Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,220
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects execution of script interpreters (wscript.exe, cscript.exe) or HTML Application host (mshta.exe) when spawned by Microsoft Office applications (Winword, Excel, PowerPoint, Outlook) or mshta.exe. This pattern is characteristic of the Gamaredon group's spear-phishing delivery chains (e.g., PteroOdd, PteroDum) that utilize macro-enabled documents or malicious HTA files to execute malicious VBScript.
Detects application log patterns indicative of a memory leak exploitation attempt against vLLM using the Python Imaging Library (PIL). This behavior is associated with an ASLR bypass technique leveraging BytesIO object manipulation, a prerequisite for a subsequent heap overflow vulnerability.
Detects when a single user account performs 3 or more Privileged Identity Management (PIM) role activations within a 30-minute window. This behavior may indicate an attacker who has compromised a privileged account and is rapidly assuming multiple roles to perform lateral movement or privilege escalation.
Detects malicious URLs sent via Microsoft Teams direct messages that contain known phishing TLDs, indicating potential phishing attempts or the use of Phishing-as-a-Service (PhaaS) infrastructure. The rule specifically targets one-on-one chats and filters for a broad list of suspicious top-level domains.
This rule detects when users access or download suspicious file types (specifically .xlsm, .docm, or .ics) from Microsoft SharePoint, Teams, or Exchange, where the filenames contain keywords associated with common phishing lures such as credentials, invoices, payroll, or password resets. This monitors for indicators of potential spearphishing attempts involving malicious documents or calendar invites within the M365 environment.
Detects the creation of user accounts or modifications to sensitive groups (Event IDs 4720, 4728, 4732, 4756) where the account name matches naming conventions typically associated with backup service accounts or elevated administrative roles (e.g., prefix 'backup_', 'bkp_' or suffix '_da', '_ea'). This activity can indicate an attacker attempting to establish persistence or escalate privileges via compromised or newly created accounts.
Detects web server processes (e.g., httpd, nginx) spawning common shell interpreters (sh, bash, cmd.exe) that execute suspicious commands often used in reconnaissance or download stages of an attack, such as 'whoami', 'wget', or 'curl'. This behavior is characteristic of an exploited web application being used as a staging or command-and-control pivot point.
This rule monitors Microsoft IIS access logs for unauthenticated POST requests targeting the '/accessv2' endpoint from non-private, external IP addresses. This activity may indicate an attempt to exploit a public-facing application, potential web shell interaction, or unauthorized access attempts.
This rule detects potential supply chain compromise in Node.js projects by monitoring for the execution of known malicious npm package install/preinstall/postinstall scripts. It identifies unauthorized access to sensitive developer credential files (such as .ssh, .git-credentials, and .npmrc) and suspicious network outbound connections associated with identified malicious package scopes.
Detects attempts to clone or snapshot sensitive virtual machines (such as Domain Controllers, PKI, Vault, ADFS, or SSO servers) in a VMware environment. The rule alerts on these activities when performed by non-administrator accounts outside of established maintenance windows, suggesting potential unauthorized data staging or credential extraction.
Detects the execution of Node.js lifecycle scripts (preinstall, postinstall, install-check, etc.) that trigger secondary process execution, such as command shells, downloaders (curl, wget), or security utilities (certutil, bitsadmin). This behavior is often associated with malicious npm package supply chain attacks aimed at downloading secondary payloads during installation.
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
Detects the successful creation or update of an Azure API Management Service. This activity could indicate legitimate administrative actions or, if unexpected, potential unauthorized access or privilege escalation within the Azure environment. Monitoring these events can help identify suspicious configuration changes or resource provisioning by malicious actors.
Detects the execution of npm lifecycle scripts (such as postinstall, preinstall, or custom install-related scripts) by node.exe. These scripts are frequently abused in supply chain attacks to execute malicious code automatically when a package is installed.
Detects the specific ShinyHunters lateral movement pattern involving automated SSH credential spraying using 'sshpass' or rapid SSH connections to multiple hosts with PeopleSoft admin accounts, often after reading '/etc/hosts'. The rule identifies suspicious SSH activity by looking for 'sshpass' execution or multiple 'ssh' commands with specific PeopleSoft-related usernames, potentially preceded by commands to read '/etc/hosts'.
Detects workstations establishing multiple connections to non-standard, internal management ports (SSH, Telnet, SNMP). This behavior is often associated with lateral movement or unauthorized network scanning using tools that leverage management protocols.
This rule detects a sequence of suspicious activities: the creation or modification of an executable file (.exe or .dll) within a directory path containing update-related keywords, followed by the execution of a file in that same location, and culminating in an outbound network connection from that process. This pattern is characteristic of a software supply chain compromise or an adversary deploying a malicious payload via a fake or compromised update mechanism.
This rule detects anomalous or risky sign-in events for user accounts that have recently configured an active out-of-office (OOF) auto-reply. An attacker may leverage a user's known absence to gain access to their email or other corporate resources using compromised credentials, as the user is less likely to notice suspicious account activity while away.
This rule detects anomalous or risky sign-in events for user accounts that have recently configured an active out-of-office (OOF) auto-reply. An attacker may leverage a user's known absence to gain access to their email or other corporate resources using compromised credentials, as the user is less likely to notice suspicious account activity while away.
Detects potential exploitation of the ToolShell remote code execution vulnerability (CVE-2025-53770) in on-premises Microsoft SharePoint servers. Attackers have been observed sending POST requests to the 'ToolPane.aspx' endpoint and subsequently dropping webshells with specific names in the SharePoint LAYOUTS directory.
Correlates a successful authentication from a new, untrusted IP address utilizing a Linux/Kali User-Agent, a known signature of the Kali365 framework.
Page 46 of 235