Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,582
8,393
6,220
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects the use of weaponized GitHub Actions workflows (e.g., impersonating 'Run Copilot' or 'Dependabot Updates') designed to exfiltrate CI/CD secrets via artifacts, as observed in the Miasma/Mini Shai-Hulud supply chain campaign.
Detects attempts to exploit the Squidbleed vulnerability by monitoring 'squid.exe' process command lines for keywords related to FTP default configuration exploitation, specifically 'Safe_ports', 'CONNECT', 'PORT', 'PASV', '21', and 'tcp_outgoing_address'. This indicates an adversary trying to bypass security controls or exfiltrate data via FTP.
Detects MFA authentication success from one IP address followed immediately by a session access attempt from a different IP address. This pattern is characteristic of Adversary-in-the-Middle (AiTM) phishing attacks, such as those using EvilProxy, Evilginx2, or similar phishing-as-a-service (PhaaS) platforms, where an adversary proxies the authentication flow to capture session tokens.
Detects web traffic containing specific randomized CSS filter properties on top-level elements, frequently seen in Bluekit PhaaS toolkits. These properties are used to alter the visual hash of the rendered page, complicating automated screenshot or pixel-based analysis by security vendors. This technique is often combined with suspicious URL patterns indicative of credential harvesting sites.
This rule detects successful SSH login events utilizing public key authentication for the 'vmanage-admin' user. It aggregates login events by source IP, username, and host to identify patterns of access for this specific administrative account.
Detects anomalous bulk publication of NPM packages by a specific compromised maintainer account (czirker) targeting the LeoPlatform and LeoInsights organizations, indicative of malicious propagation behavior similar to the Miasma worm.
Detects network communication associated with the Bluekit phishing framework and the use of the rrweb library to capture web sessions, including WebSocket upgrade attempts which may indicate unauthorized user activity monitoring or credential harvesting.
Detects potential Browser-in-the-Middle (AiTM) credential relay attacks where a user clicks a malicious phishing URL, followed shortly by a successful interactive sign-in from a different IP address and a previously unseen device.
Detects instances where a single authentication correlation ID is associated with multiple distinct IP addresses within a 10-minute window, followed by high-risk administrative or data-access actions within 30 minutes. This behavior is indicative of session hijacking or post-authentication account compromise, where an adversary uses stolen session tokens to perform unauthorized activities.
Detects a specific behavioral pattern associated with Bluekit Phishing-as-a-Service (PhaaS) involving WebRTC IP address leak fingerprinting. The rule identifies UDP STUN traffic (port 3478) originating from common web browsers followed within 30 seconds by an HTTPS connection to non-reputable domains, indicating a potential client-side phishing reconnaissance or identification attempt.
This rule detects potential malvertising or drive-by download activity by identifying when common web browsers spawn script-interpreting processes (such as powershell.exe, cmd.exe, or mshta.exe) that execute suspicious commands indicative of obfuscation or payload delivery (e.g., IEX, EncodedCommand). It further correlates this activity with outbound network connections initiated by the child process within a 30-second window, which is characteristic of the second stage of a malware delivery chain.
Detects consecutive successful AWS ConsoleLogin events for the same user originating from distinct IP addresses within a 10-minute window. This behavior is indicative of a session-based attack such as Adversary-in-the-Middle (AiTM) where session cookies are intercepted and replayed, allowing an attacker to bypass traditional authentication or multi-factor authentication controls.
Detects a potential Conditional Access bypass, often associated with Storm-2372, where a device is registered and immediately followed by a PRT or deviceToken-authenticated sign-in to sensitive cloud applications within one hour. This behavior indicates the usage of non-TPM-attested 'phantom' devices to circumvent device-based security requirements.
This rule detects potential adversary-in-the-middle (AiTM) activity targeting FortiGate firewalls, specifically looking for internal authentication traffic (LDAP, Kerberos, LDAPS, MS-SQL) originating from a firewall management IP. The rule triggers if there are 5 such connections within 60 seconds, indicating a possible listening post or attempt to intercept credentials.
Detects the execution of processes with command-line arguments containing keywords related to known supply chain attacks (e.g., solarwinds, 3cx, kaseya, npm, pypi). This rule is intended for threat hunting to identify potential exploitation attempts or malicious activity involving software supply chain components.
Identifies logins from known malicious VPN/Proxy exit nodes geolocated in Canada, specifically attempting to bypass geographic conditional access rules. This rule joins location data with threat intelligence indicators to detect suspicious access patterns.
This rule detects sensitive modifications to payroll-related information in Workday, such as bank account details, direct deposit settings, or payment method changes. It flags instances where such modifications occur from multiple IP addresses for the same user account, which may indicate account compromise and unauthorized attempts to divert funds.
This rule detects potential lateral phishing attempts originating from a compromised Microsoft 365 account. It flags outbound internal emails containing payroll-related keywords, such as direct deposit or salary redirection, which are sent to HR or finance departments. This activity is correlated with recent mailbox rule modifications (like transport or inbox rules) by the same user, a technique often used by threat actors to hide communications or exfiltrate data, consistent with identified campaigns like Payroll Pirate.
This rule monitors for inbound email messages containing SVG file attachments. SVG files can contain embedded scripts that may be leveraged for malicious purposes, such as SVG smuggling to deliver secondary payloads or perform credential harvesting.
Detects a potential privilege escalation attempt in MyBB where a user with limited Administrator Control Panel (ACP) permissions modifies a user account to join the 'Administrator' group (ID 4) by POSTing to the 'user-users' module.
This rule detects potential SSH brute force attacks by identifying multiple failed password attempts from a single source IP address to a specific computer within a 5-minute window. It specifically looks for 'Failed password' messages in syslog entries from the 'sshd' process.
Page 61 of 235