Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects common SQL injection attack patterns such as UNION SELECT, OR 1=1, DROP TABLE, and others within the request URI of Caddy web server logs.
Detects incoming HTTP requests to a Caddy web server using the TRACE or TRACK methods. These methods are rarely used in legitimate production traffic and are frequently associated with Cross-Site Tracing (XST) attempts, which can be used to bypass security controls and steal sensitive data such as cookies.
KQL Query
Detects local/remote file inclusion attempts via php wrappers and similar schemes.
Detects upload requests targeting executable or server-side script file extensions.
Detects HTTP upload attempts to web directories where a request URL contains a suspicious double file extension pattern (e.g., a web shell extension followed by an image or document extension). This technique is commonly used to bypass web server or application-level security filters that check for forbidden file types by looking at the final extension while the server might execute the underlying script.
Detects the use of non-standard, unusual, or potentially dangerous HTTP methods within Caddy web server logs, which may indicate reconnaissance, web application exploitation, or attempts to abuse server functionalities like WebDAV.
Detects HTTP upload requests directed to common web directory paths that contain suspicious file extensions, specifically archive formats (e.g., zip, rar, tar) or macro-enabled Office documents (e.g., docm, xlsm). This behavior is often associated with the delivery of malware payloads.
This rule detects messages sent or chats created in Microsoft Teams by external or guest users where the chat name or message content impersonates IT support, helpdesk, or other official organizational entities. It specifically looks for keywords commonly used in phishing attempts to trick users into believing the sender is a legitimate internal service.
Detects external Microsoft Teams calls involving screen sharing and potential impersonation of trusted entities. The rule filters for calls where the `identity_name` (likely the external caller's domain or display name) matches patterns associated with free/abused TLDs, cheap/throwaway TLDs, phishing-common TLDs, high-risk specialty TLDs, PHaaS kit TLDs, or common impersonated entity names (e.g., 'microsoft', 'helpdesk', 'it.support'). This combination indicates a high risk of credential theft or remote access tool installation via vishing tactics.
This rule aggregates sign-in log activity for a specific user to identify the volume and distribution of authentication attempts across different IP addresses, applications, and client types within a specified time range. It is primarily used for identifying anomalies in access patterns that might indicate credential abuse or unauthorized access.
Detects files with names containing '-EMS' or the specific string 'PO26-EMS134.zip' being created or written to the 'Downloads' directory by common web browsers. This pattern is often associated with phishing campaigns distributing malicious attachments.
Detects Zscaler ZIA logs identified as Advanced Threat Protection events, specifically targeting URL categories like Phishing and WebSpam, or traffic classified as Advanced Security Risk. The rule aggregates these events by user to identify potential malicious activity, flagging sessions where threats were allowed as higher severity.
Detects emails containing attachments with suspicious file extensions such as '.exe', '.scr', or '.vbs'. These file types are commonly used in phishing and malware delivery campaigns.
Detects external Microsoft Teams calls involving screen sharing and potential impersonation of trusted entities. The rule filters for calls where the `identity_name` (likely the external caller's domain or display name) matches patterns associated with free/abused TLDs, cheap/throwaway TLDs, phishing-common TLDs, high-risk specialty TLDs, PHaaS kit TLDs, or common impersonated entity names (e.g., 'microsoft', 'helpdesk', 'it.support'). This combination indicates a high risk of credential theft or remote access tool installation via vishing tactics.
Detects instances where Zscaler AI Protect (AI Guard) flags attempts to perform prompt injection or jailbreak against Large Language Model (LLM) or GenAI applications. The rule monitors blocked requests and allowed requests that exceed a high confidence score threshold (0.75), identifying potential malicious interactions with generative AI services.
Detects a significant increase in Zscaler Risk360 risk scores or the emergence of new high-impact security insights. This rule monitors for category-specific risk spikes (External Attack Surface, Compromise, Lateral Propagation, or Data Loss) that exceed a defined delta threshold or are flagged as Critical/High severity, serving as a posture-based alert for security investigation.
This rule detects messages sent or chats created in Microsoft Teams by external or guest users where the chat name or message content impersonates IT support, helpdesk, or other official organizational entities. It specifically looks for keywords commonly used in phishing attempts to trick users into believing the sender is a legitimate internal service.
This rule detects successful connection events to Palo Alto GlobalProtect gateways originating from known malicious source IP addresses associated with the exploitation of CVE-2026-0257, or connections initiated by hosts using suspicious or default placeholder device names/host IDs. It effectively identifies potential exploitation attempts or unauthorized access to corporate VPN gateways.
This rule detects successful connection events to Palo Alto GlobalProtect gateways originating from known malicious source IP addresses associated with the exploitation of CVE-2026-0257, or connections initiated by hosts using suspicious or default placeholder device names/host IDs. It effectively identifies potential exploitation attempts or unauthorized access to corporate VPN gateways.
Detects a significant increase in Zscaler Risk360 risk scores or the emergence of new high-impact security insights. This rule monitors for category-specific risk spikes (External Attack Surface, Compromise, Lateral Propagation, or Data Loss) that exceed a defined delta threshold or are flagged as Critical/High severity, serving as a posture-based alert for security investigation.
Page 17 of 235