Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects instances where an FTP service on an OpenCanary honeypot has had a login attempt. This indicates an adversary is attempting to access or interact with the honeypot's services, which could be part of reconnaissance, initial access, or lateral movement activities.
Detects exploitation attempts targeting Arcadyan routers, specifically looking for path traversal (CVE-2021-20090) and configuration file injection (CVE-2021-20091) vulnerabilities. The rule identifies requests containing '..%2f' (URL-encoded path traversal) and, for the configuration file injection, also 'apply_abstract.cgi', combined with requests to unauthenticated paths.
Detects potential exploitation of CVE-2021-26084, a Confluence RCE using OGNL injection. The rule looks for specific POST requests to Confluence endpoints, either '/pages/createpage-entervariables.action' with a 'SpaceKey=x' parameter or '/doenterpagevariables.action' with a 'u0027' string in the POST body's 'queryString' parameter. It specifically targets requests from 'anonymous' users that result in a 200 HTTP status code.
This rule detects web traffic to a recently expired domain followed by the creation of an executable (.exe) file on the same host. It correlates network access events with WHOIS data to identify expired domains and then looks for subsequent file creation events where the file path ends with '.exe'. The file creation must occur after the network access event on the same principal hostname.
This rule detects the creation or launch of processes or files that have a SHA256 hash matching an Indicator of Compromise (IOC) from MISP, specifically when the file is identified by VirusTotal as an MS Office DOCX file type. It correlates process/file events with threat intelligence data to identify potentially malicious activity involving weaponized documents.
This rule detects a sequence of events indicating the creation of a user account, a successful login by that user, and the subsequent deletion of the same user account within a 4-hour timeframe. This pattern is often indicative of an adversary creating temporary accounts for malicious activities, using them, and then removing them to cover their tracks or evade detection. The rule specifically targets Windows login events (event code 4624).
Detects strong indicators of a successful device code phishing attack. This rule correlates email events containing Microsoft device login URLs with subsequent Microsoft Entra ID authentication attempts that result in a specific error code (50199 or 0), indicating the user was prompted to confirm the application. The time window for correlation is set to 16 minutes, accounting for the typical 15-minute expiration of device codes.
Detects Microsoft Word loading an Add-In (.wll) file, which can be used by threat actors for initial access or persistence. This rule specifically looks for the 'ImageLoaded' event where the loaded file has a '.wll' extension and the 'Image' (process) is 'winword.exe'.
Detects instances where an FTP service on an OpenCanary node has had a login attempt.
Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.
Detects DNS queries initiated by "QuickAssist.exe" to Microsoft Quick Assist primary endpoint that is used to establish a session.
Allowed Logins from Terminated Employees
Detects when an account successfully recovers a Local Administrator Password Solution (LAPS) password from Microsoft Entra ID. This activity is logged in Azure audit logs under the 'Device' category with the activity type 'Recover device local administrator password' and additional details indicating 'Successfully recovered local credential by device id'. This event can signify an attacker attempting to gain elevated privileges or maintain persistence by obtaining local administrator credentials.
This analytic detects exploitation activity of CVE-2023-27532 using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signature 61514 (Veeam Backup and Replication credential dump attempt) is followed within a 5-minute window by 64795 (Veeam Backup and Replication xp_cmdshell invocation attempt), which detects the use of `xp_cmdshell`, a common post-exploitation technique. If confirmed malicious, this behavior is highly indicative of a successful exploitation of CVE-2023-27532, followed by remote command execution or credential dumping.
Detects suspicious SQL query keywords that are often used during reconnaissance, data exfiltration, or destructive activities. This includes keywords like 'drop', 'truncate', 'dump', and 'select *', which can indicate attempts to manipulate database structures, extract sensitive information, or perform denial-of-service attacks.
Detects POST requests to the F5 BIG-IP iControl Rest API "bash" endpoint, which allows the execution of commands on the BIG-IP
Detects Octopus Scanner Malware.
Detects potentially suspicious processes being spawned by a web server process which could be the result of a successfully placed web shell or exploitation
Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0. CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass, which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through template injection. This sequence enables unauthenticated remote code execution, significantly increasing the impact of exploitation.
Detects potential exploitation attempt of CVE-2023-1389, an Unauthenticated Command Injection vulnerability in TP-Link Archer AX21 routers. The rule looks for specific URI patterns and keywords indicative of an attempt to inject commands via the 'country' parameter.
This rule detects attempts to proxy web pages through the HTTPPROXY service on an OpenCanary honeypot. This indicates that an attacker or automated tool has interacted with the honeypot's HTTP proxy, potentially attempting to use it for further malicious activity or reconnaissance.
Page 212 of 235