Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
This query is a comprehensive set of KQL (Kusto Query Language) scripts designed for threat hunting in Windows DNS environments. It leverages data from ASimDnsActivityLogs and SecurityEvent to detect various suspicious activities and potential security threats related to DNS operations.
Detects execution of a 'setup.mjs' preinstall lifecycle hook, the stage-1 loader used in the
4 August 2026 compromise of the keyv and cacheable npm namespaces. The trojanised package.json
adds "preinstall": "node setup.mjs" while leaving dist/ byte-identical to the last clean
release, so the only execution-time signal is the hook itself. The loader downloads a
standalone Bun runtime and executes an obfuscated second stage (Math_Symbol.js).
4 August 2026 compromise of the keyv and cacheable npm namespaces. The trojanised package.json
adds "preinstall": "node setup.mjs" while leaving dist/ byte-identical to the last clean
release, so the only execution-time signal is the hook itself. The loader downloads a
standalone Bun runtime and executes an obfuscated second stage (Math_Symbol.js).
Detects a single Entra ID session (SessionId) being used from two different countries within one hour at a travel velocity no physical journey could achieve. This is a signature of a stolen session/refresh token being replayed by an actor from a different location than the legitimate user.
Detects the Payroll Pirates (Storm-2755) AiTM phishing redirect chain: Google Meet/Ads redirector, an AWS S3 intermediate hop, and final resolution of a previously-unseen domain, indicating completion of the multi-hop chain to an AiTM proxy.
Detects creation of the stage-2 payload files distributed with the compromised keyv and
cacheable packages. Math_Symbol.js is a ~728 KB Bun bundle shipped in the tarball and written
to disk as math_init.js by the loader; bun-dl-* directories are used to stage the downloaded
Bun runtime. These filenames are specific to the campaign and should be treated as high
fidelity indicators.
cacheable packages. Math_Symbol.js is a ~728 KB Bun bundle shipped in the tarball and written
to disk as math_init.js by the loader; bun-dl-* directories are used to stage the downloaded
Bun runtime. These filenames are specific to the campaign and should be treated as high
fidelity indicators.
Temporal correlation of the two highest-confidence stages of the keyv/cacheable compromise:
a setup.mjs preinstall hook executing, followed within 15 minutes on the same host by a Bun
runtime executing from a staging or node_modules path. Either alone is tunable noise on a
developer estate; the pair is the campaign. Use this as the alerting rule and keep the base
rules at correlation-input severity.
a setup.mjs preinstall hook executing, followed within 15 minutes on the same host by a Bun
runtime executing from a staging or node_modules path. Either alone is tunable noise on a
developer estate; the pair is the campaign. Use this as the alerting rule and keep the base
rules at correlation-input severity.
This rule identifies successful user sign-ins originating from IP addresses associated with residential or commercial VPN ASNs that have not been observed in the user's historical sign-in data (past 30 days). By comparing current activity against a baseline of known user locations, it flags potentially unauthorized access through masked connections.
Slack Anomalous Activity
Cortex XDR
This rule detects anomalous activity reported by Slack's internal anomaly detection system. This includes events such as impossible travel, new device access, suspicious IP changes, and other behavioral anomalies that Slack identifies. The rule extracts relevant user and context information for further investigation.
This rule identifies successful user sign-ins originating from IP addresses associated with residential or commercial VPN ASNs that have not been observed in the user's historical sign-in data (past 30 days). By comparing current activity against a baseline of known user locations, it flags potentially unauthorized access through masked connections.
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
Detects HTTP requests to the WordPress REST batch endpoint (/wp-json/batch/v1 or /?rest_route=/batch/v1) carrying user agents associated with public wp2shell proof-of-concept tooling. This targets the pre-auth route confusion and SQL injection primitive in WordPress Core (CVE-2026-63030, CVE-2026-60137) that leads to full remote code execution.
Detects a phishing page's /api/config fetch used to stage ClickFix instructions, requiring a Referer indicating an impersonated CRM login page (NetSuite, Odoo, HubSpot, or Salesforce) while excluding requests to the genuine vendor domains.
Detects CVE-2026-33824 IKE VPN endpoint exploitation traffic (UDP 500/4500) correlated within a 5-minute window with a subsequent outbound reverse-shell callback from the same host.
This rule monitors Zscaler web proxy logs to identify potential unauthorized account access by flagging two types of anomalous geographic activity: Impossible Travel (user access from two different countries within a short time window) and New Country for Identity (the first instance of an account accessing resources from a specific country).
Detects unauthenticated WebSocket upgrade requests to a terminal/shell-related URI path or subprotocol, lacking Authorization or Cookie headers, indicative of unauthenticated web-terminal exploitation.
Detects HTTP requests to the WordPress REST batch endpoint (/wp-json/batch/v1 or /?rest_route=/batch/v1) carrying user agents associated with public wp2shell proof-of-concept tooling. This targets the pre-auth route confusion and SQL injection primitive in WordPress Core (CVE-2026-63030, CVE-2026-60137) that leads to full remote code execution.
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
Correlates an external Microsoft Teams helpdesk-impersonation contact event with subsequent remote access tool installation (Quick Assist/RemSupp/DWAgent/AnyDesk) and Chaos ransomware encryption/ransom note deployment (readme.chaos.txt) occurring within a 17-hour window, consistent with the STAC4749 campaign's observed under-17-hour intrusion-to-encryption timeline.
This rule monitors Zscaler web proxy logs to identify potential unauthorized account access by flagging two types of anomalous geographic activity: Impossible Travel (user access from two different countries within a short time window) and New Country for Identity (the first instance of an account accessing resources from a specific country).
This rule monitors Okta system logs for lifecycle events related to inbound Identity Providers (IdP), specifically creation, modification, activation, deactivation, or deletion. It flags these changes when initiated by clients identified as proxies or associated with known abused ASNs. This activity is indicative of potential cross-tenant impersonation where an attacker with administrative access adds a malicious IdP to federate and impersonate organizational users.
BlueNoroff ClickFix typosquatted meeting domain contacted (TLS SNI)
Page 18 of 235