Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,917 detections
Filters
Last updated
All Time
Detection languages
2,237
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
806
765
576
Platforms
1,843
1,022
856
814
657
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,636
12,582
8,393
6,221
4,917
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects automated programmatic token refreshes (BAV2ROPC) originating from Railway IP space. This rule specifically looks for sign-in logs in Azure Active Directory where the UserAgent contains 'BAV2ROPC' and the IPAddress falls within known Railway PaaS IP ranges.
Detects potential invoice-themed phishing campaigns by identifying inbound emails that simultaneously target multiple recipients from senders with whom the organization has no prior communication history. The detection specifically flags emails with authentication failures (DKIM, SPF, or ARC) in the subject line, which is a common pattern for phishing attacks attempting to bypass reputation filters using aged domains.
Detects exploitation attempts against the Ray AI framework's unauthenticated /api/jobs/ endpoint (CVE-2023-48022). The rule identifies specific Python requests using a known malicious contact address ('rondo2012@atomicmail.io') and detects the delivery of fileless payloads (rondo.wfh.sh) associated with the RondoDox / ShadowRay campaign originating from known malicious infrastructure.
Detects new app installations, expansions of OAuth scopes, or the addition of collaborators to Slack applications. These activities can indicate an adversary attempting to gain persistent access, escalate privileges, or exfiltrate data from Slack by leveraging malicious or compromised applications.
Detects EvilTokens phishing HTML page with AES-GCM encrypted payload by file hash and characteristic code patterns
Detects a potential multi-stage attack sequence where a file (archive or browser-related) is executed, followed by a script interpreter (wscript/cscript), and finally followed by a remote connection to common remote access ports (RDP, FTP, SMB, SSH). The rule correlates these events within a specific timeframe per device to identify likely lateral movement or remote command and control initialization.
Detects anomalous, high-volume npm package publication patterns from a single user account within a 5-minute window. This behavior is indicative of automated worm propagation or supply chain attacks using compromised developer tokens, specifically identified by high-frequency 'publish' events.
Detects unauthorized npm package publication events triggered by specific compromised maintainer accounts (czirker, llxlr) associated with the Miasma/Mini Shai-Hulud supply chain attack campaign, specifically targeting LeoPlatform or Verana Blockchain related packages.
Detects the execution of script interpreters (mshta, wscript, cscript) or PowerShell initiated by Microsoft Office applications (Word, Excel, PowerPoint, Outlook). This pattern is a common indicator of malicious macro or embedded script execution, often used to deliver secondary payloads.
Detects instances where common productivity applications (such as Microsoft Office suite, Outlook, or script engines like mshta/wscript) spawn PowerShell or PowerShell Core. The rule specifically looks for suspicious command line arguments often associated with malicious payloads, such as encoded commands, download instructions, or specific indicators related to Ptero-family malware.
Detects execution chains attributed to the Gamaredon threat group (also known as Shuckworm/ACTINIUM). The rule monitors Microsoft Office applications (Word, Excel, PowerPoint, Equation Editor) spawning cmd.exe or powershell.exe, where the child process contains suspicious patterns such as base64 blobs, script download commands, or known Gamaredon Ptero-toolset strings (PteroPaste, PteroVDoor, PteroDee). This activity is correlated with a network connection to non-Microsoft infrastructure within 60 seconds of process execution.
Detects USB-based lateral movement and persistence techniques associated with the Gamaredon group (PteroOdd/PteroPaste). The rule monitors for the connection of removable media followed by the creation of LNK files targeting AppData/Temp directories or UNC paths by specific processes (Office, Scripting engines, PowerShell), and the subsequent creation or modification of autorun.inf files on the same removable device.
Detects instances where 'node.exe' is copying browser history SQLite databases (Chrome, Edge, Brave) to temporary directories, potentially indicating data exfiltration or staging. This behavior has been observed in supply chain attacks like the 'easy-day-js' incident involving the 'protocal.cjs' backdoor.
Detects a user who interacted with a code-of-conduct lure subsequently authenticating through an anonymous proxy or anonymisation service. This rule correlates URL click events or sign-in events with subjects related to 'code of conduct' or 'policy acknowledgement' and then checks if the subsequent authentication occurred via an anonymous proxy.
Detects many unique, high-entropy URL paths that each receive a small number of requests before redirecting to authentication. This behavior is indicative of adversaries like Volt Typhoon (Tycoon) using one-time session paths for each victim in phishing campaigns.
This rule detects when common document-handling applications (such as Microsoft Office suite or PDF readers) spawn known remote access and support tools. This behavior is highly indicative of vishing-based social engineering attacks, where a user is tricked into downloading and executing a remote management tool via a malicious document.
Detects internal phishing emails with subject lines mimicking IT service notifications, such as from ServiceNow. This is a tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539) for lateral movement within a compromised organization.
Detects a user navigating to the Microsoft devicelogin portal immediately after clicking a link from an email, a precursor to Device Code OAuth phishing.
This rule detects successful OAuth logins originating from IP addresses identified as residential proxies. This behavior can indicate an adversary attempting to bypass geo-blocking or other IP-based restrictions, potentially using stolen credentials (Valid Accounts) or after a successful phishing campaign (Spearphishing Link) to gain initial access or maintain persistence.
Detects the execution of a local, polymorphic HTML file that contains AI-obfuscated JavaScript, followed by an HTTP POST request to an external server within a 5-minute window, indicating potential credential exfiltration.
This rule monitors network logs (from proxies and firewalls) for web traffic (HTTP GET requests) containing suspicious JavaScript code injection patterns in the request context or message fields. It specifically looks for common XSS indicators such as <script tags, eval(), document.write(), fromCharCode(), and atob().
Page 67 of 235