoyal by looking for specific command-line arguments. Proxyware applications monetize unused internet bandwidth by routing traffic through the user's device, which can pose security and privacy risks.
Detects program executions in suspicious non-program folders related to malware or hacking activity
This rule detects the creation of temporary files within the WebDAV TfsStore directory that have suspicious file extensions. Attackers can leverage WebDAV to force authentication or to drop malicious files onto a system. The presence of executable or archive file extensions in this specific temporary directory is highly indicative of malicious activity, potentially related to initial access or resource development.
Windows Update Error
Sigma
Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.
Detects the creation of WebDAV temporary files with potentially suspicious extensions
This rule detects attempts to execute files from external WebDAV shares. It specifically looks for HTTP GET requests where the User-Agent header starts with 'Microsoft-WebDAV-MiniRedir/' and the requested URI ends with common executable or script file extensions. This behavior is often observed in initial access campaigns where adversaries leverage WebDAV to deliver and execute malicious payloads.
Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.
This rule detects the execution of programs from suspicious directories on Linux systems. These directories are commonly used by malware or attackers for staging and executing malicious payloads, including temporary folders, web server directories, and data directories of typically exploited services like PostgreSQL, MySQL, and FTP. The rule specifically looks for SYSCALL events where the executable path starts with one of the predefined suspicious paths.
Windows Update Error
Sigma
Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.
Page 2 of 2