Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects a process tree where Code.exe (VS Code) spawns node.exe as an intermediary process, which in turn spawns calc.exe. This matches the child_process.exec execution pattern observed when a malicious VS Code extension dependency decodes and runs an arbitrary command, demonstrating that any payload (not just calc.exe) can be executed via this chain.
This rule detects when a user containing the name "admin" in the username fails to log in via SSH.
This could indicate an attempt to access the system using administrative credentials, which may be a sign of malicious activity.
However, it is important to note that this rule may also generate false positives if legitimate users with "admin" in their usernames fail to log in due to typos or other issues.
This could indicate an attempt to access the system using administrative credentials, which may be a sign of malicious activity.
However, it is important to note that this rule may also generate false positives if legitimate users with "admin" in their usernames fail to log in due to typos or other issues.
This rule detects potentially malicious email activity that uses recruitment or career-related pretexts to target specific organizations (Boeing, Airbus, Teledyne FLIR). The detection looks for combinations of career-themed keywords in the subject or body of an email that also contain an archive file attachment (e.g., .zip, .rar, .7z) or links, which is a common tactic for delivering malware under the guise of job applications.
KQL Query from file: The Hunt for QR Phisher
Detects the use of Git commands (filter-branch, rebase -i, or force-push) that rewrite local or remote commit history. These operations are often used by adversaries to hide malicious code injections, remove evidence of unauthorized changes, or manipulate developer repository integrity.
Detects file system artifacts indicating installation of the malicious 'ascii-fetcher' VS Code extension (v1.0.0) from the Open VSX marketplace, which bundles the malicious npm dependency '@jaymara/jsononifier' to hide its logic from static analysis.
Detects inbound emails from external domains that contain both the recipient's job title and their company name in the subject or body, which is a common indicator of targeted spearphishing attacks (BEC/Whaling).
Detects instances where the same file (identified by SHA256) with common lure names like 'resume', 'headshot', or 'faceswap' is being created or modified by multiple different users across the environment. This behavior is often indicative of an adversary distributing malicious files or a coordinated effort to access sensitive or tempting filenames, potentially related to social engineering or lateral movement.
This rule detects a multi-stage attack chain originating from OAuth device code phishing. It tracks the sequence of events starting from device code authentication, followed by the registration of a new device or Primary Refresh Token (PRT) manipulation, potential password resets, and the creation of malicious inbox rules (e.g., auto-forwarding). The rule correlates these events within a 1-hour window to identify malicious intent, with critical alerts triggered if persistence mechanisms survive a password reset.
Detects instances where FortiClient EMS (versions 7.4.5 or 7.4.6) logs a 'Certificate not found in request header' error. This indicates that a client attempt to communicate with the EMS server failed due to missing certificate-based authentication, which could suggest misconfiguration, network issues, or potentially an unauthorized attempt to access the management interface.
This rule detects attempts to exploit the Nacos CVE-2021-29441 authentication bypass vulnerability. The vulnerability allows an attacker to bypass authentication by leveraging default or forged JWT tokens, specifically targeting the /nacos/ path with an Authorization header containing a Bearer token starting with 'eyJ'.
Detects non-interactive sign-ins to Azure CLI using the 'python-requests' User-Agent by non-administrative users. This pattern is associated with the LSHIY password spray campaign, which exploits the OAuth ROPC flow for credential abuse against Microsoft 365.
Detects Microsoft Exchange EWS/OWA HTTP requests containing URL-encoded file scheme indicators (e.g., 'file%3a', '%66%69%6c%65'). This activity is associated with attempts to bypass security filters via scheme smuggling, potentially to facilitate Server-Side Request Forgery (SSRF) exploitation leading to unauthorized local file access.
This rule detects potential device code phishing attempts by correlating URL click events with sign-in logs using the 'deviceCode' authentication protocol. It specifically looks for successful or failed sign-ins (result types 0, 50074, 50076, 500121) that occur after a user clicks on a URL.
Detects potential exploitation attempts against FortiClient EMS versions 7.4.5-7.4.6, specifically targeting the administration API on port 8013. The detection identifies unauthorized access attempts indicated by the log entry 'Certificate not found in request header', which correlates with exploit behavior for CVE-2026-35616.
This rule detects potential brute force authentication attempts via LDAP occurring shortly after a specific DLL (ending in 'ode.dll') is loaded on a system. This behavior may indicate an adversary is using a malicious or secondary module to facilitate credential brute forcing or unauthorized authentication attempts.
This rule detects HTTP GET requests for specific file paths associated with known malicious lure archives (e.g., YEPlayer.rar, Pis2rayVPN.zip, YEMPlayer.msi). These files are typically used in social engineering campaigns to trick users into downloading and executing malware.
Detects non-interactive sign-ins to Microsoft 365 using the OAuth Resource Owner Password Credentials (ROPC) flow via the Azure CLI. This legacy authentication method enables attackers to bypass multi-factor authentication (MFA) by submitting credentials directly to the authentication endpoint, a technique observed in password spraying campaigns.
Detects network requests targeting port 8013 that generate an error message indicating a missing certificate in the request header. This pattern is associated with attempts to exploit vulnerability CVE-2026-35616.
Detects unauthorized access attempts to MinIO object storage using the default 'minioadmin' credentials. The rule specifically flags attempts to access sensitive files like 'terraform-state' or 'credentials.json' via HTTP GET requests.
This rule detects potential lateral movement or account compromise by identifying instances where a single user account successfully logs into four or more unique computer systems via Remote Desktop (Logon Type 10) within a 30-minute window.
Page 22 of 235