Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,220
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
This rule detects when a user clicks on a URL that contains a domain identified as malicious. The rule specifically looks for `UrlClickEvents` where the extracted domain from the URL matches any of the domains listed in the `malicious_domains` array. This can indicate a successful phishing attempt or an accidental click on a known malicious link.
This rule detects network connections to a list of domains identified as associated with phishing activities associated with Crimson Kingsnake. Monitoring these connections can help identify compromised systems or users attempting to access malicious sites.
This rule detects a high volume (5 or more within an hour) of emails from the same sender containing compressed attachments (.zip, .rar, .7z) and subjects indicating documents, invoices, or reports. This pattern can be indicative of phishing campaigns attempting to deliver malware or gather information.
This rule detects potential 'reply-all' storm attacks or malicious mass emails sent to large distribution lists within the organization. It identifies emails sent to 50 or more recipients where the subject line contains phrases like 'reply all' or 'all members', originating from an internal company domain. The rule then counts such broadcast emails within one-hour bins to identify unusual activity.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails where the sender's address contains keywords like 'ceo', 'finance', or 'hr', and the subject contains keywords like 'wire', 'payment', or 'invoice', but the sender's domain does not match the internal company domain. This pattern suggests an attempt to impersonate a high-ranking individual or department to trick recipients into making unauthorized financial transactions.
This rule detects multiple successful RDP logons (LogonType 10) within a one-hour window by accounts containing '$' (often machine accounts) or 'admin' (privileged accounts). This behavior can be indicative of an adversary attempting to gain remote access and potentially deploy ransomware or other malicious payloads, especially if multiple source IPs are observed.
This rule detects a high volume of successful sign-in attempts to Exchange Online from a single IP address where the UserPrincipalName ends with '@' (indicating an anonymous or malformed UPN) and Conditional Access was not applied. This pattern can be indicative of anonymous SMTP relay abuse, often used for spamming or phishing campaigns.
This rule detects potential enumeration of ServiceNow API endpoints or unauthorized access attempts from a known malicious IP address. It monitors HTTP header events specifically for common ServiceNow API patterns, aggregating requests to identify high-volume activity or interactions with sensitive endpoints like 'related_list_edit'.
Detects an internet-facing host in the DMZ that receives an inbound connection from an external non-RFC1918 address and subsequently authenticates to an internal RFC1918 host within a one-hour window. This behavior is indicative of a compromised DMZ host being used as a pivot point for lateral movement into the internal network.
Detects web requests containing patterns indicative of Server-Side Request Forgery (SSRF) attempts targeting the Google Cloud Platform (GCP) Instance Metadata API (metadata.google.internal). The rule monitors for attempts to access metadata endpoints, including token retrieval paths.
This rule detects Server-Side Request Forgery (SSRF) attempts by monitoring for URL parameters containing malicious path injections. Specifically, it looks for sequences typical of differential parsing vulnerabilities where an attacker attempts to access sensitive local files (e.g., /proc/self/environ, /var/task/) or internal cloud metadata services (metadata.google.internal) by manipulating a 'url' parameter, often combined with attempts to bypass path validation using double-slash formatting.
Detects high-frequency network requests from a single process to potentially sensitive targets such as cloud metadata services (169.254.169.254, metadata.google.internal) or using URL traversal patterns (../, %2e%2e, %2f). This behavior is characteristic of Server-Side Request Forgery (SSRF) attempts, where an attacker tries to access internal resources by forcing an application to make unauthorized requests.
Detects signs of Adversary-in-the-Middle (AiTM) phishing where a login attempt produces a reprocess error (50199) or result code 90014, immediately followed by suspicious activity using specific Firefox user-agent versions known to be associated with Tycoon 2FA reverse proxy session token capture tools.
This rule detects instances where common web server processes (e.g., httpd, nginx) or system utility services (e.g., sshd, crond, dropbear) spawn shell processes like bash, sh, or ash. This activity is a classic indicator of potential remote command execution (RCE) via web application exploits or the abuse of legitimate system services to run arbitrary commands.
This rule detects attempts to exfiltrate GCP service account credentials by performing a Server-Side Request Forgery (SSRF) attack targeting the GCP metadata server or local system files. It correlates suspicious outbound request patterns with subsequent response bodies containing standard GCP credential fields, excluding known legitimate authentication traffic to cloud APIs.
Detects web application processes (such as nginx, gunicorn, uvicorn, python, node, or java) attempting to read sensitive information from /proc/self, specifically /proc/self/environ, /proc/self/cmdline, or /proc/self/maps. This behavior is indicative of a Local File Read (LFR) vulnerability exploitation, which an attacker may use to exfiltrate environment variables containing secrets or Cloud Run service account credentials.
Correlates phishing email delivery with subsequent communication to attacker-controlled domains.
This rule detects potential SSH brute force attacks by monitoring syslog for multiple failed SSH login attempts, connection closures, or invalid user attempts from a single source IP address within a short time frame. It specifically looks for keywords like 'error', 'Connection closed', 'authentication failure', and 'invalid user' in SSHD logs.
Detects a suspected exploitation of CVE-2026-35616 on edge/SOHO devices, followed within 5 minutes by the download of an architecture-specific MIPS dropper via curl or wget, a behavior consistent with known threat activity such as the Volt Typhoon/JDY Botnet.
This rule detects URLs that contain common redirection or link parameters (u=, url=, redirect=, r=, link=, target=, dest=) where the value of the parameter is a long, alphanumeric string that appears to be an encoded domain. This pattern can indicate attempts to obfuscate the true destination of a link, often seen in phishing campaigns or malicious redirection attempts. The rule specifically looks for encoded parameters containing common top-level domains like .com, .net, or .org.
Detects the use of npm to install known malicious npm packages, which is indicative of a supply chain compromise attempt via typosquatting or malicious dependency injection.
Page 37 of 235