Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,917 detections
Filters
Last updated
All Time
Detection languages
2,237
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
806
765
576
Platforms
1,843
1,022
856
814
657
Products / Services
988
596
477
456
383
MITRE Techniques
18,116
15,636
12,583
8,393
6,222
4,917
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects HTTP/1.1 Upgrade requests directed at an nghttpx proxy that contain a non-zero Content-Length header. This combination is the core primitive for the nghttp2-nghttpx-upgrade-queue-poison-poc attack, where the proxy incorrectly forwards request body bytes to the next backend connection user.
This rule detects attempts to exploit MyBB administrative controls. It monitors for two primary patterns: unauthorized privilege escalation where a limited ACP account creates a new Administrator (usergroup=4) user by bypassing access controls, and unauthorized access by limited ACP accounts to restricted administrative modules such as template and plugin management.
This rule detects network connections to a list of domains identified as associated with phishing activities associated with Crimson Kingsnake. Monitoring these connections can help identify compromised systems or users attempting to access malicious sites.
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
Detects instances where a guest user or an external account (identified by the #EXT# suffix) performs an operation to add a new member to a Microsoft 365 Group. This behavior can be indicative of a guest account being compromised or misused to escalate privileges or gain unauthorized access by modifying group memberships.
Detects potential HTTP Request Smuggling attempts targeting the nghttpx reverse proxy by monitoring for HTTP/1.1 'Upgrade: h2c' requests that include a 'Content-Length' header, or traffic containing known PoC-specific payloads, poisoned paths, or specific nghttp2 version strings that indicate exploitation activity.
Detects instances where a Java-based application (specifically associated with 'floci' or API Gateway components) spawns suspicious child processes such as shell interpreters (sh, bash, powershell, cmd.exe). This pattern is often indicative of post-exploitation activity following a remote code execution (RCE) attempt against a template engine or web-facing gateway. It also identifies specific file paths related to documented 'floci' POCs and RCE payloads.
Detects ImageMagick processes (magick, convert, mogrify) spawning Ghostscript binaries (gs, gswin64c) from non-standard paths or with suspicious command-line arguments indicative of exploitation attempts, including known proof-of-concept markers.
Identifies successful device code authentications originating from non-trusted named locations. This can indicate an attempt to bypass multi-factor authentication or compromise an account through device code phishing.
Detects inbound emails carrying an attachment whose filename matches the voicemail lure pattern (v-mail_*mp3.eml) but whose declared MIME type is application/html — a content-type mismatch used in Scotiabank-impersonation TOAD callback phishing campaigns to bypass gateway filters.
Detects inbound emails masquerading as Scotiabank or Interac e-Transfer alerts that contain a specific attacker-controlled US toll-free number (1-800-472-XXXX). This pattern is indicative of a Telephone-Oriented Attack Delivery (TOAD) campaign targeting financial personnel.
Detects an email attachment file type mismatch where the filename contains 'mp3' to masquerade as an audio file, but the actual MIME type is HTML or EML. This technique was observed in a Scotiabank TOAD (Telephone-Oriented Attack Delivery) callback phishing campaign to trick users into opening interactive phishing pages.
Detects email attachments named to appear as voicemail MP3s but are actually HTML/EML files, as seen in the Scotiabank TOAD campaign.
Detects successful authentications where a Temporary Access Pass (TAP) was used as the primary authentication method. TAPs bypass standard password and MFA requirements, and their usage outside of expected scenarios (like onboarding or account recovery) could indicate an adversary bypassing authentication mechanisms.
Correlates the successful DNS resolution of a legit domain to a malicious IP, followed by an HTTP POST submitting stolen credentials. Specifically looks for POST requests to 'login.microsoftonline.com' where the remote IP address is not a known Microsoft IP range (13.x.x.x or 20.x.x.x).
This rule detects a POST request to the MyBB administrative interface (specifically the user-users module) that contains parameters indicating an attempt to escalate a limited administrative user to a full administrator by assigning the 'usergroup=4' or 'gid=4' identifier, which corresponds to the default Administrator group in MyBB.
Detects potential HTTP Request Smuggling attempts targeting nghttpx proxies. The rule monitors for malicious request patterns involving HTTP/1.1 Upgrade headers combined with a body (Content-Length) designed to poison the request queue, as well as specific path patterns (e.g., /upgrade, /poisoned) or server-agent identification of the nghttp2/nghttpx service.
Detects Node.js or JavaScript runtimes executing code patterns commonly associated with GlassWorm-style supply chain attacks. The campaign abuses invisible Unicode variation selectors to hide malicious payloads that are decoded and executed through eval(). Investigate execution originating from repositories, package managers, VS Code extensions, or temporary development directories.
This rule monitors file creation events for RAR archives containing specific keywords in the filename related to military, intelligence, or drone-related topics in Ukrainian. It also flags specific file hashes associated with malicious activity. The rule is designed to detect the delivery or presence of targeted spearphishing attachments or documents used for information gathering or exploitation.
This rule detects the creation of 'pythonw.exe' within a user's AppData\Local folder. This is a suspicious activity, especially when the file lacks a valid digital signature, as it could indicate the dropping of malicious Python interpreters or scripts by threat actors. The rule specifically looks for the file name and folder path, with an implicit check for the absence of a digital signature (which would require a 'FileProfile' join in a production environment).
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
Page 78 of 235