Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects successful OAuth application consent grants or service principal role assignments involving sensitive permissions, such as read access to mail, contacts, files, or directory information. This activity is a common indicator of OAuth-based phishing or unauthorized persistent access to cloud resources.
Detects modifications to the Active Directory AdminSDHolder object's DACL, which is a known technique for achieving persistence in an AD environment. The rule alerts when a user (that is not a service account) modifies this object, correlating it with membership in highly privileged groups.
This rule monitors Microsoft Entra ID (Azure AD) sign-ins for indicators associated with the 'Payroll Pirate' campaign. It identifies non-interactive OAuth/token-based authentication requests originating from residential Internet Service Provider (ISP) ASNs using devices marked as unmanaged. It further elevates risk by detecting impossible travel (same user accessing from multiple IPs in a short window) and the use of specific browser User-Agent strings (Firefox or Axios) characteristic of the threat actor's tooling.
This rule detects potential container escape attempts by monitoring for malicious use of the 'docker cp' command with path traversal sequences (../) or the creation of suspicious files by the docker daemon outside of expected docker storage directories, which may indicate symlink injection attacks to modify files on the host filesystem.
Detects network activity and successful administrative logins to Cisco SD-WAN vManage devices originating from IPs associated with threat actor UAT-8616. The rule also flags any successful vmanage-admin logins originating from outside known trusted management network ranges, which may indicate exploitation of CVE-2026-20127 or CVE-2026-20182.
This rule monitors Cisco SD-WAN environments for indicators of post-exploitation, including unauthorized SSH lateral movement, abuse of administrative tools (vshell, confd_cli), suspicious tenant list modifications related to CVE-2026-20245, privilege escalation to backdoor accounts, system file tampering (/etc/passwd, /etc/shadow), and anti-forensic activities such as log and history deletion.
Detects a suspicious sequence of events where a user successfully authenticates via SSH to a Cisco SD-WAN Manager (vManage) using the 'vmanage-admin' account, followed by REST API calls to enumerate device inventory (vedges or controllers) from the same source IP within 30 minutes. This behavior is indicative of potential post-exploitation activity or reconnaissance associated with the UAT-8616 campaign.
This query detects multiple TTPs associated with the Storm-2561 campaign that uses SEO poisoning to distribute fake VPN clients for credential theft. It looks for known file hashes, a specific code-signing certificate, malicious DLL side-loading and C2 communication patterns.
This rule detects indicators of exploitation for CVE-2026-20245 in Cisco Catalyst SD-WAN Manager. It monitors for the upload of malicious tenant configuration files, the creation of unauthorized 'troot' administrative accounts, subsequent lateral movement via 'su', modifications to critical system authentication files like /etc/passwd or /etc/shadow, and post-exploitation configuration exfiltration via REST API endpoints.
Detects suspicious activity associated with the AdaptixC2 framework, specifically process hollowing or shellcode injection where WmiPrvSE.exe spawns or creates remote threads in WAB.exe (Windows Address Book). This pattern has been observed in Akira ransomware intrusions.
Detects successful SSH authentication to administrative accounts ('vmanage-admin' or 'admin') on Cisco Catalyst SD-WAN Manager (vManage) devices originating from IP addresses associated with the threat actor UAT-8616. This activity relates to exploits targeting CVE-2026-20127 and CVE-2026-20182 for unauthorized access via authentication bypass or certificate abuse.
Detects instances where the RustDesk remote support process (rustdesk.exe) spawns suspicious child processes such as command shells, scripting engines, or administrative utilities. This behavior is indicative of a potential session permission bypass or post-exploitation activity where an attacker leverages the context of the remote support application to execute arbitrary commands.
Detects the creation of the '\adprinterpipe' named pipe by a process other than authorized AnyDesk binaries. This activity is indicative of a local privilege escalation (LPE) technique where an attacker pre-creates the pipe to impersonate the AnyDesk service and intercept a SYSTEM-level token.
Detects suspicious activities often associated with malware (such as DcRAT or Operation DragonReturn) including the loading of amsi.dll by unauthorized processes in writable directories to facilitate patching of AMSI, and unauthorized cross-process memory writing into svchost.exe from non-system, potentially unsigned or suspicious processes.
This rule detects the creation of executable files within specific directories in the user's AppData Roaming profile, specifically matching patterns associated with known persistence or malicious staging filenames (xwreg or xgdf). This location is frequently abused by attackers to store persistent payloads that execute outside of standard program directories.
Detects anomalous activities targeting SaaS CRM applications (Salesforce, Microsoft Dynamics 365, HubSpot), including high-volume bulk exports, off-hours access, mass API queries for sensitive objects, and suspicious OAuth token grants.
This rule detects the loading of DLL modules from non-standard system directories (outside of Windows, System32, SysWOW64, or Program Files) by signed processes, or the loading of files with known suspicious filenames such as 'MiniJunk' or 'TRUSTRAP'. This behavior is indicative of potential DLL sideloading, search order hijacking, or the loading of malicious payloads masquerading as legitimate libraries.
This rule detects the creation of a scheduled task via schtasks.exe using parameters often associated with malicious persistence mechanisms, such as running as SYSTEM, requiring highest privileges, or placing task actions in directories like Temp, AppData, or Public. This behavior is consistent with tactics used by various threat actors, including UNC1549/MiniJunk, to maintain persistence.
This rule detects unauthorized exploitation attempts against Gitea environments vulnerable to CVE-2026-20896. When Gitea is configured with REVERSE_PROXY_TRUSTED_PROXIES set to permit all sources, an attacker can bypass authentication by injecting the 'X-WEBAUTH-USER: admin' header in HTTP requests. This allows the attacker to gain administrative privileges and perform unauthorized actions, such as creating new admin accounts or accessing restricted API endpoints.
This rule detects potential lateral movement or account compromise by identifying instances where a single user account successfully logs into four or more unique computer systems via Remote Desktop (Logon Type 10) within a 30-minute window.
This rule monitors for file system activity associated with the 'libpwn' exploit suite, specifically targeting files related to the exploitation of CVE-2026-55200. It flags the presence of exploit harnesses, probes, and proofs of concept (PoCs) identified by specific filenames and directory structures.
Page 33 of 401