Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects the execution of wscript.exe spawning a child powershell.exe process with arguments specifically configured to execute a script file starting with 'ps_' from the 'C:\Temp' directory. This behavior is highly characteristic of JScript droppers commonly associated with malicious email attachments that write and launch secondary payloads silently in the background.
Detects successful authentication to Atlassian Jira from an anomalous network source (e.g., proxied or unusual geolocation/ASN) following a period of credential inactivity. This activity is consistent with tactics used by the HellCat ransomware group, who leverage credentials harvested by infostealers (such as Raccoon, Redline, StealC, or Lumma) to gain initial unauthorized access to corporate Jira environments.
Monitors GitHub audit logs for suspicious or high-risk activities within CI/CD pipelines, including actions triggered by forks, workflow approvals, branch policy overrides, self-hosted runner registration, and sensitive secret access.
Detection rule monitoring for indicators of compromise related to SolarWinds Serv-U, including anomalous Content-Encoding headers, unexpected child process execution, large file staging indicative of data exfiltration (Cl0p-style), outbound exfiltration, SQL injection artifacts, and unauthorized LDAP/Active Directory object enumeration by the Serv-U process.
Detects automated lateral movement attempts using sshpass to perform password spraying or authentication against PeopleSoft-related service accounts (psoft, oracle, linuxadm). The rule specifically flags the use of sshpass with lax security settings (StrictHostKeyChecking=no), identifying a pattern associated with the uon_fanout.sh post-exploitation script.
Detects anomalous AWS API activity following a console login where the API calls originate from a different IP address within 10 minutes, potentially indicating the replay of stolen session tokens captured via Adversary-in-the-Middle (AiTM) techniques.
Detects the ClickFix social engineering technique where a user is coerced into copying and executing a malicious script from a web browser. The rule identifies instances where common web browsers spawn script interpreters such as powershell.exe, cmd.exe, mshta.exe, or wscript.exe, which is characteristic of the user pasting malicious commands into a command prompt interface.
Detects anomalous post-compromise activity associated with Browser-in-the-Browser (BitB) attacks or general credential theft. Specifically, it monitors for browser processes spawning suspicious child processes (e.g., cmd.exe, powershell.exe, mshta.exe) that are typically used for payload delivery, and unauthorized access to browser-stored credential files (e.g., 'Login Data') by non-browser processes.
Detects the use of curl.exe to upload files to the temp.sh service while simultaneously passing the resulting temp.sh URL within the User-Agent string to a C2 server. This specific exfiltration and beaconing TTP was observed in the Notepad++ supply chain attack.
Detects emails containing embedded PNG, SVG, or JPG images (often QR codes) that are used in conjunction with a subject line indicating 'Code of Conduct' to bypass text-based URL filters and redirect users to an AiTM (Adversary-in-the-Middle) proxy. This technique is commonly used in phishing campaigns to steal authentication tokens.
This rule detects suspicious sign-in patterns indicative of an EvilTokens-style Microsoft Device Code OAuth phishing attack. It identifies successful device code flow sign-ins where Multi-Factor Authentication (MFA) was not applied or satisfied, suggesting an adversary has bypassed MFA using a stolen device code. The rule aggregates these suspicious sign-ins by user, listing associated applications, IP addresses, and locations for analyst review.
Detects suspicious user agents associated with Tycoon2FA phishing-as-a-service (PHaaS) attacks, specifically targeting Microsoft 365 accounts via device code phishing. The rule identifies 'axios/1.13.x' (credential relay variant) and 'node/undici' (device code variant) user agents in Azure AD sign-in logs where the original transfer method is 'deviceCodeFlow', and the device is neither managed nor compliant, and the sign-in token protection status is unbound.
Detects spear-phishing emails associated with Operation DragonReturn, which impersonates the Indian Income Tax Department. The rule identifies emails containing malicious PDF attachments (e.g., 2026-0610-1.pdf) or directing users to the known phishing domain 'govtop.one', commonly used to harvest credentials or deliver malware.
This rule identifies indicators of compromise associated with the DragonReturn malware and DcRAT, including malicious file names, suspicious process execution, DNS resolution of known malicious phishing domains, and network communication with documented C2 infrastructure.
This rule monitors email metadata for patterns associated with known phishing campaigns mimicking Booking.com. It looks for specific lures in email subjects, suspicious attachment filenames such as 'invite.ics', malicious domains using the .cfd TLD, or body text containing 'Download Photos and Videos'.
Detects the registration of a new device or MFA authentication method in Microsoft Entra ID from an IP address geolocated to Morocco. This is a persistence tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539).
Correlates a successful Fortinet SSL VPN session with nltest, net, Get-AD*, AdFind, ldapsearch, WinRS, or WMIC discovery commands for the same account within forty-five minutes. This behavior can indicate an attacker establishing initial access via VPN and then performing internal reconnaissance.
Detects anomalous network traffic patterns indicative of two distinct techniques: P2P injection into Microsoft 365 Copilot search queries and Server-Side Request Forgery (SSRF) leveraging Bing's image search functionality for data exfiltration.
Detects activity associated with a specific phishing campaign distributing 'Distribution Settlement Agreement' PDF lures. The rule monitors for file creation or execution of files matching this naming pattern, as well as network connection attempts to domains identified as related to the threat actors: 'gasparinutrition.com' and 'gappssmtp.com'.
Detects email thread fabrication by the Latin-placeholder phishing kit, which embeds specific, non-business job titles and recipient-domain email addresses into the message body to manufacture the appearance of legitimate internal correspondence.
This rule monitors email attachment events for PDF files containing specific, repetitive text patterns often associated with phishing templates or document-based social engineering. It detects attachments that include phrases like 'lorem ipsum' variations or specific professional-sounding but potentially suspicious terms like 'Investor Accounts Producer' or 'Settlement Agreement' which may indicate an attempt to entice a user into reviewing fraudulent documentation.
Page 59 of 235