Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects instances where a user account is created or modified (e.g., added to a local admin group) shortly after a network logon event (Logon Type 3 or 10). This behavioral correlation is highly indicative of lateral movement followed by local privilege escalation or persistence establishment.
Detects a sequence of events where a user performs a network logon (Event ID 4624, Logon Type 3) followed by a successful Directory Replication Service (DRS) request (Event ID 4662, Access Mask 0x100) on a Domain Controller within a one-hour window. This pattern is indicative of potential lateral movement followed by credential dumping via DCSync, often associated with tools like Mimikatz.
This rule detects potentially malicious spearphishing emails containing suspicious file types (such as executables, scripts, or archives) that are sent with either a spoofed sender domain or a subject line containing common lures targeting IT/infrastructure teams. It focuses on identifying high-risk email deliveries that indicate social engineering and initial access attempts.
Detects suspicious modifications to GitHub Actions workflows, such as unauthorized file overwrites, commits by bot impersonation identities (e.g., dependabot, renovate), or the upload of sensitive artifacts like 'format-results.txt'. These activities are indicative of IronWorm-style attacks targeting CI/CD pipelines to exfiltrate secrets via build artifacts.
Detects potential remote code execution (RCE) attempts targeting Langflow that manifest as the spawning of child shell processes or the execution of curl/wget commands to download and execute malicious scripts (specifically 'isp.sh') from the IP address 83.142.209.214. It also monitors for Python-based execution patterns using 'os.system' to drop or execute these payloads.
Detects anomalous child process creation from typical web and application server processes (IIS w3wp.exe or Openfire Java processes). This behavior is consistent with post-exploitation activity following web application vulnerability exploitation, specifically web shell deployment and execution of reconnaissance or secondary payload staging commands.
Detects suspicious PowerShell activity potentially associated with the 'Ptero' malware family. The rule correlates several behaviors: direct invocation of PowerShell with known Ptero-related script names, execution spawned by common phishing delivery parents (such as Office applications or web scripting engines), PowerShell downloading files from Cloudflare Workers domains, and the correlation of PowerShell network download activity with subsequent registry-based persistence modifications.
Detects instances where the Node.js runtime (node.exe) spawns a command shell or scripting interpreter (cmd.exe, powershell.exe, or wscript.exe). The detection specifically looks for these processes being initiated from directories commonly associated with Node.js package management (npm) or local module installations, which may indicate malicious activity such as software supply chain attacks or execution of obfuscated scripts.
This rule detects authentication events for service accounts (matching patterns like 'svc', 'sa', 'service') originating from at least two different countries within a short time window (30 minutes or less), indicating potential credential compromise and anomalous geographic movement.
Detects anomalous external scanning activity against internal web applications by monitoring for multiple requests to sensitive URI paths associated with vulnerability exploitation (e.g., cgi-bin, admin-ajax.php, .env, or command execution endpoints) originating from external IP addresses to internal network space.
Threat hunting query designed to identify suspicious FortiGate SSL-VPN and administrative authentication activity that may indicate credential abuse following the FortiBleed 2026 credential exposure campaign.
This hunt focuses on post-exposure behavior rather than vulnerability exploitation and combines multiple hunting hypotheses, including:
- Previously unseen user/IP combinations
- Multiple users authenticating from the same source IP
- Single users authenticating from multiple source IPs
- Rapid country changes resembling impossible-travel scenarios
- Administrative account creation or modification
- Firewall and VPN configuration changes
- Potential tunneling or proxy activity associated with post-compromise operations
The objective is to identify unauthorized access resulting from exposed FortiGate administrator credentials or SSL-VPN credentials.
This query is intended as a hunting starting point and should be adapted to local FortiGate log formats, parser mappings, enrichment sources and operational requirements.
This hunt focuses on post-exposure behavior rather than vulnerability exploitation and combines multiple hunting hypotheses, including:
- Previously unseen user/IP combinations
- Multiple users authenticating from the same source IP
- Single users authenticating from multiple source IPs
- Rapid country changes resembling impossible-travel scenarios
- Administrative account creation or modification
- Firewall and VPN configuration changes
- Potential tunneling or proxy activity associated with post-compromise operations
The objective is to identify unauthorized access resulting from exposed FortiGate administrator credentials or SSL-VPN credentials.
This query is intended as a hunting starting point and should be adapted to local FortiGate log formats, parser mappings, enrichment sources and operational requirements.
This rule monitors for successful and failed user authentication events (Logon events 4624 and 4625) occurring on Saturdays or Sundays. It calculates a risk score based on the volume of authentication attempts and classifies the activity, providing visibility into potential off-hours credential misuse or insider threat scenarios.
This rule detects potential exploitation attempts targeting the BeyondTrust Privileged Remote Access API by identifying unauthenticated POST requests directed at specific sensitive API endpoints (e.g., /api/, /remote-support/). It flags high-frequency or multi-path request patterns indicative of automated vulnerability scanning or exploitation attempts related to CVE-2026-1731, where the absence of authorization headers is a key indicator of unauthorized access.
Detects node.exe spawning cmd.exe or powershell.exe during npm package installation process, indicating potential malicious use of preinstall or postinstall scripts. This pattern has been observed in supply chain attacks involving infostealers like Miasma and MYRA.
Detects network proxy activity associated with the 'Polymarket Trap' supply chain attack, where developers are lured into cloning a fake arbitrage bot repository or fetching malicious npm packages from the wshu.net domain. The rule monitors for access to known malicious repositories (Trum3it/polymarket-arbitrage-bot) and malicious dependencies (clob-client-math).
Detects instances where npm or node processes execute suspicious shell commands or scripts, often associated with software supply chain attacks. The rule looks for child processes like shell interpreters (sh, bash) or utilities (curl, wget, python) initiated by node/npm, combined with suspicious command-line patterns indicative of obfuscated execution or malicious package lifecycle scripts.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
Detects instances where a user grants an OAuth application sensitive permissions, which could indicate an illicit consent grant attack where an adversary lures a user into authorizing a malicious application to access their email, files, or directory data.
Detects messages sent within Microsoft Teams from an external tenant that contain potentially malicious indicators, such as URL shorteners, external links, or references to executable file extensions. This rule is designed to identify potential spearphishing or social engineering attempts originating from external Microsoft 365 tenants.
Detects unauthenticated requests directed at ServiceNow Scripted REST Resource endpoints, specifically targeting path segments like '/api/now/related_list_edit/create' or general '/api/now/' paths. The rule looks for transaction activity identified as 'Guest' user or lacking necessary authorization headers, potentially indicating exploitation of ServiceNow platform vulnerabilities.
Detects anomalous, high-volume API requests to ServiceNow endpoints originating from the same source IP that lack valid authorization headers or session tokens, potentially indicating automated scanning, enumeration, or exploitation attempts.
Page 33 of 235