Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,918 detections
Filters
Last updated
All Time
Detection languages
2,238
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
807
765
577
Platforms
1,844
1,022
856
814
658
Products / Services
988
596
477
456
383
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
4,918
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects when a user has been elevated to manage all Azure Subscriptions. This change should be investigated immediately if it isn't planned. This setting could allow an attacker access to Azure subscriptions in your environment.
Detects the Node Package Manager (npm) or npx spawning child processes commonly used to download remote files. This behavior is often seen in malicious npm packages that use post-install scripts to fetch and execute second-stage payloads, as seen with the AdaptixC2 framework delivery.
Detects the execution of ScreenConnect, a legitimate remote access tool, when it is used to establish a remote access session. The rule specifically looks for command-line arguments indicative of a guest connection to a ScreenConnect session.
Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.
Detects the command line executed when TeamViewer starts a session initiated by a remote host. This specific command line indicates that TeamViewer_Desktop.exe is being launched by TeamViewer_Service.exe with an IPC port of 5939 and module 1, which is characteristic of a remote connection being established. An investigator can verify connection details by reviewing the "incoming_connections.txt" log file in the TeamViewer folder.
The following analytic identifies potential phishing attempts blocked by Zscaler within a network. It leverages web proxy logs to detect actions tagged as HTML.Phish. The detection method involves analyzing critical data points such as user, threat name, URL, and hostname. This activity is significant for a SOC as it serves as an early warning system for phishing threats, enabling prompt investigation and mitigation. If confirmed malicious, this activity could indicate an attempt to deceive users into divulging sensitive information, potentially leading to data breaches or credential theft.
Detects potential exploitation of Cisco SNMP vulnerability (CVE-2025-20352) by identifying shell command patterns within SNMP traffic, indicative of remote code execution attempts as seen in Operation Zero Disco.
This rule detects the execution of the 'Reset-ComputerMachinePassword' PowerShell cmdlet. This cmdlet is used to change the computer account password that systems use to authenticate to domain controllers. Malicious use of this cmdlet can indicate an attempt to reset the local computer's password, potentially for privilege escalation, persistence, or defense evasion, as seen in some Qbot and ZeroLogon attacks.
Detects the creation of an MSI (Microsoft Installer) file on a device where the file's origin referrer URL indicates it was downloaded from a ZIP archive that was originally an email attachment. This could indicate a user opening a malicious ZIP file from an email, leading to the execution of an installer.
Dependabot performs a scan to detect insecure dependencies, and sends Dependabot alerts.
This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.
This rule detects when an organization owner disables Dependabot alerts private repositories or Dependabot security updates for all repositories.
This detection identifies when a user successfully authenticates from a country for the first time within a given period. It establishes a baseline of known countries for each user and alerts on any successful login originating from a country not present in that baseline. This behavior can indicate compromised credentials being used from an unusual location, or a legitimate user traveling to a new country.
This analytic is designed to identify attempts to exploit a server-side template injection vulnerability in CrushFTP, designated as CVE-2024-4040. This severe vulnerability enables unauthenticated remote attackers to access and read files beyond the VFS Sandbox, circumvent authentication protocols, and execute arbitrary commands on the affected server. The issue impacts all versions of CrushFTP up to 10.7.1 and 11.1.0 on all supported platforms. It is highly recommended to apply patches immediately to prevent unauthorized access to the system and avoid potential data compromises. The search specifically looks for patterns in the raw log data that match the exploitation attempts, including READ or WRITE actions, and extracts relevant information such as the protocol, session ID, user, IP address, HTTP method, and the URI queried. It then evaluates these logs to confirm traces of exploitation based on the presence of specific keywords and the originating IP address, counting and sorting these events for further analysis.
Detects suspicious file writes to the root directory of web applications, specifically targeting Apache or Tomcat servers. This activity often indicates an attempt to deploy malicious files like web shells or other unauthorized scripts, potentially after exploiting a public-facing application.
This correlation rule identifies multiple risk events associated with the "Living Off The Land" analytic story. It aggregates and correlates events tagged under this story, focusing on systems with a high count of distinct sources (5 or more). The rule aims to detect suspicious behavior involving the use of legitimate tools for malicious purposes, which could lead to code execution, privilege escalation, or persistence within an environment.
This rule detects suspicious failed logon attempts by monitoring specific uncommon error codes. These error codes indicate issues such as logons to disabled accounts, attempts outside authorized hours, from unauthorized workstations, or due to trust relationship failures or insufficient logon rights. Such failures can suggest an adversary attempting to bypass security controls or test account validity and permissions.
Detects the use of argument injection in the Commvault qlogin command, specifically targeting CVE-2025-57791. An attacker can inject the `-localadmin` parameter via the password field to bypass authentication and gain a privileged token.
This detection identifies potential exploitation of a critical SQL injection vulnerability in Ivanti Endpoint Manager (EPM), identified as CVE-2024-29824. The vulnerability, which has a CVSS score of 9.8, allows for remote code execution through the `RecordGoodApp` function in the `PatchBiz.dll` file. An attacker can exploit this vulnerability by manipulating the `goodApp.md5` value in an HTTP POST request to the `/WSStatusEvents/EventHandler.asmx` endpoint, leading to unauthorized command execution on the server. Monitoring for unusual SQL commands and HTTP requests to this endpoint can help identify exploitation attempts. Note that, the detection is focused on the URI path, HTTP method and status code of 200, indicating potential exploitation. To properly identify if this was successful, TLS inspection and additional network traffic analysis is required as the xp_cmdshell comes in via the request body.
The following analytic identifies attempts to exploit Jenkins Arbitrary File Read CVE-2024-23897. It detects HTTP POST requests to Jenkins URLs containing "*/cli?remoting=false*" with a 200 status code. This activity is significant as it indicates potential unauthorized access to sensitive files on the Jenkins server, such as credentials and private keys. If confirmed malicious, this could lead to severe data breaches, unauthorized access, and further exploitation within the environment.
The analytic detects attempts to exploit the Fortinet FortiNAC CVE-2022-39952 vulnerability. It identifies HTTP POST requests to the URI configWizard/keyUpload.jsp with a payload.zip file. This activity indicates an attempt to exploit a known vulnerability, potentially leading to remote code execution. If confirmed malicious, attackers could gain control over the affected system, schedule malicious tasks, and establish persistent access via a remote command and control (C2) server.
This analytic detects potential exploitation of the Ivanti Virtual Traffic Manager (vTM) authentication bypass vulnerability (CVE-2024-7593) to create new administrator accounts. The vulnerability allows unauthenticated remote attackers to bypass authentication on the admin panel and create new admin users. This detection looks for suspicious new account creation events in the Ivanti vTM audit logs that lack expected authentication details, which may indicate exploitation attempts.
The following analytic detects the creation of new ASPX files in the MOVEit Transfer application's "wwwroot" directory. It leverages endpoint data on process and filesystem activity to identify processes responsible for creating these files. This activity is significant as it may indicate exploitation of a critical zero-day vulnerability in MOVEit Transfer, used by threat actors to install malicious ASPX files. If confirmed malicious, this could lead to exfiltration of sensitive data, including user credentials and file metadata, posing a severe risk to the organization's security.
Page 158 of 235