Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,220
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
This rule detects potentially malicious email attachments masquerading as 'Distribution Settlement Agreements'. It flags PDF attachments that match these specific filenames when delivered in emails associated with identified suspicious domains (gasparinutrition.com, gappssmtp.com) or when authentication checks like DMARC fail.
Detects spearphishing emails targeting high-value executive recipients (CEO, CFO, etc.) that contain PDF attachments and use subject lines related to settlement or distribution agreements. The rule specifically looks for inbound traffic routed through Google Workspace (gappssmtp.com) infrastructure, indicating potential use of compromised legitimate domains to distribute malicious lures.
Detects the creation of Model Context Protocol (MCP) server configuration files (e.g., mcp.json) in workspace directories triggered by process executions typically associated with package installation tools such as npm, npx, pip, or python. This behavior can indicate the installation of a malicious or typosquatted package designed to register a malicious MCP server and facilitate credential theft or unauthorized access.
Detects a multi-stage attack where an adversary reads local AWS credentials or configuration files (e.g., .aws/credentials, mcp.json) on a developer workstation and subsequently performs unauthorized AWS API calls from the same source IP. The rule correlates initial credential access on the endpoint with a sequence of AWS CloudTrail events starting with identity verification (GetCallerIdentity) followed by enumeration and potentially high-impact API calls (e.g., RunInstances, AssumeRole).
Detects the creation of Model Context Protocol (MCP) server configuration files (such as .mcp.json or those in .vscode/ and .amazonq/ directories) shortly after a Git operation (pull, fetch, merge, or clone). This pattern is indicative of a supply chain attack where a contributor introduces malicious MCP configurations into a workspace, which are subsequently loaded by development tools like VS Code, Cursor, or language servers to execute arbitrary code or exfiltrate data.
Detects attempts to clone or snapshot sensitive virtual machines (such as Domain Controllers, PKI, Vault, ADFS, or SSO servers) in a VMware environment. The rule alerts on these activities when performed by non-administrator accounts outside of established maintenance windows, suggesting potential unauthorized data staging or credential extraction.
Detects exploitation attempts against the Flowise MCP environment variable case-sensitivity vulnerability. Attackers can leverage a lowercase 'node_options' environment variable on Windows to bypass Flowise security denylists, allowing the injection of arbitrary JavaScript via the Node.js --require flag. The rule also monitors for the execution of associated proof-of-concept (PoC) python scripts and markers.
Detects a sequence of events where a developer utility (e.g., npm, git) is executed on an endpoint, followed shortly by suspicious cloud API calls originating from the same source IP address. This pattern potentially indicates credential theft or misuse where keys or configuration files were exfiltrated or abused to authenticate against AWS services.
Detects malicious child process creation behavior associated with the BeaverTail JavaScript infostealer during the installation of compromised npm packages. The rule monitors for 'node.exe' spawning suspicious shell or interpreter processes (e.g., python, curl, powershell) in conjunction with strings indicative of known malicious delivery mechanisms (e.g., specific filenames like 'lserver.js', 'jsonwebauth', or external hosting domains).
This rule detects potential Bluekit PhaaS C2 infrastructure by identifying fast-flux DNS behavior. It monitors DNS queries for domains associated with Bluekit phishing campaigns and flags instances where a single hostname resolves to a high number of distinct IP addresses (3 or more) within a one-hour window, which is indicative of domain rotation for evasion.
Detects external Microsoft Teams calls involving screen sharing and impersonation of trusted entities. This rule identifies high-risk credential theft or RAT installation vectors by filtering for calls where screen sharing occurs and the `identity_name` (likely the external caller's domain or display name) matches patterns associated with free/abused TLDs, cheap/throwaway TLDs, phishing-common TLDs, high-risk specialty TLDs, PHaaS kit TLDs, or impersonates common trusted entities like 'microsoft', 'helpdesk', 'it.support', 'admin', 'security.team', 'apple', 'google', 'amazon', 'paypal', 'bank', etc.
Detects messages sent or chats created by external/guest users in Microsoft Teams where the sender's name or user ID impersonates IT or support personnel, indicating a potential phishing attempt.
Detects the installation of known malicious Chrome extensions, specifically Adblock for YouTube, Adblock for Chrome, Adblock for You, and AdBlock Suite. These extensions have been associated with malware distribution, removal from the Chrome Web Store, or dormant remote code execution capabilities via server-fetched scriptlets.
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects the execution of remote commands on cloud virtual machines (Azure RunCommand or AWS SSM SendCommand) during defined off-hours (18:00 to 06:00). This rule identifies potentially unauthorized administrative or management activity occurring outside of standard business hours across cloud environments.
Detects potential execution chains related to QR code phishing (Quishing) by monitoring for suspicious process creation or outbound network connections originating from document readers, office applications, and QR scanner utilities. It covers three primary vectors: suspicious process spawning (e.g., Office apps launching cmd or powershell), non-standard network connections from document readers, and malicious URL-based LNK files spawned via explorer.exe.
Monitors IIS web servers for signs of potential exploitation by tracking suspicious child processes spawned by worker processes (w3wp.exe/iisexpress.exe), tracking unexpected WER (Windows Error Reporting) crashes associated with IIS workers, aggregating IIS-related application crashes, and detecting anomalous W3C IIS log request patterns (e.g., malformed content-length, negative bytes, or suspicious URI characteristics).
Detects potential exploitation of CVE-2025-0309, where the Intune Company Portal application identifier is used to acquire Microsoft Graph tokens via a password grant mechanism while bypassing Multi-Factor Authentication (MFA). This technique typically relies on exploiting misconfigured Conditional Access policies that exclude the Intune resource from mandatory MFA enforcement.
This rule detects potential automated credential stuffing attempts followed by successful authentication and subsequent access to sensitive/privileged APIs within Azure/Entra ID environments. It correlates multiple failed login attempts for service-oriented account names (e.g., svc, api, bot) with a successful login from the same user shortly thereafter, followed by privileged API operations (e.g., KeyVault secret access, user management) within a short time window.
Detects social engineering lures (like ClickFix, FileFix, and CrashFix) where a user is tricked into manually executing a malicious payload. This rule specifically looks for script interpreters (powershell.exe, cmd.exe, mshta.exe, wscript.exe, cscript.exe) or Living Off The Land Binaries (LOLBins) (rundll32.exe, msiexec.exe, regsvr32.exe, curl.exe, certutil.exe, bitsadmin.exe) being spawned as child processes of web browsers (chrome.exe, msedge.exe, firefox.exe, iexplore.exe, brave.exe, opera.exe) or explorer.exe (indicating execution from a Run dialog). Exclusions are in place for common benign browser update processes.
This rule monitors for suspicious activity originating from Langflow-related web service processes (langflow, uvicorn, gunicorn, python). It detects the spawning of unexpected OS-level child processes (like shell interpreters), creation of suspicious files in temporary directories (e.g., /tmp, /dev/shm), and outbound network connections to known command-and-control (C2) infrastructure associated with recent Langflow exploitation attempts (CVE-2026-33017).
Page 40 of 235