Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,918 detections
Filters
Last updated
All Time
Detection languages
2,238
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
807
765
577
Platforms
1,844
1,022
856
814
658
Products / Services
988
596
477
456
383
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
4,918
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects high-volume SSH or network logon failures from a single source IP address within a short time window, indicative of a brute force attack. The rule specifically mentions consistency with 'mpbrute2.bin' tooling used in the 'FortiBleed' campaign.
Detects the execution of pg_dump or pg_restore initiated by Splunk processes with unexpected remote hosts or custom directories. This behavior is indicative of CVE-2026-20253 exploitation, where an unauthenticated attacker can abuse the PostgreSQL Sidecar Service to achieve remote code execution.
Detects network connections to privnote.com used by UNC3753 for delivering installation commands during social engineering attacks. The threat actors use this self-destructing text service to transmit cURL commands and RMM installer links without leaving permanent browser footprints.
Detects multiple failed connection attempts to Azure Database for MySQL, which may indicate a brute force attack. This rule specifically looks for 'Access Denied' errors (error code 1045) or other non-zero error codes during connection attempts within a defined timeframe from the same client IP address.
Detects a successful Key Vault access policy or role change that grants secret-reading capability to a user or service principal. This could indicate an adversary attempting to gain access to sensitive credentials stored in Azure Key Vault.
Detects the scope-squatted package preinstall script executing the Claude CLI to harvest the developer's authenticated session email. Specifically, it looks for 'node.exe' as the initiating process, executing a process named 'claude' or a process with 'auth' and 'status' in its command line.
Detects endpoint connections directly to Kali365 PhaaS panel domains, which are associated with phishing-as-a-service operations. This rule identifies network activity to specific domains used by the Kali365 platform, indicating potential compromise or interaction with phishing infrastructure.
Detects general Entra ID sign-ins originating from Railway.com PaaS IP space, which could indicate a token replay campaign or other unauthorized access.
Correlates the successful establishment of a reverse proxy (ngrok/cloudflared) with an incoming interactive logon event originating from the local loopback, indicating the tunnel is actively being used for malicious purposes such as Terminal Server Phishing.
Detects the execution of financial-themed executable files (masquerading as .com or .scr) that are launched directly from common email client processes. This rule aims to identify phishing attempts where users are tricked into opening malicious attachments disguised with financial keywords.
Detects first-time external sender domains delivering multiple voicemail-themed or financial urgency emails to the same recipient during off-hours (midnight-06:00 UTC), consistent with Scotiabank TOAD callback phishing targeting CFO/finance executives.
This rule detects the connection of USB devices identified as suspicious based on a curated list of Vendor IDs (VIDs) and Product IDs (PIDs). It monitors 'PnpDeviceConnected' events, extracts VID and PID from the device information, and cross-references them with an external list of known suspicious USB device identifiers. The rule aims to identify potentially malicious or unauthorized USB devices being connected to endpoints.
Detects HTTP requests that include an 'Upgrade' header (specifically for websocket or h2c) in conjunction with a 'Content-Length' header. This combination can be used to perform HTTP Request Smuggling or protocol-specific request queue poisoning attacks, particularly against load balancers or proxy servers like nghttpx.
Detects deployment of phishing landing pages on attacker infrastructure
Monitors Cisco SD-WAN (vManage, vBond, vSmart) appliance logs for authentication events against management accounts. It specifically identifies logins from known malicious IP addresses associated with threat actor activities and flags anomalous authentication methods such as PAM/keyboard-interactive and unvalidated administrative access.
This rule monitors Cisco SD-WAN logs (vManage, auth, and syslog) for suspicious administrative activity including credential manipulation, unauthorized password changes, successful vManage-admin SSH logins, and potential configuration exfiltration via vManage API calls.
Detects potential unauthorized or rogue peer connections within a Cisco SD-WAN infrastructure. The rule monitors certificate-based authentication events for indicators of rogue peers (e.g., certificate mismatches, invalid common names) or connections originating from known malicious IP addresses associated with rogue SD-WAN activity.
This rule detects administrative changes to Cisco SD-WAN environments, including policy pushes, template attachments, device onboarding, and tunnel modifications. It uses a risk-scoring mechanism based on the type of change and whether the activity occurs outside of standard business hours (06:00 to 22:00). High-risk events (score >= 65) trigger an alert, highlighting potential unauthorized infrastructure modifications or malicious device insertion.
Detects the modification of sensitive banking or payment election records (e.g., direct deposit details) in Workday or similar HR SaaS platforms shortly after a user login event from the same source IP. This behavior is consistent with 'Payroll Pirate' style attacks where adversaries use stolen session tokens (via AiTM phishing) to redirect employee salary payments.
Detects the execution of known CVE-2026-55200 exploit harness and server binaries, or the creation of the libpwn_rce_proof.txt artifact. These activities indicate active exploitation staging or the successful execution of an out-of-bounds heap write exploit chain against libssh2.
Detects fake security alert pages used for social engineering attacks
Page 77 of 235