Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,582
8,393
6,221
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects HTTP traffic involving redirect chains from known Gmail URL shorteners (goo.gl, g.co, short.gy) that terminate at the identified credential-harvesting domain chongdaotang.net. This behavior is indicative of a phishing campaign designed to harvest user credentials through a multi-stage redirect.
This rule detects potential remote code execution (RCE) exploitation targeting PHP 8.5.7 via the StreamBucket SOAP deserialization vulnerability. It monitors for PHP-related parent processes spawning suspicious child processes (e.g., shells, network utilities, or specific exploit strings) that indicate unauthorized system command execution.
Detects the creation of suspicious IDE configuration files (e.g., .vscode/tasks.json or .claude/index.js) associated with the poisoned verana-blockchain Go module, as well as the subsequent execution of these files by the Node.js runtime. This detection aims to identify supply chain compromise attempts targeting developers.
Detects suspicious activities within GitHub repository logs that indicate potential supply chain attacks, including the use of unauthorized workflow names, the creation of orphan snapshot branches, dependabot impersonation attempts, commit messages containing known campaign markers, exposure of internal secrets (HAS_GCR_TOKEN), and the push of suspicious files or configuration modifications.
This rule detects instances where the IIS web server process (w3wp.exe) spawns common command-line interpreters such as cmd.exe or powershell.exe. This activity is a classic indicator of a successful web application exploit, potentially leading to remote code execution.
Detects instances where explorer.exe launches a PowerShell process originating from an LNK file, which then performs a remote download of a Node.js runtime and JavaScript implant (TonRAT) to standard Windows temporary or application data directories. This activity is indicative of the TonRAT campaign targeting hospitality front-desk systems.
Detects the execution of a specific malicious executable (COU_ITR-1_to_4_AY2026-27.exe) identified as part of the Operation DragonReturn spearphishing campaign. The campaign impersonates the Indian Income Tax Department to lure users into executing the file.
Detects network connections to known malicious domains or IP addresses associated with Fortinet or Ivanti VPN phishing campaigns or command and control infrastructure. This rule identifies attempts to connect to fake VPN portals or communicate with adversary-controlled servers.
Detects anomalous file activity on removable media drives characteristic of the Gamaredon group's PteroOdd/PteroSetup malware. The rule identifies PowerShell, wscript.exe, or cscript.exe writing autorun.inf or .lnk files to removable drive letters (D-Z), which is a common technique for lateral movement and propagation via USB drives.
Correlates a user passing a CAPTCHA gate (Cloudflare Turnstile, reCAPTCHA) with an immediate subsequent connection to an unknown, low-prevalence domain hosting the actual phishing landing page.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails containing financial keywords sent to sensitive finance/accounting roles from domains that have not been observed in the last 180 days. It then correlates this email event with subsequent device-level network activity involving banking or financial URLs initiated by the recipient user, which may indicate follow-up reconnaissance or unauthorized access.
Detects ClickFix social engineering attacks where users are tricked into pasting and executing a malicious script from a fake CAPTCHA page. The technique results in a browser process spawning powershell.exe, cmd.exe, wscript.exe, or mshta.exe as a child process to launch the first-stage loader.
Detects the execution of remote commands on cloud virtual machines (Azure RunCommand or AWS SSM SendCommand) during defined off-hours (18:00 to 06:00). This rule identifies potentially unauthorized administrative or management activity occurring outside of standard business hours across cloud environments.
Detects emails containing attachments that mimic voicemail files (e.g., .mp3.eml) with an HTML content type, often used in phishing campaigns. The rule specifically looks for dual extensions, HTML content type, a specific file size range, and subject line keywords related to financial institutions or unauthorized activity, indicating a potential Scotiabank impersonation or similar financial lure.
Detects suspicious execution patterns involving 'npm' or 'node' processes, specifically looking for command-line arguments or folder paths related to 'apintegrationpost' or known components of the MYRA malware family (libcache.so, memfd_loader, proc_hide, injector, agent_launcher). This rule aims to identify potential supply chain compromise or malicious activity leveraging Node.js environments.
Monitors for the use of 'sshpass' to automate SSH logins using specific accounts commonly associated with Oracle/PeopleSoft administration (psoft, oracle, linuxadm) with disabled strict host key checking. This technique was observed in ShinyHunters attacks.
Detects the opening of suspected APT28 (Fancy Bear) spearphishing lure documents by Microsoft Office or Outlook. The rule monitors for file access, creation, or renaming events where the filename matches known lure patterns associated with APT28 activities, such as naming conventions containing 'BULLETEN', 'OperInformativ', 'Courses', 'Consultation', 'Weapons', or 'Smuggling' in Word or Outlook processes.
Detects messages sent or chats created by external/guest users in Microsoft Teams where the sender's name or user ID impersonates IT or support personnel, indicating a potential phishing attempt.
This rule detects a specific typosquatting pattern used by the EvilTokens phishing kit. It looks for HTTP traffic where the host contains 'workers.dev' and matches a regular expression for 'viewdoc[a-z0-9\-]+\.workers\.dev'. This indicates an attempt to mimic legitimate Cloudflare Workers domains for phishing purposes, specifically targeting the 'viewdoc' pattern often seen in document-sharing lures.
This rule detects network traffic indicative of the 'EvilTokens' phishing kit, specifically targeting Microsoft OAuth Device Code flow. It looks for HTTP POST requests to the '/api/device/start' URI on domains hosted on Cloudflare Workers ('.workers.dev'). This pattern suggests an attempt to initiate a device code phishing attack, where adversaries trick users into entering credentials or codes to grant access to malicious applications.
This rule detects potential automated credential stuffing attempts followed by successful authentication and subsequent access to sensitive/privileged APIs within Azure/Entra ID environments. It correlates multiple failed login attempts for service-oriented account names (e.g., svc, api, bot) with a successful login from the same user shortly thereafter, followed by privileged API operations (e.g., KeyVault secret access, user management) within a short time window.
Page 63 of 235