Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,917 detections
Filters
Last updated
All Time
Detection languages
2,237
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
806
765
576
Platforms
1,843
1,022
856
814
657
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,636
12,582
8,393
6,221
4,917
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
AI-powered phishing-as-a-service abusing device-code authentication
This rule detects successful HTTP requests (status 200, 201, 202) directed towards management interfaces (Redfish, CIMC, OSS APIs) by unauthenticated or anonymous users originating from outside the internal network. The rule calculates a risk level based on the variety and frequency of requested paths, flagging potential unauthorized enumeration or exploitation attempts against server infrastructure.
This rule monitors build agent processes (e.g., Jenkins, Bamboo, Gradle, MSBuild) for suspicious DNS activity. It alerts when these processes resolve a high volume (3 or more) of unique external domains that are not associated with typical development, build, or dependency management platforms (e.g., Microsoft, Azure, GitHub, NPM, PyPI, Maven, Sonatype). This behavior may indicate an attempt by an adversary to reach command-and-control servers or exfiltrate data from a compromised build environment.
This rule detects successful HTTP requests (status 200, 201, 202) directed towards management interfaces (Redfish, CIMC, OSS APIs) by unauthenticated or anonymous users originating from outside the internal network. The rule calculates a risk level based on the variety and frequency of requested paths, flagging potential unauthorized enumeration or exploitation attempts against server infrastructure.
Generates a macro-level alert identifying a rapid influx of emails containing links routing through known AiTM reverse proxy architectures, specifically targeting domains like onrender.com, web.app, and workers.dev. The rule triggers if more than 100 such threats are observed within a one-hour window for a given URL domain.
Detects an inbound policy-themed PDF attachment whose extracted URLs lead to a sign-in, authentication, review, or acknowledgement workflow outside the organisation. This rule specifically looks for PDF attachments in emails where the subject contains terms like 'code of conduct', 'policy', 'compliance', or 'handbook', and the extracted URLs within the PDF contain keywords such as 'login', 'signin', 'auth', 'review', or 'acknowledge'.
Detects a Google account completing an OAuth or MFA challenge and then generating a new session from a different client fingerprint (different source IP or user agent) within a 10-minute window. This behavior can indicate a session hijack or an adversary bypassing MFA.
Detects DLL sideloading and suspicious executable execution patterns associated with Obsidian Sandstorm's recruitment-themed spearphishing campaigns. The rule monitors for unsigned or untrusted DLLs loaded by processes in user-writable directories, and the execution of binaries directly from extracted archive paths containing recruitment-related keywords (e.g., job, resume, payroll).
Commodity .NET keylogger and remote access trojan
Detects potential supply-chain attacks where a malicious 'preinstall' hook in an npm package drops and executes a native binary (ELF or PE) from within the 'node_modules' directory. It monitors both the initial execution of the binary by npm/node and subsequent network activity from such binaries, specifically targeting suspicious subdirectories like 'tools/' or '.bin/'.
This rule detects potentially malicious npm activity, including the execution of preinstall hooks in non-standard locations, the use of publishing commands with external registry flags, and the execution of suspicious scripts located within node_modules directories, often indicative of a software supply chain compromise.
Commodity .NET keylogger and remote access trojan
Detects potential supply chain attacks where a suspicious Python package is installed via 'pip' followed by execution of suspicious commands or network activity from 'python.exe' within a short timeframe. This rule correlates process creation events involving pip installations with subsequent suspicious command-line activity or external network connections from Python processes.
Detects instances where a user successfully authenticates from a mobile device (Android or iPhone) that exhibits a geographic mismatch (geo_country vs registered_country), and subsequently performs a sensitive credential or MFA-related action (enrollment or reset) from a different device within one hour. This pattern is indicative of a potential session hijacking or credential compromise where an attacker attempts to establish persistence by enrolling their own MFA device.
Detects anomalous activity consistent with the IronWorm threat actor using compromised CI credentials to perform npm package publishing. The rule identifies a sequence of two events from the same source IP within a 10-minute window: first, an OIDC identity token exchange request at the npm registry, followed by a package publish operation (PUT request). This behavior is characteristic of malicious actors hijacking CI/CD pipelines to inject malicious code into trusted npm packages.
Detects high-frequency requests (over 30 unique paths within a 5-minute window) to sensitive VPN-related URL paths that result in 403 (Forbidden) or 404 (Not Found) status codes from non-internal IP addresses. This behavior is indicative of an adversary performing directory enumeration or vulnerability scanning on public-facing infrastructure.
Detects high-frequency requests (over 30 unique paths within a 5-minute window) to sensitive VPN-related URL paths that result in 403 (Forbidden) or 404 (Not Found) status codes from non-internal IP addresses. This behavior is indicative of an adversary performing directory enumeration or vulnerability scanning on public-facing infrastructure.
Detects malicious node.js processes spawned from npm lifecycle hooks (e.g., install, postinstall) that exhibit suspicious command-line arguments, environment variables, or connections to known malicious domains associated with supply chain compromise campaigns.
Detects node.exe (or node) processes accessing standard shell history files across Linux (.bash_history, .zsh_history, .sh_history, fish_history) and Windows (PSReadLine history). This behavior is characteristic of infostealer payloads, such as those observed in the Polymarket Trap npm supply chain campaign, attempting to collect sensitive command-line history.
Detects the Polymarket Trap technique where a Node.js process executes 'npm pack' during a post-install phase and subsequently overwrites core module files (e.g., index.js) within the node_modules directory. This behavior is used to evade static analysis and conceal malicious code within legitimate dependency files.
Detects email-based phishing attempts impersonating Scotiabank where the sender display name contains 'Scotiabank' but the actual sending domain is not 'scotiabank.com'. The rule specifically looks for emails with SPF and DMARC pass but missing DKIM pass, combined with suspicious subject lines (e.g., 'interac', 'e-transfer', 'unauthorized') or specific IP addresses/GoDaddy infrastructure indicators, and targeting high-value recipients (CFO, finance, etc.). This pattern is consistent with compromised legitimate small-business domain abuse.
Page 69 of 235