Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects classic SQL injection attack patterns within incoming HTTP requests, such as UNION SELECT statements, boolean-based tautologies (1=1), table dropping commands, or common URL-encoded quote characters.
Detects successful authentication events from accounts identified as service, managed, or robot accounts (e.g., svc_, sa_, msol, robot) originating from external IP addresses or exhibiting an unusually high number of distinct source IP addresses. This behavior is indicative of potential credential theft, token replay attacks, or unauthorized usage of service account identities.
This rule detects indicators of Adversary-in-the-Middle (AiTM) phishing infrastructure, specifically targeting Evilginx2 and similar proxy frameworks. It identifies unauthorized execution of Evilginx2 binaries, the presence of specific session and configuration files (.evilginx/, phishlets, session databases), unauthorized modifications to Nginx configurations, and the dropping of suspicious HTML lure files into web document roots by scripting interpreters.
Detects Node.js executing the malicious setup.cjs script or easy-day-js with the --no-warnings flag, associated with the Mastra npm supply chain compromise.
Detects inbound emails that fail SPF, DKIM, or DMARC authentication checks while containing keywords related to invoices or payments in the subject line, and referencing known potentially malicious SaaS URLs (holabrief.com or loopedin.io) in the body or URL fields.
This rule detects potentially malicious web traffic involving a redirect chain associated with HolaBrief and LoopedIn services, which are sometimes leveraged in phishing campaigns or credential harvesting. It identifies multi-hop redirect chains and connections to known suspicious IP addresses (217.182.211.237).
This rule detects potential scanning behavior (port or host sweeps) against specific, commonly targeted service ports (e.g., 443, 80, 8080) and correlates it with suspicious HTTP URI path requests associated with common exploit attempts (e.g., OWA, ECP, or management API paths).
Detects suspicious child processes spawned by an AutoGen Studio agent process. This behavior is indicative of the AutoJack exploit chain, where an attacker leverages an unauthenticated MCP WebSocket endpoint (/api/mcp/ws/) to execute arbitrary OS commands on the host by passing base64-encoded StdioServerParams.
Detects unauthorized inbound WebSocket connections from external (non-private) IP addresses to the AutoGen Studio MCP API endpoint at /api/mcp/ws/ on port 8081, followed by the execution of interpreter processes (autogenstudio, uvicorn, or python) on the same host, indicating a potential exploitation of an origin validation bypass for remote code execution.
Detects evidence of RustDesk session permission bypass exploitation. The rule monitors for the presence of known Proof-of-Concept (PoC) file artifacts, suspicious child processes spawned by RustDesk, use of elevated tokens by RustDesk-initiated processes, compilation of PoC tools using cargo, and outbound network connections from RustDesk to known relay ports.
Detects instances where common video conferencing and collaboration applications (such as Microsoft Teams, Zoom, Webex, or Slack) initiate a command shell (cmd.exe, powershell.exe, or wscript.exe). This behavior is often indicative of social engineering or phishing attacks where an adversary executes malicious code via a meeting invite or chat message.
Detects anomalous behavior associated with the PHP 8.5.7 SOAP remote code execution (RCE) vulnerability. The detection monitors for PHP/PHP-FPM processes spawning suspicious child processes (e.g., shell, python, powershell), the creation of specific exploitation marker files (e.g., php857_rce, rpoc.php), and suspicious command-line patterns indicative of payload execution or command-based exploitation techniques.
Detects web server processes (e.g., httpd, nginx) spawning common shell interpreters (sh, bash, cmd.exe) that execute suspicious commands often used in reconnaissance or download stages of an attack, such as 'whoami', 'wget', or 'curl'. This behavior is characteristic of an exploited web application being used as a staging or command-and-control pivot point.
Detects suspicious activities associated with malicious npm package installations, including Node.js spawning shells during lifecycle hooks (preinstall, postinstall), connections to known command-and-control (C2) domains used in software supply chain campaigns, and the creation of artifacts within the node_modules directory.
This rule monitors web request URLs and associated messages for common SQL injection characters and sequences, such as quotes and semicolons. It specifically targets requests involving the 'apiuser' account to identify potential attempts to manipulate or exploit backend database queries.
This rule detects the installation and execution of malicious typosquatted npm packages associated with the Polymarket Trap campaign. It monitors for the creation of specific directory names within node_modules, npm install commands referencing these package names, and network activity or DNS lookups to 'log-taker' infrastructure from Node.js processes.
This rule detects repeated execution of 'maven' or 'gradle' commands on a system within a one-hour window. A high count (5 or more) of these commands from the same account on the same computer within an hour could indicate unusual development activity, automated build processes, or potentially malicious activity related to software supply chain compromise or development environment abuse.
Detects anomalous self-upgrade behavior in npm packages where a node process spawns child processes using npm pack or specific command-line arguments to overwrite installed package files. This pattern is associated with malicious supply chain activity, specifically seen in the wshu.net campaign where packages download and replace their own contents at runtime.
Detects anomalous activities targeting SaaS CRM applications (Salesforce, Microsoft Dynamics 365, HubSpot), including high-volume bulk exports, off-hours access, mass API queries for sensitive objects, and suspicious OAuth token grants.
Detects exploitation of the Flowise MCP environment variable case-sensitivity bypass vulnerability. Adversaries leverage this flaw to circumvent denylist validation by supplying lowercase or mixed-case variable names (e.g., node_options), facilitating malicious code preloading via '--require', unauthorized environment secret exfiltration, or spawning child processes from the Flowise application.
Detects Node.js executing the malicious setup.cjs script with the --no-warnings flag. This execution sequence is associated with the easy-day-js typosquat postinstall hook used in the Mastra npm supply chain compromise.
Page 58 of 235