Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,917 detections
Filters
Last updated
All Time
Detection languages
2,237
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
806
765
576
Platforms
1,843
1,022
856
814
657
Products / Services
988
596
477
456
383
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
4,917
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
This rule detects suspicious ad click traffic that routes through Google Ad Services It specifically looks for URLs containing Google Click Identifier (gclid), an ad URL, and a placement ID, while excluding legitimate ad routing services. This could indicate ad fraud or malvertising.
Most but not all clicks on Google ads are routed this way.
Most but not all clicks on Google ads are routed this way.
This analytic monitors Windows RDP client connection sequence events (EventCode 1024) from the Microsoft-Windows-TerminalServices-RDPClient/Operational log. These events track when RDP ClientActiveX initiates connection attempts to remote servers. The connection sequence is a critical phase of RDP where the client and server exchange settings and establish common parameters for the session. Monitoring these events can help identify unusual RDP connection patterns, potential lateral movement attempts, unauthorized remote access activity, and RDP connection chains that may indicate compromised systems.
This detection identifies suspicious authentication failure patterns that may indicate brute-force attacks. It detects four common scenarios:
- Repeated failed login attempts to a single account from a single IP address.
- Distributed login attempts to a single account from multiple IPs.
- A single IP address targeting multiple accounts.
- Broad-scale attempts involving multiple accounts and multiple IPs in a short timeframe.
This rule focuses on failed login attempts only and is intended for early brute-force detection and threat hunting.
Note:
Consider tuning the TimeWindow (default: 10 minutes) and Threshold (default: 5 attempts) values to reflect your organization’s normal login activity. A more permissive or stricter threshold may be necessary depending on your environment (e.g., high-traffic services, mobile users, VPNs).
Includes both a readable union-based version and a compact case()-based variant for performance-conscious deployments.
- Repeated failed login attempts to a single account from a single IP address.
- Distributed login attempts to a single account from multiple IPs.
- A single IP address targeting multiple accounts.
- Broad-scale attempts involving multiple accounts and multiple IPs in a short timeframe.
This rule focuses on failed login attempts only and is intended for early brute-force detection and threat hunting.
Note:
Consider tuning the TimeWindow (default: 10 minutes) and Threshold (default: 5 attempts) values to reflect your organization’s normal login activity. A more permissive or stricter threshold may be necessary depending on your environment (e.g., high-traffic services, mobile users, VPNs).
Includes both a readable union-based version and a compact case()-based variant for performance-conscious deployments.
This rule detects when an email with a detected threat (e.g., malware, phishing) has an attachment that is subsequently observed on an endpoint device. This indicates that a malicious attachment from an email was downloaded and executed or saved on a device.
This rule detects the installation of specific malicious open-source packages using npm or pip. It looks for process executions of 'npm.exe', 'pip.exe', 'pip3.exe', 'npm', or 'pip3' with 'install' in their command line, specifically targeting known malicious package names like 'winston-compose', 'nodemailer-helper', 'servula', 'velocky', 'vite-postcss-helper', 'pycryptoconf', and 'pycryptoenv'. This activity is indicative of supply chain compromise attempts, potentially by groups like Lazarus Group, who have been known to leverage such tactics.
This rule detects instances where an email with identified threats (e.g., malware, phishing) is received and a URL within that email is subsequently clicked by a user. It correlates email threat information with URL click events to identify successful user interaction with malicious links.
Detects the connection of an IP KVM (Keyboard, Video, Mouse) device, which could be used for unauthorized remote access or data exfiltration.
This rule detects instances where a user clicks on a URL within an email, and subsequently, the email is moved to quarantine. This sequence of events suggests that the email was initially delivered, a user interacted with a potentially malicious link, and then a post-delivery security action (quarantine) was taken, indicating a delayed detection of a threat, likely phishing or malware.
This rule detects email events that have an identified threat name and are associated with a URL click event. This combination suggests a user has clicked on a malicious link delivered via email.
This analytic leverages alerts from Splunk AppDynamics SecureApp to identify and monitor exploit attempts targeting business applications. It specifically looks for vulnerabilities in web applications, including injection attacks (SQL, API abuse), deserialization vulnerabilities, remote code execution attempts, LOG4J, and zero-day attacks. These attacks typically aim to gain unauthorized access, exfiltrate sensitive data, or disrupt application functionality. Splunk AppDynamics SecureApp provides real-time detection by analyzing application-layer events and correlating attack behavior with known vulnerability signatures, categorizing attack severity, providing visibility into attacker tactics, and generating risk-based scoring and contextual alerts.
This rule detects network connections, email activity, URL clicks, and Teams messages that involve domains commonly used by threat actor group Scattered Spider. It specifically looks for domains containing '-servicedesk.', '-okta.', '-sso.', '-cms.', '-helpdesk.', or 'oktalogin-'. The rule aims to identify potential phishing attempts or suspicious activity targeting SSO/helpdesk credentials by monitoring interactions with these specific domain patterns across multiple data sources.
Detects the installation of specific malicious versions of several npm packages. Threat actors gained access to maintainer accounts via a phishing campaign and published compromised versions containing malware. The payloads ranged from a Windows-based information stealer (Scavenger) to a cross-platform JavaScript backdoor.
Detects attempts to exploit multiple buffer overflow vulnerabilities (CVE-2025-8184, CVE-2025-8169, CVE-2025-8168) in D-Link DIR-513 routers via the 'curTime' parameter in formSetWan endpoints.
The analytic detects an unusually high number of denied Multi-Factor Authentication (MFA) requests for a single user within a 10-minute window, specifically when more than nine MFA prompts are declined. It leverages Azure Active Directory (Azure AD) sign-in logs, focusing on "Sign-in activity" events with error code 500121 and additional details indicating "MFA denied; user declined the authentication." This behavior is significant as it may indicate a targeted attack or account compromise attempt, with the user actively declining unauthorized access. If confirmed malicious, it could lead to data exfiltration, lateral movement, or further malicious activities.
Detects the reconfiguration of a virtual machine where a virtual disk (.vmdk) from a different, often critical, VM is attached. This is a key tactic used by threat actors like UNC3944 to perform offline credential theft by mounting a Domain Controller's disk to a staging VM to access the NTDS.dit file.
Detects network communication patterns associated with Scattered Spider threat group, including known C2 domains, IP addresses, and characteristic domain patterns used for phishing and command and control operations.
The following analytic detects the creation of registry artifacts when an ISO container is opened, clicked, or mounted on a Windows operating system. It leverages data from the Endpoint.Registry data model, specifically monitoring registry keys related to recent ISO or IMG file executions. This activity is significant as adversaries increasingly use container-based phishing campaigns to bypass macro-based document execution controls. If confirmed malicious, this behavior could indicate an initial access attempt, potentially leading to further exploitation, persistence, or data exfiltration within the environment.
Detects the creation of files with suspicious file extensions in the temporary directory that Outlook uses when opening attachments. This can be used to detect spear-phishing campaigns that use suspicious files as attachments, which may contain malicious code.
Detects suspicious file writes to SharePoint layouts directory which could indicate webshell activity or post-exploitation. This behavior has been observed in the exploitation of SharePoint vulnerabilities such as CVE-2025-49704, CVE-2025-49706 or CVE-2025-53770.
This rule detects potential SQL injection attempts by looking for specific keywords and patterns within the 'cs_uri_query' field of Cloudflare WAF logs. These patterns, such as 'UNION SELECT', '' OR 1=1', 'information_schema', and '--', are commonly used in SQL injection attacks to extract information, bypass authentication, or comment out parts of SQL queries. The rule aims to identify malicious requests targeting web applications that could lead to unauthorized database access or manipulation.
📌 Description
Threat actors frequently register lookalike domains to support malicious activities such as phishing attacks, drive-by compromises, and command-and-control (C2) operations. This KQL hunting query is designed to help identify potential phishing and typosquatting domains that may be targeting your organization or its third-party vendors.
🔍 Threat Intelligence Feed
The hunting query utilizes data from the SANS Internet Storm Center (ISC) API, which provides access to newly registered domains.
API Endpoint:
https://isc.sans.edu/api/recentdomains/today?json
Use Cases:
Threat intelligence enrichment
Detection of suspicious or malicious domains
Security log correlation
Returned Data Fields:
Domain name
Registration date
IP address
Type
Additional metadata (if available)
Query by Date (Optional):
Example: https://isc.sans.edu/api/recentdomains/2025-07-08?json
🎯 ATT&CK Framework Mapping
Technique: Acquire Infrastructure: Domains
ID: T1583.001
Reference: MITRE ATT&CK
Threat actors frequently register lookalike domains to support malicious activities such as phishing attacks, drive-by compromises, and command-and-control (C2) operations. This KQL hunting query is designed to help identify potential phishing and typosquatting domains that may be targeting your organization or its third-party vendors.
🔍 Threat Intelligence Feed
The hunting query utilizes data from the SANS Internet Storm Center (ISC) API, which provides access to newly registered domains.
API Endpoint:
https://isc.sans.edu/api/recentdomains/today?json
Use Cases:
Threat intelligence enrichment
Detection of suspicious or malicious domains
Security log correlation
Returned Data Fields:
Domain name
Registration date
IP address
Type
Additional metadata (if available)
Query by Date (Optional):
Example: https://isc.sans.edu/api/recentdomains/2025-07-08?json
🎯 ATT&CK Framework Mapping
Technique: Acquire Infrastructure: Domains
ID: T1583.001
Reference: MITRE ATT&CK
Page 168 of 235