Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects HTTP requests that reference or serve the 'cors_exploit_poc.html' file, which is associated with the MexicanMafia (Operation Escaneo) actor's method of exploiting Cross-Origin Resource Sharing (CORS) misconfigurations. This exploit attempts to hijack active administrative sessions by leveraging CORS with 'withCredentials=true'.
Detects HTTP requests where the URI or request body contains indicators of internal network references (e.g., localhost, 127.0.0.1, or RFC 1918 private IP address ranges). This pattern is consistent with Server-Side Request Forgery (SSRF) attempts, where an attacker tries to force a vulnerable web application to perform unauthorized requests to internal resources.
Detects the creation of executable files (.exe or .dll) on a removable drive followed by the execution of a process from that same drive within a 30-second window. This behavior is indicative of an adversary using removable media to stage and execute malicious payloads.
Detects the execution of wscript.exe, msiexec.exe, or cmd.exe initiated with command lines pointing to script files (.js, .vbs) or shortcut files (.lnk) located on removable drives (d-z drive letters). This behavior is characteristic of the Raspberry Robin worm spreading via infected USB media.
Detects node.exe and script execution patterns associated with the Polymarket Trap supply chain attack. The rule monitors for the usage of specific environment variables (e.g., DFC_SYNC_CONFIG), operator tags (e.g., piterpan), and C2 domain connections that indicate a malicious attempt to extract configuration data from an NPM package.json file.
Detects malicious npm package behavior where a postinstall lifecycle hook uses 'npm pack' or similar commands to overwrite local node_modules contents with a newer version, a technique used by packages like 'decimal-format-utils' to bypass static analysis.
Detects npm package installation activity or network communication originating from npm-related processes that involve identified malicious packages, maintainers, or scopes associated with supply chain attacks. Specifically monitors for the '@withgoogle' scope squatting, as well as specific malicious package names and maintainer accounts, and tracks related outbound network connections to suspicious C2 domains.
Detects malicious npm dependency sideloading where a node.exe process spawns cmd.exe from a path containing 'node_modules'. This rule specifically targets the behavior observed in the Polymarket Trap / wshu.net supply chain campaign, where indirect dependencies execute malicious scripts that bypass security restrictions by launching Windows command shells at runtime.
Detects malicious activity associated with npm supply chain compromise, including execution of known malicious npm lifecycle scripts, DNS queries to suspected C2 domains, and unauthorized access to sensitive developer credential files (such as .npmrc, .aws/credentials, and SSH keys) by Node.js processes.
This rule detects potentially malicious activity related to Node.js environments. It monitors for the execution of Node.js or NPM commands involving specific sensitive files ('sync-peer.cjs', 'peer-math.js') or suspicious packing destinations, as well as the creation of 'index.js' or 'package.json' files within a 'node_modules' directory, which can indicate software supply chain manipulation or malicious dependency installation.
Detects the creation of suspicious cron jobs related to Node.js or npm processes, specifically looking for indicators of post-installation scripts or recurring tasks that might suggest malicious activity, such as supply chain compromise or persistence mechanisms.
Detects Microsoft Entra ID (formerly Azure AD) sign-in logs where a single user account authenticates from two different countries within a 10-minute window, which is indicative of potential account compromise or credential sharing.
Detects Node.js processes or npm-related parent processes writing suspicious files (e.g., .cjs, .tgz, package.json) into the node_modules directory. This behavior is often indicative of malicious supply chain activities, such as dependency confusion or post-install script injections observed in campaigns like Operation Poisson.
Detects suspicious network connections to 'outlook-one.vercel.app' or 'api.telegram.org' when initiated by common web browsers (msedge.exe, chrome.exe, firefox.exe) or Outlook (outlook.exe). This pattern can indicate phishing attempts, credential harvesting, or data exfiltration via Telegram bots.
Detects inbound emails originating from 'azure-noreply@microsoft.com' with subjects that typically indicate financial transactions (e.g., 'Invoice Paid', 'Payment Reference') or system alerts (e.g., 'MemorySpike', 'DiskFull'). This pattern could be indicative of phishing attempts leveraging a seemingly legitimate sender to trick recipients.
Flags Intune assignments to “All Devices” or “All Users,” which attackers may abuse for mass deployment.
This rule detects potential spear phishing campaigns by identifying a high volume of emails (10 or more within an hour) from external senders (not @company.com) that contain keywords like 'password', 'account', or 'security' in the subject line, and also include either an attachment or a URL. This combination of factors suggests a targeted social engineering attempt.
This rule detects potential phishing attempts by identifying emails where the sender's address contains international (Cyrillic) characters that look similar to Latin characters (homoglyphs) and the subject line contains keywords often associated with phishing, such as 'verify', 'confirm', or 'urgent'. This combination suggests an attempt to spoof legitimate domains using visual deception.
This rule detects suspicious Azure AD sign-in activity where a user successfully signs in from multiple unusual cities within a 24-hour period. It specifically looks for sign-ins that are not from a trusted network and are not from a compliant device, aggregating successful sign-ins by UserPrincipalName and IpAddress, and flagging if there are 5 or more distinct cities.
Detects the execution of 'runas.exe' with the '/savecred' or '/netonly' parameters. The '/savecred' parameter allows the use of credentials previously stored in the credential manager, while '/netonly' allows the use of credentials for remote network resources without authenticating locally. Both flags can be abused by adversaries to persist or move laterally with compromised or cached credentials while evading local authentication monitoring. The rule excludes common system-signed processes originating from the Windows System32 directory.
This rule detects potentially malicious activity associated with the MetaKit software, including DNS lookups to the 'metakit.fireant.vn' update server and the execution of 'setup.exe' processes spawned by parent processes associated with 'metakit'. This pattern is indicative of potential supply-chain execution or suspicious software update behavior.
Page 55 of 235