Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,220
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
This rule monitors network logs (from proxies and firewalls) for web traffic (HTTP GET requests) containing suspicious JavaScript code injection patterns in the request context or message fields. It specifically looks for common XSS indicators such as <script tags, eval(), document.write(), fromCharCode(), and atob().
This rule detects exploitation attempts targeting CVE-2026-0300 in Palo Alto Networks PAN-OS. It identifies suspicious network connections to User-ID Authentication Portal ports (6081, 6082) from external IP addresses, excluding RFC1918 and loopback ranges. Additionally, it looks for a specific anomalous User-Agent string associated with the CL-STA-1132 threat actor, which has been observed during exploitation of this vulnerability.
Detects unauthenticated Engine.IO WebSocket handshake attempts targeting the Peyara Remote Mouse service on TCP port 1313. These requests, characterized by specific URI query parameters, are often used as an initial phase for exploitation against vulnerable instances of the application.
Detects an unauthenticated WebSocket or Socket.IO handshake attempt targeting the Peyara Remote Mouse service on TCP port 1313. This behavior is associated with the exploitation of known remote code execution vulnerabilities in the service.
Detects phishing emails sent from personal Gmail accounts that use URL shorteners, include urgency-based legal lures in the subject line, and pass SPF/DKIM/DMARC authentication checks. The rule looks for indicators of spearphishing attempts leveraging social engineering and common evasion techniques like BCC delivery to bypass standard security filters.
Detects exploitation attempts against Gitea instances where an attacker impersonates an admin user by injecting the 'X-WEBAUTH-USER' header. This vulnerability typically occurs when 'REVERSE_PROXY_TRUSTED_PROXIES' is misconfigured to trust all proxies ('*'), allowing unauthenticated users to gain administrative access via header manipulation. The rule covers web request headers, container logs for suspicious admin creation, and process execution arguments associated with the exploitation.
Detects the exploitation of CVE-2026-20896 in Gitea, where an unauthenticated attacker sends a crafted POST request to user registration or installation endpoints. The rule triggers when this network activity is followed by the creation of a new user account with administrative roles within a 10-minute window, indicating potential privilege escalation.
This rule monitors DeviceNetworkEvents for connections to domains that match naming patterns and TLDs frequently associated with the Ghostwriter/UNC1151 threat group. The rule specifically looks for URLs containing common credential-harvesting keywords (e.g., login, verify, account) combined with specific TLDs (e.g., .digital, .icu, .cc.cd). Connections to known common public DNS providers are excluded.
Detects DNS queries and network connection attempts to a set of known malicious domains associated with the threat actor UNC1151 (Ghostwriter). This rule monitors both DNS resolutions and direct network connection attempts to these indicators of compromise (IOCs), which are commonly used in spearphishing campaigns.
This rule monitors DeviceNetworkEvents for connections to domains that match naming patterns and TLDs frequently associated with the Ghostwriter/UNC1151 threat group. The rule specifically looks for URLs containing common credential-harvesting keywords (e.g., login, verify, account) combined with specific TLDs (e.g., .digital, .icu, .cc.cd). Connections to known common public DNS providers are excluded.
Detects file access (open or read) events targeting documents with file paths matching known UAC-0226 Ukrainian military-themed lures. These documents are often associated with weaponized RAR archives, targeting sensitive military information such as reconnaissance platoon records or military registry data.
Detects malicious execution patterns during npm package installation consistent with Miasma and Mini Shai-Hulud supply chain attacks. The rule monitors for node.exe or bun.exe being spawned by npm or node-gyp that exhibit suspicious behavior, such as accessing sensitive credential paths (e.g., .ssh, .npmrc, .gitconfig) or utilizing a Phantom Gyp execution pattern where index.js is executed directly within node_modules via node-gyp, as well as bun.exe staging execution from temporary directories.
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Photo-themed ZIP phishing campaign dropping a Node.js implant
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Detects malicious URLs sent via Microsoft Teams direct messages that contain known phishing TLDs, indicating potential phishing attempts or the use of Phishing-as-a-Service (PhaaS) infrastructure. The rule specifically targets one-on-one chats and filters for a broad list of suspicious top-level domains.
Detects common web server processes (IIS, Apache, Nginx, PHP, Tomcat) spawning command-line interpreters or utilities (cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe). This pattern is often indicative of exploitation of a web application to gain command execution on the host.
Detects instances where package managers like npm, pip, or python execute shells or scripting interpreters with command-line arguments indicative of software installation or build processes. This pattern is common in supply chain attacks where malicious packages run code during their installation phase.
Device Code Phishing Attempt
Cortex XDR
Detects attempts to abuse the device code flow targeting Microsoft Office and Authentication Broker applications from unmanaged, non-compliant devices with unbound tokens. This activity is indicative of a phishing attack where an adversary is trying to gain access to a user's application access token.
Detects suspicious modifications to .github/workflows YAML files, unauthorized git commits with backdated timestamps, usage of noreply.github.com bot author names, and git push commands initiated by node.exe. This activity is indicative of the IronWorm malware attempting to manipulate CI/CD pipelines and exfiltrate secrets.
Page 42 of 235