Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
43 detections
Filters
Last updated
All Time
Detection languages
29
4
3
2
2
Contributors
9
9
8
8
3
Categories
11
10
10
8
7
Platforms
28
10
8
5
1
Products / Services
16
6
4
4
4
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
3
1
IDS Classtypes
3
1
IDS Protocols
4
Detects the use of OleViewDotNet or NtObjectManager PowerShell tools to enumerate running COM host processes (e.g., dllhost.exe) and check for the absence of specific security mitigations like EOAC_NO_CUSTOM_MARSHAL or COMGLB_UNMARSHALING_POLICY_STRONG. This behavior is indicative of reconnaissance activity aimed at identifying targets for fake-marshaled CoGetInstanceFromIStorage exploit chains.
Detects a specific device-intelligence workflow pattern where an operator performs device reconnaissance (e.g., serial number checks, device model lookups) followed shortly by the generation of a malicious lure or tracking link (e.g., Five-channel lure), indicative of an attempt to gain unauthorized access to a victim device or account.
Identifies instances of Google Chrome running on endpoints with version numbers below the threshold patched for CVE-2026-85046. This detection focuses on specific build numbers (e.g., 152.0.7977.82 for Windows/Linux) to identify potentially vulnerable browser installations in the environment.
Identifies instances of Google Chrome running on endpoints with version numbers below the threshold patched for CVE-2026-85046. This detection focuses on specific build numbers (e.g., 152.0.7977.82 for Windows/Linux) to identify potentially vulnerable browser installations in the environment.
Identifies instances of Google Chrome running on endpoints with version numbers below the threshold patched for CVE-2026-85046. This detection focuses on specific build numbers (e.g., 152.0.7977.82 for Windows/Linux) to identify potentially vulnerable browser installations in the environment.
Detects host-profiling reconnaissance behavior characteristic of the CountLoader malware, where a process concurrently checks for common cryptocurrency wallet and Signal messaging application data folders alongside performing WMI-based antivirus product enumeration within a 5-minute window.
Detects silent browser-side cryptocurrency wallet fingerprinting via EIP-6963 discovery, window.ethereum probing, and wallet-extension enumeration (e.g. MetaMask, Solana) occurring together, excluding known legitimate dApp/wallet-connect domains, consistent with BlueNoroff's pre-payload wallet profiling.
Detects browser processes (Edge or Chrome) connecting to known IP geolocation or fingerprinting services within 3-5 days after a new extension has been registered. This behavior is consistent with malicious browser extension 'dormancy gating' and environment fingerprinting techniques, often used by malware (such as StegoAd) to confirm they are running on a real user host before activating payloads.
Detects potential malicious activity where a process enumerates installed software by querying the Windows Uninstall registry key (HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall) for application details such as DisplayName, Publisher, and UninstallString. This pattern is characteristic of Remcos RAT's 'ListInstalledApplications' capability to perform reconnaissance on a compromised host.
This rule detects potential information disclosure attempts by monitoring W3C IIS logs for repeated queries containing keywords like 'version', 'build', or 'debug'. A high frequency (5 or more attempts within an hour) from a single IP address suggests an adversary is trying to enumerate software versions or debug information, which can be used for further reconnaissance or exploit development.
Detects rapid enumeration of system binaries related to SSH and networking libraries (libssh2, libcurl, libgit) or version checks within a 5-minute window, which may indicate reconnaissance or pre-exploitation activity related to vulnerabilities like CVE-2026-55200.
Detects outbound UDP traffic over port 3478 (STUN) initiated by common web browsers. This pattern is commonly used by phishing-as-a-service (PaaS) platforms like Bluekit to perform WebRTC IP leak checks, potentially revealing a victim's real IP address behind a proxy or VPN. The rule excludes common communication platforms like Microsoft Teams, Zoom, and Webex to reduce false positives.
Detects read access attempts to the 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion' registry key. Adversaries often query this key during the reconnaissance phase to identify the specific version, build number, and installation details of the host operating system, which aids in tailoring further exploitation or post-exploitation activities.
Detects browser-based WebRTC STUN traffic initiated from phishing landing pages used by the Bluekit PhaaS platform. The rule identifies suspicious STUN requests originating from browsers that exhibit a WebRTC IP mismatch when compared to the active HTTPS session IP, a technique used by attackers to de-anonymize security researchers and bypass automated analysis sandboxes.
This rule detects an unusually high number of network connections made by common package managers (npm, nuget, pip) to their respective repositories. A high volume of connections within a short period (1 hour) could indicate automated activity, potential supply chain compromise, or an adversary attempting to download numerous packages for reconnaissance, staging, or malicious purposes.
Detects reconnaissance activity where PowerShell is used to enumerate installed software by querying Windows registry uninstall keys (HKLM and HKCU) via cmdlets such as Get-ItemProperty, Get-StartApps, or Get-AppxPackage. This behavior is associated with the ROOTBOY/Prinz Eugen campaign, typically performed as a precursor to ransomware deployment.
Detects fingerprinting of web application CMS versions for vulnerability research
Detects fingerprinting of web application CMS versions for vulnerability research
Detects scraping of job listings to identify employee roles and technology stack
This rule detects potential information disclosure attempts by monitoring W3C IIS logs for repeated queries containing keywords like 'version', 'build', or 'debug'. A high frequency (5 or more attempts within an hour) from a single IP address suggests an adversary is trying to enumerate software versions or debug information, which can be used for further reconnaissance or exploit development.
This rule detects attempts to fingerprint web server software versions by looking for common server headers in HTTP responses. Specifically, it triggers if a client receives an HTTP response containing 'Apache/', 'nginx/', 'IIS/', or 'PHP/' followed by a digit, indicating a version number. The rule is thresholded to trigger only after 10 such events from the same destination within 30 seconds, aiming to reduce alerts from legitimate browsing.
Page 1 of 3