Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,917 detections
Filters
Last updated
All Time
Detection languages
2,237
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
806
765
576
Platforms
1,843
1,022
856
814
657
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,636
12,582
8,393
6,221
4,917
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects phishing emails leveraging Telephone-Oriented Attack Delivery (TOAD). These emails impersonate Scotiabank and use urgent themes regarding unauthorized $3,000 Interac e-Transfers to lure victims into calling an attacker-controlled toll-free number. The rule monitors for specific email subjects and attachments masquerading as voicemail audio files (v-mail*.mp3.eml or v-mail*.html).
This rule detects suspicious activities related to AWS S3 buckets that could indicate a bucket hijacking attempt or unauthorized replication to an external account. Specifically, it looks for two scenarios: 1) an S3 bucket being deleted and then recreated by a different AWS account within a one-hour window, suggesting a namespace hijacking, or 2) an S3 bucket being deleted while a PutBucketReplication event references an external AWS account, indicating an attempt to exfiltrate data or maintain access through replication.
Detects the node.exe process deleting its own executing script file 'setup.cjs' located within an 'easy-day-js' node_modules directory. This behavior is indicative of the anti-forensics self-deletion mechanism used by the easy-day-js supply chain dropper to remove its footprint after executing a subsequent malicious payload.
Detects unauthorized file access to browser extension directories and credential stores (History, Login Data) by a suspicious Node.js process named 'protocal.cjs'. This activity is characteristic of the 'easy-day-js' supply chain compromise, where a malicious backdoor attempts to exfiltrate browser-stored credentials and history from Chrome, Edge, and Brave browsers.
Detects a multi-stage infection chain associated with HijackLoader delivered via ErrTraffic ClickFix lures. The rule identifies a sequence where a web browser spawns a PowerShell process that subsequently creates a large archive file (binary bloating), followed by the execution of suspicious processes (often associated with process injection/hollowing) from the extracted context.
Detects a suspicious pattern where a highly privileged on-premises synchronized user account signs into Azure Active Directory (Entra ID) and immediately performs sensitive administrative actions (role assignment or OAuth application consent grant) within a 30-minute window. This behavior is indicative of credential abuse by the Storm-2372 actor to escalate privileges within a tenant.
Detects the creation or download of 'injection-obf.js', an obfuscated JavaScript payload associated with VVS Stealer for Discord injection. The rule captures details like source URL, referrer, and responsible process to aid in containment and scoping.
Detects high-frequency requests to sensitive management or API-related URL paths (/msp/, /api/, /wyse/, /wms/) that are not preceded by successful authentication attempts. This pattern is characteristic of automated exploitation attempts or unauthorized discovery against network management or configuration interfaces from external IP addresses.
Detects attempts to exploit CVE-2026-12537 in the Google Gemini CLI, which allows for unauthorized manipulation of the .gemini/.env configuration file. The rule triggers on GET or POST requests attempting to access or modify this specific environment file, potentially enabling malicious environment variable injection.
This rule detects potential Remote Code Execution (RCE) exploitation attempts targeting Dell Wyse Management Suite (WMS) by identifying abnormally large POST requests containing JSON payloads directed at specific management paths (/WMS/ or /wyse/). This behavior is indicative of an exploit attempt against CVE-2026-41120.
Detects the transmission of a Windows executable binary file in an HTTP response stream, which may indicate an attempt to exploit vulnerabilities in Dell Wyse Management Suite (CVE-2026-41120 or CVE-2026-49506) by delivering malicious payloads.
This rule detects attempts to access sensitive .env configuration files in Gemini CLI applications, which may indicate an attempt to exploit CVE-2026-12537. Attackers target these files to retrieve credentials or environment variables that could lead to Remote Code Execution (RCE) within CI/CD pipelines or deployment environments.
This rule monitors HTTP traffic for the presence of a Python Pickle deserialization payload in the response body. Attackers use serialized Python objects to achieve remote code execution when these objects are improperly deserialized by a client application. This signature specifically looks for the hexadecimal byte sequence associated with the pickle protocol in conjunction with HTTP responses containing text or binary data.
Detects instances where node.exe or npm.exe processes spawn PowerShell to execute download-related cmdlets (e.g., Invoke-WebRequest, IEX) or encoded commands, followed by the execution of a process from user-writable directories (TEMP or AppData) within a one-minute window, a pattern associated with PostCSS typosquatting supply chain attacks.
Correlates JS payload execution with immediate network requests to high-reputation but compromised shadowed domains used for traffic proxying. Specifically, this rule detects network connections initiated by 'wscript.exe' to known SocGholish domain shadowing infrastructure.
This rule detects attempts to perform Large Language Model (LLM) prompt injection via HTTP requests. It monitors proxy traffic for common jailbreaking or adversarial instruction patterns such as 'ignore previous instructions', 'bypass restrictions', or 'fictional environment' within URI parameters or request bodies. Such patterns are indicative of an attacker attempting to manipulate the behavior of an AI/LLM application.
Detects high-frequency requests to sensitive management or API-related URL paths (/msp/, /api/, /wyse/, /wms/) that are not preceded by successful authentication attempts. This pattern is characteristic of automated exploitation attempts or unauthorized discovery against network management or configuration interfaces from external IP addresses.
This rule detects network activity involving known suspicious domains and the download of specific, potentially malicious files (archives and installers). The monitoring focuses on HTTP/proxy/DNS traffic where hostnames, URLs, or query parameters match indicators of malicious activity.
Detects attempts to exploit CVE-2026-12537 in the Google Gemini CLI, which allows for unauthorized manipulation of the .gemini/.env configuration file. The rule triggers on GET or POST requests attempting to access or modify this specific environment file, potentially enabling malicious environment variable injection.
This rule detects attempts to exploit a path traversal vulnerability (CVE-2026-49506) in the Dell Wyse Management Suite API. The rule inspects HTTP requests for directory traversal sequences such as '..' or URL-encoded equivalents, which could allow an unauthorized attacker to access files or directories outside the intended scope on the web server.
Detects the transmission of a Windows executable binary file in an HTTP response stream, which may indicate an attempt to exploit vulnerabilities in Dell Wyse Management Suite (CVE-2026-41120 or CVE-2026-49506) by delivering malicious payloads.
Page 71 of 235