Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,917 detections
Filters
Last updated
All Time
Detection languages
2,237
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
806
765
576
Platforms
1,843
1,022
856
814
657
Products / Services
988
596
477
456
383
MITRE Techniques
18,116
15,636
12,583
8,393
6,221
4,917
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
This rule detects processes making a high number of successful network connections (10 or more within an hour) to known public container registries such as docker.io or quay.io. This activity could indicate legitimate containerization operations, but also potential malicious activity like downloading malicious container images as part of a supply chain attack, or ingress of tools.
Detects instances where a node.exe process, operating in an npm install or lifecycle hook context, executes a child process (such as cmd, powershell, or bash) that matches known suspicious patterns or actor-defined malicious filenames, indicative of potential supply chain compromise via malicious npm packages.
This rule detects an unusual number of local or remote interactive logons (LogonType 2 or 10) by the 'SYSTEM' account within a one-hour window. While the SYSTEM account is legitimate, direct interactive logons are rare and multiple occurrences could indicate an attempt to escalate privileges or maintain persistence by an attacker.
Detects instances where npm or node.exe spawn shell interpreters (cmd.exe, powershell.exe, bash, sh) with suspicious command-line arguments indicative of malicious activity, such as credential harvesting or unauthorized script execution within package lifecycle hooks (postinstall, preinstall). This is associated with supply chain attacks like the Miasma infostealer and MYRA RAT.
Detects a malicious post-install technique where an npm package utilizes node.exe to perform an 'npm pack' and overwrite critical files within the node_modules directory. This behavior, observed in the Miasma/Polymarket Trap, is designed to bypass static analysis performed during initial installation by swapping legitimate files with malicious variants after the fact.
Detects a successful self-service password reset for a privileged or high-value account when the initiating context does not match an approved helpdesk workflow. This could indicate an attacker attempting to gain access to an account by resetting its password without proper authorization.
Detects inbound emails relayed through GoDaddy secureserver.net infrastructure where SPF and DMARC authentication pass but DKIM is absent, and the X-SECURESERVER-ACCT header is present. This pattern is consistent with the Scotiabank TOAD callback phishing campaign using compromised legitimate domains to bypass email authentication controls.
Detects DNS queries for domains associated with the Tykit phishing kit infrastructure. These domains are used for hosting phishing pages and for C2 exfiltration.
Detects node.js processes spawned from npm postinstall hooks accessing developer credential files including .gitconfig, .npmrc, and GitHub CLI token files, consistent with the Operation Friday Harvest infostealer campaign targeting Claude Code, GitHub CLI, and npm tokens via malicious npm packages.
Detects DNS queries for domains associated with the Tykit phishing kit infrastructure. These domains are used for hosting phishing pages and for C2 exfiltration.
These domains are actively used in phishing campaigns impersonating legitimate software platforms like Homebrew, LogMeIn, and TradingView to distribute Odyssey Stealer and AMOS malware. Blocking these domains can prevent access to malicious download sites.
Detects network requests involving a file named 'cors_exploit_poc.html' in either the URL or the Referrer field. This filename is characteristic of proof-of-concept (PoC) code used to test for vulnerabilities in Cross-Origin Resource Sharing (CORS) policies, which could allow unauthorized cross-domain access to sensitive data.
Detects the staging and potential execution of Java deserialization payloads associated with the ysoserial CommonCollections5 (CC5) exploit, which leverages the BadAttributeValueExpException gadget chain.
Detects unauthorized OS command execution initiated via Oracle DBMS_SCHEDULER jobs, often involving UTL_FILE for output retrieval. This behavior is indicative of RCE attempts against database servers.
Detects outbound network connection from a host to a known malicious IP and port associated with the exploitation of the GeoServer WFS vulnerability CVE-2024-36401. This rule identifies the potential post-exploitation callback, such as a curl command, following successful remote code execution.
This rule detects suspicious web traffic patterns associated with potential Cross-Origin Resource Sharing (CORS) exploitation. It monitors for access to files containing 'cors_exploit_poc', HTTP POST requests containing sensitive 'AMAUTHID' cookies, or the presence of 'withCredentials' headers alongside 'Access-Control-Allow-Origin' configurations. These indicators, particularly when combined, suggest unauthorized attempts to bypass browser-based security models to access sensitive session identifiers or data.
Detects the creation of known webshell filenames within web-accessible directories (such as wwwroot or CFIDE) by ColdFusion or IIS worker processes. This behavior is indicative of an adversary re-establishing persistence or re-compromising a web server through unauthorized file drops after initial exploitation.
Detects network requests to Microsoft 365 Copilot Enterprise Search containing suspicious HTML tags or prompt injection keywords in the query parameter, indicating a potential Parameter-to-Prompt (P2P) injection attempt (CVE-2026-42824).
Detects network connections to known ShinyHunters infrastructure, identified by specific IP addresses and DNS queries for 'azurenetfiles.net'. This activity is associated with the exploitation of Oracle PeopleSoft servers via gadget chain exploitation.
This rule detects POST requests to the URI '/api/device/start' which is indicative of the EvilTokens phishing kit attempting to initiate a Microsoft OAuth Device Code flow. This technique is often used in phishing campaigns to gain unauthorized access to user accounts by tricking them into authenticating through a device code.
This rule detects network traffic indicative of the 'EvilTokens' phishing kit, specifically targeting Microsoft OAuth Device Code flow. It looks for HTTP POST requests to the '/api/device/start' URI on domains hosted on Cloudflare Workers ('.workers.dev'). This pattern suggests an attempt to initiate a device code phishing attack, where adversaries trick users into entering credentials or codes to grant access to malicious applications.
Page 74 of 235