Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,582
8,393
6,221
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects Server-Side Template Injection (SSTI) and subsequent Remote Code Execution (RCE) attempts within the Floci API Gateway environment. The rule monitors for suspicious child processes spawned by the Floci JVM (e.g., shell execution), the creation of specific RCE proof-of-concept marker files, and the execution of associated exploitation tooling or IAM-bypass command arguments.
This rule detects potential malicious activity where the 7-Zip utility spawns executable files or scripts. It monitors for child processes such as .exe, .js, .vbs, .ps1, or .bat files being executed from common user-writable directories (e.g., Downloads, Temp, Desktop). This pattern is often indicative of an adversary using a legitimate archive tool to extract and execute a malicious payload delivered via phishing or other initial access methods.
Detects execution of MyBB exploitation scripts, specifically targeting the 'mybb_limited_acp_to_admin' PoC, or evidence of a web server process (PHP) spawning suspicious shell or interpreter child processes, suggesting post-exploitation activity on a MyBB platform.
Detects unauthorized changes to sensitive payroll information (such as bank accounts or direct deposit details) or suspicious inbox rule creations within Microsoft 365 or HR SaaS environments that occur immediately following anomalous authentication activity. The rule targets indicators of AiTM (Adversary-in-the-Middle) session hijacking, such as unusual user agents, unmanaged device usage, or potential token reuse.
This rule detects a multi-stage attack sequence where a user is subjected to a 'spam bomb' (large volume of inbound emails in a short time), followed by an external Microsoft Teams contact, and concluding with the execution of legitimate remote support tools (Quick Assist or MSRA) on the victim's endpoint, which is a common pattern for social engineering and technical support fraud.
Detects inbound network connections from external, non-private IP addresses to local ports 6081 and 6082. These ports are used by the PAN-OS User-ID Authentication Portal, which is actively targeted by CVE-2026-0300.
Detects creation and deletion of an Azure SQL firewall rule by the same caller within a short window, which can provide temporary database access while reducing later evidence. This behavior is often indicative of an adversary attempting to gain temporary access to a database, perform actions, and then remove their tracks by deleting the firewall rule.
This rule detects network activity associated with a known malicious domain 'facture-in.pages.dev' or suspicious HTTP response patterns often observed in phishing kits or web-based redirection, such as 'BOT BLOCKED', 'no_mouse', 'wrong_timezone', or specific language-localized error messages.
Detects network connections initiated by 'Browser_Updater.exe' to a known malicious IP address (45.251.243.210) or a specific domain containing 'iis.jpg'. This activity is indicative of initial access or command and control related to a specific campaign.
Detects attempts to generate SQL injection payloads by abusing Ollama servers, specifically targeting unauthenticated HTTP POST requests to /api/generate or /api/chat on port 11434. The rule looks for SQL injection indicators and VAPT framework specific strings within the request context, URI, or user agent.
Detects sign-ins by Global Administrators using a Temporary Access Pass (TAP) to the Azure Portal. This activity is indicative of potential credential abuse, especially in cross-tenant scenarios, as TAP can bypass MFA. The rule identifies instances where a Global Administrator role is assigned or where a user with 'globaladmin' in their UPN signs in with a TAP.
Detects unauthenticated network connections to AutoGen Studio's Management Control Plane (MCP) WebSocket paths. AutoGen Studio's AuthMiddleware explicitly skips authentication for '/api/mcp/*' and '/api/ws/*' paths, typically on port 8081. This rule identifies attempts to access these paths without authentication, which could indicate reconnaissance or exploitation attempts against a misconfigured or vulnerable AutoGen Studio instance.
This rule detects potentially malicious activity related to the 'node-gyp' build tool used by npm. It monitors for two patterns: 1) npm spawning node-gyp, which can be an automated trigger for malicious binding.gyp files, and 2) node-gyp spawning node.exe with command-line arguments indicative of obfuscated JavaScript (e.g., base64 encoding, eval, AES-GCM patterns), a technique often seen in malicious Node.js packages.
Detects file creation events related to known GLASSWORM VS Code extension files or WebAssembly (WASM) loader JavaScript shims. It also identifies process execution where the VS Code extension host spawns 'node.exe' with known GLASSWORM JavaScript shims. This rule aims to identify the presence and execution of the GLASSWORM malware.
Detects the mounting of an ISO file, particularly those with diplomatic lure filenames, followed by the execution of an executable from a newly mounted optical or removable drive. This sequence of events is indicative of an attacker using a malicious ISO to deliver and execute malware.
Detects instances where specific DLLs known to be abused in malicious contexts (libwebp.dll, mingwm10.dll, libffi-6.dll, libpng15.dll) are loaded by common productivity and scripting processes, such as Microsoft Office applications (Word, Excel, Outlook) or scripting engines (wscript.exe, mshta.exe). This pattern is often indicative of side-loading or exploitation of malicious documents and scripts.
Detects signs of HTTP request smuggling attempts targeting nghttpx or similar proxies. The rule monitors for a specific poisoning precondition where an HTTP/1.1 Upgrade request contains both an 'Upgrade' header and a 'Content-Length' header, which can be leveraged to desynchronize the connection and smuggle subsequent requests (e.g., GET /poisoned).
Detects OS command execution spawned by a Java process, potentially indicating successful exploitation of Velocity template injection (e.g., in Flowise or Floci) where java.lang.ProcessBuilder is leveraged to execute malicious commands.
Detects unauthorized attempts by a non-super-administrator user within the MyBB Admin Control Panel to assign the administrator group (usergroup=4) to a new or existing user, exploiting a privilege boundary bypass.
Detects the execution of VBScript files via wscript.exe or cscript.exe from user-writable directories (Temp, Downloads, AppData, etc.) when the process is spawned by common application vectors like web browsers, email clients, or document viewers. This behavior is indicative of the Grandoreiro banking trojan's dropper mechanism, which uses obfuscated VBS scripts for geofencing and locale checks prior to downloading secondary payloads.
This rule monitors DNS traffic for queries to the domain 'chongdaotang.net', which is associated with a phishing campaign leveraging legal threat lures to harvest credentials. Detecting these queries indicates that a host in the network is attempting to resolve a domain used in a known credential harvesting attack.
Page 62 of 235