Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,220
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Correlates phishing email delivery with subsequent communication to attacker-controlled domains.
Detects anomalous activities targeting SaaS CRM applications (Salesforce, Microsoft Dynamics 365, HubSpot), including high-volume bulk exports, off-hours access, mass API queries for sensitive objects, and suspicious OAuth token grants.
Detects named pipe activity with remote access enabled, initiated by JsonVMAccessExtension.exe running as SYSTEM. This may indicate abuse of the Azure VM Access Extension for unauthorized remote access.
This rule detects emails containing macro-enabled documents (.docm, .xlsm, .pptm). It specifically looks for instances where a sender sends two or more such emails within an hour, which could indicate a targeted phishing attempt using malicious macros.
Detects suspicious emails with attachments originating from external senders, characterized by urgent or action-oriented subject lines, and sent in bulk (5 or more emails within an hour). This pattern is indicative of phishing attempts.
This rule detects unusual logon activity for service accounts. It identifies service accounts by looking for a dollar sign ($) at the end of the username. The rule then counts logons, unique IP addresses, and unique computers for these service accounts within one-hour bins. An alert is triggered if a service account has 10 or more logons or logs in from 5 or more unique IP addresses within that hour, indicating potential abuse or compromise.
Detects instances where Microsoft Teams (teams.exe) initiates child processes that are commonly used as interpreters, such as cmd.exe, powershell.exe, mshta.exe, wscript.exe, or rundll32.exe. This activity is frequently associated with the execution of malicious payloads delivered via phishing or collaboration platforms.
Detects the execution of 'runas.exe' with the '/savecred' or '/netonly' parameters. The '/savecred' parameter allows the use of credentials previously stored in the credential manager, while '/netonly' allows the use of credentials for remote network resources without authenticating locally. Both flags can be abused by adversaries to persist or move laterally with compromised or cached credentials while evading local authentication monitoring. The rule excludes common system-signed processes originating from the Windows System32 directory.
Detects Server-Side Request Forgery (SSRF) attempts exploiting URL parser inconsistencies. Attackers use a 'github.com@' prefix within a URL parameter to trick backend fetchers into connecting to unintended, potentially internal, hosts like 'metadata.google.internal', bypassing validation logic that incorrectly parses the URL authority.
This rule detects when an Nginx web server proxies HTTP POST requests to FastCGI backends located on internal network subnets (RFC1918) or local unix sockets. Such behavior often indicates exploitation attempts targeting internal FastCGI interfaces, which should typically not be reachable directly from the internet-facing web server.
Detects a suspicious spike in Microsoft Teams external meeting or chat invitations directed at a single user within a 30-minute window. This behavior is consistent with UNC6692 tactics, where attackers impersonate internal IT helpdesk staff via Teams to perform vishing and social engineering attacks.
Detects Server-Side Request Forgery (SSRF) attempts against the Google Cloud metadata server (169.254.169.254 or metadata.google.internal) within GCP Cloud Run request logs. This rule identifies inbound requests attempting to access sensitive cloud metadata paths or tokens, often indicative of an adversary attempting to extract service account credentials or instance information.
This rule monitors for process creations spawned by common web application servers (e.g., nginx, python, java, php) where the command line arguments contain indicators of a Server-Side Request Forgery (SSRF) attempt. Specifically, it looks for suspicious URL schemes (file:, gopher:, dict:, ftp:), potential authority confusion patterns (targeting cloud metadata IPs), and encoded directory traversal characters when paired with sensitive paths like 'etc' or 'proc'.
Detects Server-Side Request Forgery (SSRF) attempts targeting the Google Cloud Platform (GCP) metadata server (169.254.169.254). The rule inspects RequestURL and RequestContext fields for indicators of metadata API access, URL parameter manipulation, authority confusion payloads, and encoding bypass techniques often used to access cloud instance metadata for unauthorized credential or information harvesting.
Detects potential SSRF or local file read attempts by identifying requests to sensitive system or application file paths (e.g., /proc/self/environ, /etc/passwd) that result in an unusually large response body compared to the historical baseline for that endpoint.
Detects incoming HTTP requests that use URL-encoding (e.g., %2e%2e, %2f) to obfuscate path traversal sequences targeting sensitive operating system or container application files, such as /proc/self/environ or /etc/passwd. This technique is often used to bypass security filters or URL validation mechanisms in web applications.
Detects URL credential confusion attempts where an attacker injects an @ symbol into URL-based query parameters. By including an '@' character, the attacker forces a mismatch between how a hostname validator parses the URL (seeing a legitimate hostname like github.com as the userinfo component) and how the backend fetcher resolves the URL (ignoring the userinfo and resolving the host following the @ symbol), potentially enabling Server-Side Request Forgery (SSRF) or local file read bypasses.
Detects a multi-stage attack pattern associated with the Qilin ransomware, beginning with suspicious VPN authentication (potential credential stuffing or bypass), moving through lateral movement attempts (SMB/RDP/WMI), and culminating in ransomware behaviors such as shadow copy deletion, mass file encryption, and ransom note creation.
Detects high-frequency POST requests originating from outside internal network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) that contain suspicious payloads in the request body (such as shell commands, downloading utilities, or busybox) or target common CGI-BIN paths, indicating a potential attempt to exploit a public-facing web server.
Monitors GitHub audit logs for suspicious or high-risk activities within CI/CD pipelines, including actions triggered by forks, workflow approvals, branch policy overrides, self-hosted runner registration, and sensitive secret access.
Monitors IIS web servers for signs of potential exploitation by tracking suspicious child processes spawned by worker processes (w3wp.exe/iisexpress.exe), tracking unexpected WER (Windows Error Reporting) crashes associated with IIS workers, aggregating IIS-related application crashes, and detecting anomalous W3C IIS log request patterns (e.g., malformed content-length, negative bytes, or suspicious URI characteristics).
Page 44 of 235