Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,655
12,603
8,413
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the initialization sequence of the ORAX command-and-control framework, characterized by a handoff via a spoofed Cloudflare verification page followed by a WebSocket upgrade request.
Detects potential session hijacking of a Claude SaaS account by identifying sign-ins from unrecognized IP addresses followed by a high-volume burst of API usage or message activity that deviates from the account's established baseline.
This rule monitors for two distinct suspicious patterns: first, the interaction between Claude Desktop and the CEF (Chromium Embedded Framework) library, which may indicate unauthorized plugin or extension loading; second, the execution of non-standard binaries initiated by various JetBrains IDE processes located outside of standard program directories, which could indicate process hollowing or unauthorized tool execution.
Detects unauthenticated access attempts or requests originating from system/service accounts targeting the PaperCut NG/MF administrative interface, which may indicate exploitation of authentication bypass vulnerabilities (e.g., CVE-2026-81578).
These rules detect behavioral patterns associated with GhostCode-style anti-analysis, including URI-based gate redirection (turnstile checks), automated client filtering (User-Agent scanning), and UI-based spoofing (tab title masquerading) often used to protect malicious infrastructure from automated analysis tools and bots.
Detects HTTP GET requests to a specific path structure /scanna/ which includes a token-like identifier and a check=1 parameter. This pattern is indicative of a bot-filtering relay mechanism often used by malicious scripts or malware to validate or redirect traffic while attempting to evade security scanners.
Detects Android malware performing anti-debugging, anti-instrumentation, and environmental checks to evade analysis. The rule monitors for processes querying system properties, checking for debugging artifacts like TracerPid, attempting to locate Frida instrumentation agents, or identifying rooting/Xposed framework artifacts and emulator-specific files.
Detects a non-system application using the PackageInstaller Session API to perform sideloading followed immediately by a request or binding to an AccessibilityService. This behavior is indicative of malicious droppers or malware (such as the RatHat Android malware family) attempting to bypass install restrictions and gain elevated control over the device to manipulate settings like Developer Options or Wireless Debugging.
Detects phishing emails associated with the Mirage2FA campaign, which utilize HTML smuggling via .htm, .xhtml, or .svg attachments, often disguised as voicemail or contract-related documents. The rule also accounts for social engineering lures involving QR codes.
Detects anomalous sign-in activity where a single Microsoft 365 or Entra ID user account successfully authenticates from multiple distinct residential or mobile-carrier ASNs within a 24-hour window. This behavior is highly indicative of an adversary replaying stolen session tokens (AiTM) through rotating residential proxy networks to blend into legitimate user traffic and circumvent location-based or datacenter IP-based access restrictions.
Detects the creation or modification of O365 inbox rules designed to move incoming emails to the 'Deleted Items' folder, delete messages, or mark them as read. This behavior is a common indicator of an adversary attempting to hide phishing lures, security alerts, or C2 communications within a compromised mailbox.
Detects anomalous 'Bind' operations in Microsoft 365 Exchange Online audit logs where the user-agent string includes 'Firefox/131.0' and 'Client=REST' while using specific Microsoft Outlook ClientAppId and APIId parameters. This pattern has been observed in automated, cross-tenant mailbox exfiltration campaigns targeting sensitive payroll and financial documentation.
Detects the issuance of a Primary Refresh Token (PRT) to Microsoft Graph occurring in close temporal proximity to a device code authentication flow. This pattern is indicative of device-code phishing attacks, where an adversary intercepts a device code to obtain long-lived, session-persistent access to a tenant.
Detects the creation of files within the /etc/cron.d/ directory initiated by the redis-server process, specifically looking for malicious payloads containing bash -c and /dev/tcp/ command wrappers indicative of a reverse shell or beaconing persistence mechanism often used by Redis-targeting botnets.
Detects the creation of an email inbox rule that includes both a concealment/deletion action and an external forwarding destination, occurring within 4 hours of a high-risk or compromised device-code authentication event. This pattern is indicative of account takeover where an attacker establishes persistence and exfiltration while hiding their activity.
Detects the creation of an email inbox rule that includes both a concealment/deletion action and an external forwarding destination, occurring within 4 hours of a high-risk or compromised device-code authentication event. This pattern is indicative of account takeover where an attacker establishes persistence and exfiltration while hiding their activity.
Detects the creation of an email inbox rule that includes both a concealment/deletion action and an external forwarding destination, occurring within 4 hours of a high-risk or compromised device-code authentication event. This pattern is indicative of account takeover where an attacker establishes persistence and exfiltration while hiding their activity.
Detects instances where the Steam service (steamservice.exe) is executing suspicious child processes such as command interpreters or binaries located in unusual paths like Temp, Downloads, or AppData, often indicating an attempt to hide malicious activity under a trusted process.
This rule detects the execution of the SentinelOne memory scanner process (SentinelMemoryScanner.exe) or the loading of the associated SentinelOne core library (SentinelAgentCore.dll) from a directory path outside of the standard SentinelOne installation locations (Program Files\SentinelOne or Program Files (x86)\SentinelOne). This behavior is indicative of potential masquerading or tampering where an adversary attempts to execute a renamed or moved security tool to bypass policy or evade detection.
Detects sign-in events where Multi-Factor Authentication (MFA) was satisfied using an External Authentication Method (EAM) that asserts specific possession or inherence claims (e.g., 'hwk' - hardware key). This behavior may indicate an adversary attempting to bypass or forge MFA responses via a rogue EAM provider.
Detects when a user has been elevated to manage all Azure Subscriptions.
This change should be investigated immediately if it isn't planned.
This setting could allow an attacker access to Azure subscriptions in your environment.
This change should be investigated immediately if it isn't planned.
This setting could allow an attacker access to Azure subscriptions in your environment.
Page 104 of 864