Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
The following analytic detects potential exploitation of the Adobe ColdFusion vulnerability, CVE-2023-26360, which allows unauthenticated arbitrary file read. It monitors web requests to the "/cf_scripts/scripts/ajax/ckeditor/*" path using the Web datamodel, focusing on specific ColdFusion paths to differentiate malicious activity from normal traffic. This activity is significant due to the vulnerability's high CVSS score of 9.8, indicating severe risk. If confirmed malicious, it could lead to unauthorized data access, further attacks, or severe operational disruptions, necessitating immediate investigation.
The following analytic detects potentially malicious file upload attempts to Citrix ShareFile via specific suspicious URLs and the HTTP POST method. It leverages the Web datamodel to identify URL patterns such as "/documentum/upload.aspx?parentid=", "/documentum/upload.aspx?filename=", and "/documentum/upload.aspx?uploadId=*", combined with the HTTP POST method. This activity is significant for a SOC as it may indicate an attempt to upload harmful scripts or content, potentially compromising the Documentum application. If confirmed malicious, this could lead to unauthorized access, data breaches, and operational disruptions.
The following analytic identifies attempts to exploit CVE-2024-27199, a critical vulnerability in JetBrains TeamCity web server, allowing unauthenticated access to specific endpoints. It detects unusual access patterns to vulnerable paths such as /res/, /update/, and /.well-known/acme-challenge/ by monitoring HTTP traffic logs via Suricata. This activity is significant as it could indicate an attacker bypassing authentication to access or modify system settings. If confirmed malicious, this could lead to unauthorized changes, disclosure of sensitive information, or uploading of malicious certificates, severely compromising the server's security.
The analytic identifies potential server-side template injection attempts related to CVE-2022-22954. It detects suspicious URL patterns containing "deviceudid" and keywords like "java.lang.ProcessBuilder" or "freemarker.template.utility.ObjectConstructor" using web or proxy logs. This activity may indicate an attempt to exploit a known vulnerability in VMware, potentially leading to remote code execution.
The analytic identifies an unusual number of Kerberos service ticket requests (Event ID 4769) originating from a single client address and account. It uses statistical analysis, specifically standard deviation and the 3-sigma rule, to detect anomalies. This activity is significant as it may indicate malicious behavior such as lateral movement, malware staging, or reconnaissance, potentially leading to unauthorized access to multiple endpoints and further compromise.
The analytic detects attempts to exploit the ConnectWise ScreenConnect CVE-2024-1709 vulnerability, which allows attackers to bypass authentication via an alternate path or channel. It leverages web request logs to identify access to the SetupWizard.aspx page, indicating potential exploitation. This activity is significant as it can lead to unauthorized administrative access and remote code execution. If confirmed malicious, attackers could create administrative users and gain full control over the affected system, posing severe security risks. Immediate remediation by updating to version 23.9.8 or above is recommended.
The following analytic identifies URL requests associated with CVE-2022-22965 (Spring4Shell) exploitation attempts, specifically targeting webshell access on a remote webserver. It detects HTTP GET requests with URLs containing ".jsp?cmd=" or "j&cmd=" patterns. This activity is significant as it indicates potential webshell deployment, which can lead to unauthorized remote command execution. If confirmed malicious, attackers could gain control over the webserver, execute arbitrary commands, and potentially escalate privileges, leading to severe data breaches and system compromise.
This detection identifies potential exploitation attempts of the CVE-2024-5806 vulnerability in Progress MOVEit Transfer. It looks for log entries indicating failures to access the certificate store, which can occur when an attacker attempts to exploit the authentication bypass vulnerability. This behavior is a key indicator of attempts to impersonate valid users without proper credentials. While certificate store access failures can occur during normal operations, an unusual increase in such events, especially from unexpected sources, may indicate malicious activity.
This analytic detects potential exploitation attempts against VMWare vRealize Network Insight, specifically targeting the CVE-2023-20887 vulnerability. It monitors web traffic for HTTP POST requests directed at the vulnerable endpoint "/saas./resttosaasservlet." Identifying this behavior is crucial for a SOC as it indicates an active exploit attempt. If confirmed malicious, the attacker could execute arbitrary code, leading to unauthorized access, data theft, or further network compromise.
Detects suspicious child processes spawned by the CrushFTP service that may indicate exploitation of remote code execution vulnerabilities such as CVE-2025-31161, where attackers can achieve RCE through crafted HTTP requests. The detection focuses on commonly abused Windows executables (like powershell.exe, cmd.exe etc.) that attackers typically use post-exploitation to execute malicious commands.
This rule detects login activity by Azure AD administrators to Microsoft cloud applications that are not part of a predefined list of common first-party applications. The rule specifically looks for successful logins where the application ID is not in the 'first_party_ms_cloud_apps' list and the user ID is present in the 'entra_id_admin_watchlist'. This helps identify potentially unusual or unauthorized access by administrators to less common or custom applications, which could indicate compromise or policy violation.
This rule detects Azure AD login activity to applications that are not part of a predefined list of first-party Microsoft Cloud Apps. This could indicate an attempt to access an unauthorized or unusual application within the Azure AD environment, potentially by a compromised account or an insider threat. The rule specifically excludes the 'On-Premises Directory Synchronization Service Account' to reduce false positives related to ADFS synchronization.
This rule detects successful login activity by administrative users to Microsoft Office 365 applications that are not part of a predefined list of common, first-party Microsoft cloud applications. This helps identify potentially unauthorized or unusual access to less common applications within the O365 ecosystem by privileged accounts. The rule specifically targets 'USER_LOGIN' events from 'Office 365' where the login is allowed and the application ID is not in the 'first_party_ms_cloud_apps' list. It also filters for users present in an 'msazure_admin_watchlist'.
Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D).
Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary.
The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks.
This rule flags suspicious use of such padding observed in real-world attacks.
Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary.
The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks.
This rule flags suspicious use of such padding observed in real-world attacks.
This rule detects successful login activities to the Azure AD PowerShell application within Office 365. While legitimate administrative tasks often involve using Azure AD PowerShell, adversaries can also abuse this access to gather user information or perform other malicious actions. The rule specifically looks for successful user logins to the application identified by the product object ID '1b730954-1685-4b74-9bfd-dac224a7b894'. It also includes commented-out filters for ADFS Sync Accounts, which are typically legitimate and run every 30 minutes.
This rule detects successful Office 365 login activity to applications that are not part of a predefined list of common, first-party Microsoft Cloud applications. This can help identify potentially unauthorized or unusual access to cloud resources via less common applications, which might indicate credential compromise or an attempt to bypass standard access controls. The rule specifically excludes certain known benign Microsoft application IDs and allows for filtering out ADFS synchronization traffic.
Detects when a Key Management Service (KMS) decryption operation is carried out by a service account that is not in an allowlist. This behavior may indicate unauthorized access to sensitive information protected by KMS keys. The rule specifically looks for 'Decrypt' events within Google Cloud Platform (GCP) and flags any service account performing this action if it's not part of a predefined allowlist.
This rule detects when a Google Cloud identity experiences a low severity Security Command Center alert followed by a medium severity Security Command Center alert within a 24-hour period. This escalation in alert severity for the same identity could indicate an adversary attempting to gain further access or escalate privileges after an initial compromise or suspicious activity.
This rule detects O365 login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default
Detects Azure AD admin login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default
This rule detects Azure AD login activity to apps other than a defined list of first party MS Cloud Apps. Note that Azure Active Directory PowerShell and custom Azure apps are not in this list by default
Page 221 of 235