Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
This rule monitors web traffic logs for requests targeting administrative URI paths or containing the username 'admin' in the 'X-WEBAUTH-USER' header. It specifically filters out requests originating from trusted reverse proxies, identifying potential attempts to bypass authentication by manually injecting administrative headers.
Detects the execution or presence of identified exploit harness binaries and scripts associated with CVE-2026-55200, an RCE vulnerability in libssh2. The rule monitors process launches for specific filenames and command-line arguments indicative of proof-of-concept or exploitation tooling from the 'exploitarium' repository.
Detects DNS queries and network connection attempts to a set of known malicious domains associated with the threat actor UNC1151 (Ghostwriter). This rule monitors both DNS resolutions and direct network connection attempts to these indicators of compromise (IOCs), which are commonly used in spearphishing campaigns.
This rule detects failed Microsoft 365 sign-in attempts on the OfficeHome application associated with error code 90014, indicating a malformed or missing credential payload. The detection specifically triggers when these failures originate from an iPhone/iOS user-agent. This behavior is indicative of the reconnaissance phase of the Payroll Pirate campaign (associated with threat actor Storm-2755), where attackers use mobile-simulated browsers from carrier IP ranges to probe authentication endpoints before deploying Adversary-in-the-Middle (AiTM) kits.
Detects ROPC (Resource Owner Password Credentials) token requests to Microsoft Graph using specific client IDs associated with Microsoft To-Do or Intune Company Portal. This activity could indicate an attempt to bypass MFA via hidden Conditional Access policy exclusions, as described in CVE-2025-0309.
Detects the execution of suspicious files that exhibit characteristics of finance-themed malware droppers. This includes files with known malicious MD5 hashes, specific internal file metadata (original filename, file description, product name), or filenames masquerading as financial documents (e.g., 'GST Debit Note', 'RTGS_IMPS') with an executable extension like '.com'.
This rule uses regular expressions to identify distinct URL structures associated with the Tycoon2FA AiTM (Adversary-in-the-Middle) phishing kit. Specifically, it looks for URIs containing patterns like "?auth=" followed by a base64-encoded string or "/login?email=" followed by a base64-encoded string, which are indicative of the kit's operation to capture credentials or session tokens.
This rule detects anomalous sign-in attempts to VPN or SSO services by identifying deviations from a user's established baseline of device and location combinations. It flags sign-ins where there are at least two anomalies (new country, new ASN, new device ID, new user agent), or specific critical combinations like a new country and new device, or an unmanaged device signing in from a new country or ASN. This pattern is consistent with adversaries using stolen credentials, potentially from infostealer logs, to access enterprise resources.
Detects emails successfully delivered to the inbox that exhibit authentication failures for SPF, DKIM, or DMARC, or where a mismatch between the 'SenderFromDomain' and 'SenderMailFromDomain' is observed, indicating potential email spoofing or unauthorized sender impersonation.
Detects common web server processes (IIS, Apache, Nginx, PHP, Tomcat) spawning command-line interpreters or utilities (cmd.exe, powershell.exe, wscript.exe, cscript.exe, certutil.exe). This pattern is often indicative of exploitation of a web application to gain command execution on the host.
Detects path traversal exploitation of WinRAR (CVE-2025-8088) where a malicious RAR archive extraction results in the creation of suspicious STOCKSTAY payload files (e.g., MicrosoftUpdateOneDrive.exe) outside of the expected or secure extraction directories, linked to Turla activity.
Detects suspicious activity on Cisco SD-WAN infrastructure (vManage, vSmart, vBond) associated with unauthorized configuration changes, potential exploitation of CVE-2026-20245, rogue account creation, and anti-forensic behaviors.
This rule monitors network logs (proxy, DNS, network) for connections to domains associated with the Unistream SDK. This SDK has been identified as a component of the BadBlocker malicious Chrome extension family, which facilitates unauthorized background activity. The rule serves as an indicator of potential command and control (C2) communication from a compromised host.
This rule monitors network logs for potential malicious activity by analyzing subdomain cardinality and identifying known phishing domains. It flags apex domains that exhibit high subdomain rotation (5 or more distinct subdomains within an hour), indicative of fast-flux DNS techniques, or that match a static list of known malicious/phishing infrastructure.
Detects the execution of msiexec.exe spawned by WinRAR or unrar processes, specifically targeting the installation of STOCKSTAY payloads. This activity is indicative of exploitation of the WinRAR path traversal vulnerability (CVE-2025-8088), where attackers extract malicious MSI files to unauthorized locations to bypass security controls and achieve code execution.
Detects a sequence of events indicative of a successful phishing attack: a user receives an email containing a suspected phishing URL, clicks the URL, and subsequently performs a successful sign-in from an IP address not seen in their recent 14-day history within 15 minutes of the click.
Detects potential exploitation of CVE-2026-0300 targeting PAN-OS and matches anomalous User-Agent string associated with CL-STA-1132 threat actor.
Detects inbound emails containing attachments with file extensions commonly used for HTML/SVG smuggling (.html, .htm, .svg, .shtml, .xhtml). This technique is often used to bypass email security filters by assembling malicious payloads client-side after the email has been delivered. The rule specifically looks for inbound emails where the attachment has not been blocked or junked by the email gateway.
This rule detects potential phishing attempts where users receive SharePoint sharing invitations or links from external tenants that are not part of the organization's trusted SharePoint environment. It identifies inbound emails from SharePoint notification senders containing URLs to external SharePoint tenants and also flags internal SharePoint sharing events (invitations or anonymous link creations) initiated by accounts whose domain differs from the home tenant. This could indicate an attacker attempting to lure users to malicious external SharePoint sites or using compromised accounts to facilitate external sharing.
Detects a multi-stage attack pattern associated with the Qilin ransomware, beginning with suspicious VPN authentication (potential credential stuffing or bypass), moving through lateral movement attempts (SMB/RDP/WMI), and culminating in ransomware behaviors such as shadow copy deletion, mass file encryption, and ransom note creation.
This rule detects successful self-service password reset (SSPR) operations performed by users from IP addresses geolocated to a country that does not match their typical sign-in activity over the past 30 days. This behavior may indicate account takeover where an adversary has compromised credentials and is resetting the password to maintain access or gain further persistence.
Page 51 of 235