Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects the obfuscated 'setup.cjs' dropper associated with the easy-day-js npm supply chain attack. The rule identifies unique obfuscated variable names, XOR-encoded marker bytes, and specific campaign-related strings, including postinstall commands, package names, second-stage payload filenames, self-deletion patterns, and TLS bypass indicators.
Detects incoming phishing emails that impersonate healthcare-related organizations. The detection identifies malicious activity by matching common healthcare-themed domain patterns in the From header, coupled with email authentication failures (DMARC or DKIM), and a mismatch between the envelope sender and the header From address. It also monitors for invoice-themed subject line lures commonly used in social engineering.
This rule detects persistent Microsoft 365 access established by an attacker using OAuth refresh tokens, typically following a device_code phishing attack. It correlates three key events: initial device_code sign-ins from non-compliant or non-managed devices, the subsequent consent to a new OAuth application (likely attacker-controlled) from the same user and within a short timeframe, and finally, Microsoft Graph mail API access originating from that newly registered application. This sequence indicates an adversary has successfully phished a user, gained consent for a malicious application, and is now using it to access the user's mailbox data.
This rule detects potential MFA bypass via stolen session cookies by identifying successful single-factor authentications from new or unmanaged/non-compliant devices, especially when originating from a new geographical location for the user or exhibiting medium/high sign-in risk. It correlates impossible travel, new device, and lack of MDM/EDR compliance signals.
Detects the creation of specific AI assistant configuration files (e.g., Cursor, Claude, Gemini, VS Code) by alternative runtimes. The Miasma malware targets modern AI coding assistants to inject hidden backdoors that trigger automatically when projects are opened.
This rule detects invoice-themed phishing emails that impersonate healthcare organizations. It identifies suspicious messages by analyzing email authentication failures (DKIM/DMARC/SPF) and specific delivery conditions like 'compauth=none' or 'reason=451', which are often indicative of phishing campaigns leveraging open redirect services for obfuscation.
This rule detects potentially suspicious AWS API activity by identifying IAM identities that perform high-privilege operations or use developer-oriented user agents (e.g., boto3, python-requests) from multiple distinct IP addresses within a one-hour window. It calculates a risk score based on the combination of source IP diversity, developer tool usage, and the presence of sensitive API calls such as CreateUser, CreateAccessKey, RunInstances, and AssumeRole.
This rule detects the execution of Windows Script Host (wscript.exe or cscript.exe) where the initiating parent process is not a common legitimate process like explorer.exe, cmd.exe, powershell.exe, svchost.exe, or system.exe, and is also not a web browser (Chrome or Firefox). This pattern can indicate an attempt to execute malicious VBScript or JScript files, potentially delivered via phishing, where the script is launched by an unusual or obfuscated parent process to evade detection.
This rule detects potential phishing or cloaking activity where a web server response contains JavaScript logic that checks the visitor's User-Agent string using 'navigator.userAgent' and conditionally redirects the user via 'window.location'. This technique is commonly used to redirect specific targets (e.g., mobile devices or specific browsers) to malicious sites while serving benign content to others, often for credential harvesting or malware delivery.
Detects the RondoDox campaign's use of obfuscated JNDI payloads targeting the Log4Shell (CVE-2021-44228) vulnerability. The rule identifies attempts to spray malicious JNDI lookup strings like ${env:NaN:-j}ndi across multiple HTTP headers including Authorization, Bearer, Cookie, and others, specifically designed to bypass web application firewall (WAF) filters.
Detects Tycoon 2FA AitM using unique, high-entropy URL paths with low request counts
Detects successful sign-ins using legacy authentication protocols (e.g., IMAP, POP3, SMTP AUTH, ROPC) for user accounts that are in scope of a Conditional Access policy requiring multi-factor authentication (MFA). Legacy protocols do not support modern authentication flows, effectively bypassing configured MFA requirements and increasing the risk of credential-based attacks.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails containing financial keywords sent to sensitive finance/accounting roles from domains that have not been observed in the last 180 days. It then correlates this email event with subsequent device-level network activity involving banking or financial URLs initiated by the recipient user, which may indicate follow-up reconnaissance or unauthorized access.
Detects attempts to abuse the device code flow targeting Microsoft Office and Authentication Broker applications from unmanaged, non-compliant devices with unbound tokens. This activity is indicative of device code phishing, where an attacker tricks a user into authenticating a malicious application.
Detects network connections to known ShinyHunters infrastructure, including specific IP addresses and DNS queries for 'azurenetfiles.net', which has been linked to their operations targeting Oracle PeopleSoft servers via gadget chain exploitation.
Detects successful authentication events from accounts identified as service, managed, or robot accounts (e.g., svc_, sa_, msol, robot) originating from external IP addresses or exhibiting an unusually high number of distinct source IP addresses. This behavior is indicative of potential credential theft, token replay attacks, or unauthorized usage of service account identities.
This rule detects the execution of 'net.exe' or 'net1.exe' by 'powershell.exe' to perform potentially malicious Active Directory administrative tasks. Specifically, it monitors for commands related to creating or modifying domain users, adding users to privileged groups such as 'Enterprise Admins', or configuring backup accounts, which are common patterns for persistence and privilege escalation.
This rule detects the execution of 'net.exe' or 'net1.exe' by 'powershell.exe' to perform potentially malicious Active Directory administrative tasks. Specifically, it monitors for commands related to creating or modifying domain users, adding users to privileged groups such as 'Enterprise Admins', or configuring backup accounts, which are common patterns for persistence and privilege escalation.
This rule detects potential rogue SD-WAN peering attempts by correlating successful SSH public key authentication using 'vmanage-admin' from known malicious IPs with subsequent network activity on SD-WAN control plane ports (e.g., 48373 for OMP, 830 for NETCONF). It also flags logs containing references to an 'evil_tenant.csv' artifact, which is associated with adversary persistence or unauthorized configuration management in SD-WAN environments.
Detects unauthorized persistence mechanisms on Cisco SD-WAN management plane nodes (vManage, vSmart, vBond). The rule monitors for modifications to SSH authorized_keys files, execution of commands like ssh-keygen or user management utilities, and SSH authentication events or configuration changes (e.g., PermitRootLogin) indicative of backdoored access.
This rule detects when a user clicks on a URL that contains a domain identified as malicious. The rule specifically looks for `UrlClickEvents` where the extracted domain from the URL matches any of the domains listed in the `malicious_domains` array. This can indicate a successful phishing attempt or an accidental click on a known malicious link.
Page 49 of 235