Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects rogue DHCP server used for credential interception via DNS spoofing
Detects creation of large archives used to stage data for exfiltration
Detects bulk harvesting of Teams messages for credentials or sensitive data
Detects the creation or renaming of the 'SmartPrintScreen.exe' file within the specific staging directory '\ProgramData\SmartPrint\' used by the LotusLite dropper. This activity indicates the staging of malicious files prior to execution.
Detects file creation events matching the specific staging directory and filename pattern (evo_*/stolen.zip) utilized by the EVOLUTION stealer family. Detecting hardcoded file path behaviors allows defenders to identify stealer families even when static indicators rotate.
Detects HTTP POST requests directed to the specific URI path '/api/validate/keyboard-events', which is used by a North Korean-linked npm malware to exfiltrate keylogger data.
This rule detects a high volume of network connections (10 or more within an hour) from a single process to remote URLs containing 'artifact' or 'maven' on standard HTTP (port 80) or HTTPS (port 443) ports. This activity could indicate legitimate software development or build processes, but also potentially malicious activities such as supply chain compromise, data staging, or exfiltration of development-related artifacts.
Detects an unusually high number of file copy operations to 'public' or 'external' folders within a one-hour window, initiated by the same process account. This behavior could indicate data exfiltration or unauthorized data staging.
This rule detects the creation of new transport rules within Exchange Online. Adversaries may create malicious transport rules to forward emails, bypass security controls, or exfiltrate data. Monitoring the creation of new transport rules can help identify suspicious activity.
This rule detects when sharing inheritance settings are modified in SharePoint. This could indicate an attempt to broaden access to sensitive information, a misconfiguration, or an attacker attempting to maintain access or exfiltrate data.
This rule detects when a user creates two or more email forwarding rules within a one-hour period in Exchange Online. This behavior can indicate an adversary setting up persistence or exfiltration mechanisms for email.
Detects potential session replay attacks indicative of Kali365 and other AitM (Adversary-in-the-Middle) proxying phishing kits. This rule isolates successful user logins containing a SessionId. To fully operationalize this for AitM detection, defenders must utilize SIEM-based correlation (e.g., statistical or window-based queries) to track a single SessionId originating from multiple geographically disparate IP addresses within a short timeframe.
This rule detects potential session hijacking attempts by monitoring HTTP traffic for unusually long cookie values. Specifically, it looks for HTTP cookies containing base64-like strings (alphanumeric characters, plus, slash, and equals signs) that are 100 characters or longer. A threshold of 5 such occurrences within 3 seconds from the same destination IP address triggers the alert, indicating a possible attempt to use a stolen browser session cookie.
This rule detects potential browser session token injection via a Man-in-the-Middle (MitM) attack. It looks for HTTP responses (flow:to_client) that contain the strings "document.cookie", "=", and "XMLHttpRequest" (case-insensitive) within the file data. The combination of these strings in a client-bound HTTP response suggests an attempt to manipulate browser cookies, possibly to inject session tokens, often seen in MitM scenarios where an attacker intercepts and modifies traffic to compromise user sessions.
This rule detects attempts to dump router configuration via a Telnet session. Specifically, it looks for the string "show running-config" being sent to a Telnet server on the home network. This command is commonly used on network devices to display their current running configuration, and its use over an unencrypted protocol like Telnet could indicate unauthorized access or data exfiltration.
This rule detects the exfiltration of a custom XOR-compressed archive over HTTP. It specifically looks for HTTP POST requests originating from the home network, containing file data, with a payload size greater than 10000 bytes, and a PCRE match for a sequence of at least 200 non-ASCII or control characters, which is indicative of XOR-compressed binary data.
This rule detects when a user downloads a large amount of Slack message history via the Slack API. It specifically looks for HTTP requests to 'slack.com' with the URI '/conversations.history' and triggers an alert if 20 such requests are observed from the same source IP within a 60-second window. This behavior could indicate an attempt to exfiltrate sensitive communication data.
This rule detects potential SMB Relay attacks attempting to capture NTLM hashes. It specifically looks for TCP traffic on port 445 (SMB) directed to the home network, where the flow is established and contains both "NTLMSSP" and "NTLMSSP_AUTH" content. A threshold of 3 occurrences within 30 seconds from the same source IP is set to reduce false positives.
Detects instances where Windows screen capture tools (Snipping Tool or Screen Sketch) initiate network connections to external IP addresses on ports commonly associated with Server Message Block (SMB) or Common Internet File System (CIFS). This could indicate an attempt to exfiltrate captured screenshots to an external server.
Detects instances where a web browser (Chrome, Edge, Firefox, Brave, or Internet Explorer) launches 'ms-screensketch'. This activity is unusual as browsers typically do not directly invoke system utilities like Screen Sketch. This could indicate an attempt to capture screen content, potentially for data exfiltration or reconnaissance, or an unexpected browser behavior.
This rule detects suspicious activity where a user successfully performs a multi-factor authentication (MFA) device login to Microsoft Office 365 via a browser, and within a 15-minute window, the same user either creates a new inbox rule or adds a new device. This combination of events could indicate an adversary gaining initial access and then setting up persistence (e.g., forwarding emails) or further device enrollment.
Page 120 of 173