Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18 detections
Filters
Last updated
All Time
Detection languages
9
5
2
1
1
Contributors
5
4
3
2
2
Categories
5
5
4
4
3
Platforms
8
7
5
2
2
Products / Services
6
3
3
3
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
Detects silent browser-side cryptocurrency wallet fingerprinting via EIP-6963 discovery, window.ethereum probing, and wallet-extension enumeration (e.g. MetaMask, Solana) occurring together, excluding known legitimate dApp/wallet-connect domains, consistent with BlueNoroff's pre-payload wallet profiling.
Detects the execution of ConfigurationRemotingServer.exe initiated by the Winget package manager. This activity is associated with applying system or application configuration files (e.g., .yaml configuration files) via the Windows Package Manager 'winget configure' command.
Detects Railway server OS leaking via User-Agent during automated token exchanges. This rule specifically looks for sign-in logs where the User-Agent string indicates a Linux x86_64 system and a Chrome browser version 145 or 146.
This rule detects attempts to fingerprint a browser's configuration using JavaScript by looking for the presence of 'navigator.userAgent' and 'navigator.platform' within HTTP response data. This technique is often used during reconnaissance phases by attackers to gather information about a target's browser environment.
This rule detects potential TLS client configuration fingerprinting activity. It triggers an alert when a client sends 20 or more TLS Server Name Indication (SNI) requests to a server within a 30-second window. This behavior can be indicative of reconnaissance activities where an attacker is attempting to identify services or configurations on a target network by observing TLS handshakes.
KQL Query from file: Hunting Exposed JDWP
KQL Query from file: Sentinel All-In-One IP ThreatHunt
KQL Query from file: CVE-2024-7971 Patch Prioritization
KQL Query from file: CVE-2025-4664 Chrome flaw with public exploit
KQL Query from file: HTTP Client Tools Exploitation for ATO Detection
This query searches for a string pattern detected in evasive PowerShell usage. Jupyter or SolarMarker will iterate on this pattern multiple times to read data and call additional processes. This query is not fully specific to Jupyter or SolarMarker, and will also return other malicious malware, but is unlikely to return false positives.
Microsoft has observed attackers who have gained entry to an environment via the Log4J vulnerability utilizing identifiable strings in PowerShell commands.
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_babyshark.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. It leverages Cisco Secure Firewall Threat Defense logs and focuses on events classified as: A Network Trojan was Detected, Successful Administrator Privilege Gain, Successful User Privilege Gain, Attempt to Login By a Default Username and Password, Known malware command and control traffic, Known malicious file or file based exploit, Known client side exploit attempt, Large Scale Information Leak. These classifications typically represent significant threats such as remote code execution, credential theft, lateral movement, or malware communication. Detection of these classifications should be prioritized for immediate investigation.
Detects the execution of a text-based file access or inspection utilities to read the content of /etc/sudoers in order to potentially list all users that have sudo rights.
This rule detects command-line patterns indicative of reconnaissance activities on Linux systems, specifically searching for '.htpasswd' files which often contain credentials, and files with SUID/SGID permissions ('-perm -4000') which can be exploited for privilege escalation. These commands are commonly used by attackers to gather information about the system's configuration and potential credential storage locations.
Detects events in which someone prints the contents of history files to the commandline or redirects it to a file for reconnaissance
Detects events with patterns found in commands used for reconnaissance on linux systems