Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,917 detections
Filters
Last updated
All Time
Detection languages
2,237
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
806
765
576
Platforms
1,843
1,022
856
814
657
Products / Services
988
596
477
456
383
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
4,917
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
This detection identifies when a one-on-one Microsoft Teams chat is initiated with an external domain that has not been observed in previous Teams chats (past 90 days) or recent email communications (past 15 days). This may indicate a new, potentially unsolicited or suspicious contact attempting to engage with an internal user, which could represent a social engineering attempt or early-stage reconnaissance.
Detects the creation of specific files (spinstall.aspx, spinstall?.aspx, debug_dev.js) within SharePoint's Web Server Extensions template layouts directory. This activity is indicative of successful exploitation of CVE-2025-53770, a zero-day vulnerability in SharePoint that allows remote code execution.
Detects the download of a Java Archive (.jar) file from common file-sharing services like Dropbox or MediaFire. This behavior is associated with sophisticated email campaigns where attackers use PDF attachments with embedded links to trick users into downloading and executing Remote Access Trojans (RATs).
Detects suspicious Windows Shortcut (LNK) files that exhibit characteristics of malicious activity, including execution of system binaries with suspicious arguments, in-argument script execution, or overlay content execution.
Detects emails delivered to user inboxes that contain both a PDF attachment and a URL identified as a phishing link. This rule is designed to identify modern QR code phishing (quishing) campaigns where the malicious URL is embedded within the PDF to bypass traditional email security scanning. The detection relies on the email security solution's ability to extract and flag URLs from attachments, including those embedded in QR codes.
Detects network traffic to or from IP addresses known to be associated with the active exploitation of the SharePoint vulnerability CVE-2025-53770.
Analytic detect abnormal pattern of command and scripting interpreter followed by USB mount
This rule detects inbound emails containing URLs that are commonly used for OAuth consent phishing, where an attacker attempts to trick users into granting permissions to a malicious application.
Detects the mounting of an ISO file, a common technique used by threat actors, including the SLOW#TEMPEST campaign, to deliver malware. ISO files can bypass some security controls and require user interaction (double-clicking) to mount, after which malicious content can be executed.
The following analytic detects instances where a Duo admin login originates from a country outside of the United States, which may indicate suspicious or unauthorized access attempts. It works by analyzing Duo activity logs for admin login actions and filtering out events where the access device's country is not within the expected region. By correlating user, device, browser, and location details, the analytic highlights anomalies in geographic login patterns. This behavior is critical for a SOC to identify because admin accounts have elevated privileges, and access from unusual countries can be a strong indicator of credential compromise, account takeover, or targeted attacks. Early detection of such activity enables rapid investigation and response, reducing the risk of unauthorized changes, data breaches, or further lateral movement within the environment. The impact of this attack can be severe, potentially allowing attackers to bypass security controls, alter configurations, or exfiltrate sensitive information.
Detects Windows Management Instrumentation Command-line (WMIC) execution from browsers, often used in ClickFix attacks for remote process creation or system manipulation.
Identifies processes creating fake error messages with social engineering text, commonly used in ClickFix to convince users they need to “fix” something by running malicious code.
Detects a specific malicious LNK file used by the Dropping Elephant (Patchwork) APT group to deliver payloads in a campaign targeting the Turkish defense industry.
Detects when the Palo Alto Networks firewall does not block traffic to a URL known to be used in phishing attacks. An adversary can abuse this by directing victims to the phishing site, potentially stealing credentials, deploying malware, or conducting other malicious activities.
Catches MSI installer execution from browsers with silent installation flags, often used in FileFix attacks to install malware without user interaction.
Detects malicious files (web shells, backdoors, and tools) associated with the exploitation of SharePoint vulnerabilities (e.g., CVE-2025-53770) by the threat actor Storm-2603. This rule matches known file hashes.
Detects RDP configuration files (.rdp) that enable malicious RemoteApp features and extensive resource redirection, commonly abused in 'Rogue RDP' campaigns for espionage and data exfiltration.
The analytic identifies Cisco Duo admin login attempts originating from operating systems that are unusual for the environment, specifically excluding commonly used OS like Mac OS X. It analyzes Duo activity logs for 'admin_login' actions and filters out expected operating systems. The rule then aggregates events by browser, version, source IP, location, and OS details to highlight anomalies. Detecting admin logins from unexpected operating systems is crucial for a Security Operations Center (SOC) as it may indicate credential compromise, unauthorized access, or attacker activity using unfamiliar devices. Such behavior can precede privilege escalation, policy changes, or other malicious actions within the Duo environment. Early detection enables rapid investigation and response, reducing the risk of account takeover and minimizing potential damage to organizational security controls.
This rule detects exploitation attempts against SharePoint servers, specifically targeting CVE-2025-53770 (ToolShell). It has two parts: one for suspicious process creation (cmd.exe spawning powershell.exe from w3wp.exe) and another for malicious web request patterns in IIS logs (POST requests to /_layouts/15/ToolPane.aspx with specific query parameters and referrer).
Detects potential exploitation of Microsoft Entra ID (formerly Azure AD) by attackers who abuse app role permissions to backdoor federated domains and escalate to Global Administrator using forged SAML tokens
This detection rule identifies the creation of ISO (.iso) files on endpoints, specifically focusing on those created by common internet browsers and email clients. This activity is associated with the SLOW#TEMPEST campaign, which is known to distribute malware payloads via ISO files, often bundled with legitimate applications and malicious DLLs. The rule aims to detect the initial delivery vector of this threat.
Page 169 of 235