Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects sign-ins and cloud app events associated with specific compromised vendor application IDs, application names, or a known malicious IP address across Microsoft Entra ID and CloudAppEvents logs.
Detects instances where a web browser accesses a domain listed in the 'AdFection_Domains' watchlist, followed closely by the browser spawning a script interpreter (such as PowerShell, wscript, cscript, mshta) or dropping an executable/script file in user profile or temporary directories.
Detects successful Palo Alto GlobalProtect VPN authentications where no Multi-Factor Authentication (MFA) challenge or related text is recorded in the firewall logs, and no corresponding successful MFA sign-in event is found in Entra ID (SigninLogs).
Detects GCP audit log write operations involving settings, IAM, or metadata modifications (such as setMetadata, setIamPolicy, setServiceAccount) that either originate from a known attacker IP or are performed by a default GCP service account from a public caller IP.
Detects web server worker processes (such as php-fpm, apache2, nginx, w3wp.exe) spawning download utilities like curl or wget, certutil with transfer flags, or initiating /dev/tcp network connections, which may indicate web application exploitation or webshell activity.
Detects Microsoft 365 activity (Exchange and SharePoint) initiated by known compromised service principal UUIDs associated with the ConnectWise supply-chain attack.
Detects operator synchronization scripts (sync-all.sh, sync-memory.sh, sync-cc-users.sh) spawning SSH, rsync, or scp commands targeting AI-named jump-server accounts (claude, grok, gemini, glm).
Box Shield Suspicious Location Access
Cortex XDR
Surfaces Box Shield suspicious location alerts with geographic context and accessed content details. Detects access from unusual or excluded geographic locations indicating potential compromised accounts or credential theft.
Correlates an inbound connection to a Python/Xoscar/Xinference pool process with an outbound connection from a shell spawned by that same pool process shortly afterward, potentially indicating exploitation and reverse shell activity.
Detects CVE-2026-76504 Cisco SD-WAN vManage authentication bypass attempts: POST logins using internal viptela-reserved-* accounts via the percent-encoded /%6a_security_check path. Summarized per host and account.
Detects the presence of Cisco SD-WAN vManage software, vulnerabilities related to CVE-2026-76504, associated file artifacts, and process executions across endpoints using inventory and event logs.
Detects a sequence where an UpdraftCentral management request is made to a WordPress site followed by plugin installation or user creation requests from the same source within a 30-minute window, potentially indicating unauthorized plugin installation or webshell deployment via compromised management endpoints.
Detects a sequence where a SharePoint application pool worker process (w3wp.exe) spawns a command shell (cmd.exe, powershell.exe, pwsh.exe) related to SharePoint, followed shortly (within 1 hour) by high-fidelity lateral movement tooling or remote execution techniques (such as PsExec, WMI, PowerShell remoting, or scheduled tasks) on the same host.
Detects a web browser spawning a script interpreter or dual-use
LOLBin, the execution hand-off typical of an AI-drafted phishing lure where the
victim clicks a link/attachment and content is immediately executed by
PowerShell, cmd, mshta, wscript or cscript. Legitimate browsers almost never
spawn these interpreters as direct children, making this a high-fidelity signal
of a browser-to-interpreter phishing chain as described for AI-assisted
cybercrime activity.
LOLBin, the execution hand-off typical of an AI-drafted phishing lure where the
victim clicks a link/attachment and content is immediately executed by
PowerShell, cmd, mshta, wscript or cscript. Legitimate browsers almost never
spawn these interpreters as direct children, making this a high-fidelity signal
of a browser-to-interpreter phishing chain as described for AI-assisted
cybercrime activity.
Detects execution of Node.js or Bun from a temporary directory performing DNS queries for public Ethereum JSON-RPC provider domains, a technique observed in supply chain compromise payloads such as Shai-Hulud and ChainDrop to resolve command and control endpoints.
Detects high-volume Microsoft Graph API activity using attacker-associated user agents, such as python-requests, curl, or httpx, which may indicate automated token sweeping or data collection associated with supply-chain attacks.
Detects potential SQL injection (SQLi) attempts targeting web applications by identifying multiple requests matching specific SQLi regex patterns combined with encoding or internal reference markers within web access logs.
Alerts whenever a default SAP administrative account (e.g., SAP*, DDIC, TMSADM) logs into the system. These accounts should be locked and used only for emergency 'break-glass' scenarios
Detects execution of Node.js and NPM related commands involving potential supply chain indicators, script execution, or download utilities (such as curl, wget, powershell, or eval) within command lines.
Browser sign-ins and MFA prompts with medium or high sign-in risk from devices that have no Entra device identity and are not managed or compliant. Hunting query, not an alert.
Detects inbound emails impersonating OpenCode breach notices that urge API key rotation and contain links to non-OpenCode domains.
Page 4 of 235