Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,917 detections
Filters
Last updated
All Time
Detection languages
2,237
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
806
765
576
Platforms
1,843
1,022
856
814
657
Products / Services
988
596
477
456
383
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
4,917
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects the execution of a Remote Desktop Protocol (.rdp) file from a temporary directory associated with Microsoft Outlook. This behavior is a key indicator of the initial access phase of the "Rogue RDP" campaign, where attackers deliver malicious .rdp files via email to compromise systems.
Detects if an attacker logs on using the serial console.
Detects attempts to exploit the Sitecore Experience Platform HTML cache poisoning vulnerability (CVE-2025-53693). Attackers can send a crafted HTTP request to a specific XAML handler to poison the HTML cache, leading to website defacement or client-side code execution.
Detects attempts to exploit the Citrix NetScaler RCE vulnerability (CVE-2025-7775) by identifying a specific POST request to a vulnerable endpoint, followed by a GET request to verify code execution.
Detects the use of known malicious or suspicious User-Agent strings associated with the UNC6395 data theft campaign targeting Salesforce instances.
This detection identifies network connections to domains that may be impersonating ConnectWise or ScreenConnect for credential harvesting purposes. The logic is based on tactics observed in the MCTO3030 campaign which used domains with specific country-code TLDs or generic "connectwise" and "screenconnect" themes.
Detects suspicious child processes spawned by Citrix or Commvault services, which may indicate exploitation for initial access (T1190), as seen in MURKY PANDA campaigns involving CVE-2023-3519 and CVE-2025-3928.
Detects scenarios where an attacker rename a non admin account in order to evade SOC & operations vigilance
Detects the execution of a suspicious PowerShell dropper script, often initiated by a user clicking a malicious file (e.g., LNK). This pattern is common in phishing campaigns, including those by groups like Kimsuky. The detection looks for PowerShell commands that use common evasion techniques (like hidden windows or bypassing execution policies).
Detects SQL injection attempts targeting FortiWeb (CVE-2025-25257) in HTTP GET requests to /api/fabric/device/status. The rule identifies known exploit payloads in the Authorization header, generic SQL injection patterns, and SQL statements like DROP, DELETE, INSERT, UPDATE, CREATE. It also detects known malicious source IPs targeting the vulnerable endpoint.
Detects outbound API calls to api.github.com for repository creation or file uploads matching patterns used in the s1ngularity supply chain attack.
In May 2025, a campaign started using the Microsoft Exchange Direct Send feature to send phishing mails to organizations. This feature is designed for use by printers, scanners, cloud services and other devices that need to send messages on behalf of the company. This detection rule tries to detect the malicious mails being send via Direct Send using a couple of indicators:
- Sender email is the same as Recipient email
- SPF and DMARC both failed
- Mail is not comming in via an Exchange connector
- The sender IP address country is not a country that the user is known to login from
FYI, if you remove the country check (last line of the query), you can use the query to identify if there are legitimate mails as well. If not, you can disable the Direct Send feature in Exchange Online.
- Sender email is the same as Recipient email
- SPF and DMARC both failed
- Mail is not comming in via an Exchange connector
- The sender IP address country is not a country that the user is known to login from
FYI, if you remove the country check (last line of the query), you can use the query to identify if there are legitimate mails as well. If not, you can disable the Direct Send feature in Exchange Online.
Detects a user self-assigning access to a large number of applications in Okta within a short time frame. This behavior is associated with the threat group UNC3944 (Scattered Spider) for privilege escalation and lateral movement across SaaS applications.
This rule detects successful Remote Desktop Protocol (RDP) connections by monitoring network events where the remote port is 3389 and the connection action type is 'ConnectionSuccess'. It aims to identify potential unauthorized access, lateral movement, or audit remote administration practices.
This rule detects changes to privileged roles and group memberships within Azure Active Directory. It helps identify potential unauthorized privilege escalation, supports compliance and audit requirements, and allows correlation of identity changes with suspicious activity or alerts. The rule specifically looks for operations such as adding/removing members from roles or groups, and updating role memberships or user details, ensuring the operation was successful.
This rule detects GlobalProtect VPN login attempts originating from outside of Canada. This can help identify potential unauthorized access or policy violations where users are expected to connect from specific geographic regions.
Detects PowerShell commands, particularly those involving download and execution cradles (irm/iex), being written to the RunMRU registry key. This behavior is indicative of social engineering attacks like 'ClickFix' where users are tricked into pasting and running malicious commands via the Windows Run dialog.
This detection rule identifies suspicious logins by service accounts on devices they haven't accessed in the last 14 days. This behavior could indicate a compromised service account being used for lateral movement within the environment. Service accounts typically have a static set of devices they authenticate to, making deviations easier to spot compared to user accounts. However, some service accounts (e.g., MDI service accounts) are known to dynamically log into devices, which may require environment-specific fine-tuning to reduce false positives.
This rule audits the state of service accounts in the environment by counting total, enabled, and disabled service accounts. This helps in identifying unused or stale service accounts, ensuring only necessary service accounts are active to reduce the attack surface, and supporting compliance and security posture assessments.
This rule identifies users who have clicked on specific URLs that are known to be associated with phishing attempts. It correlates email URL information with URL click events to pinpoint users who interacted with malicious links shared via email. This is particularly useful for identifying victims of targeted phishing campaigns.
This rule identifies logon attempts on any device within 30 minutes of a user receiving an email categorized as malware, phishing, or spam. It correlates email event data with identity logon events to detect potential compromise scenarios where a user might interact with a malicious email and subsequently log on, possibly indicating a successful initial access or credential compromise.
Page 165 of 235