Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects the creation of specific file artifacts (WhatsAppData.zip, whatsapp_backup.lock) associated with a Python-based WhatsApp stealer deployed by the Silver Fox (Void Arachne) intrusion set. This malware is designed to collect credentials and host data.
Detects PowerShell script block logging events (Event Code 4104) that indicate the instantiation of the Outlook COM object via the MAPI namespace. This behavior is associated with malware like Horabot for email harvesting and spreading.
Detects when a single user account successfully signs in from two or more distinct IP addresses within a short timeframe. This can be an indicator of an adversary-in-the-middle (AiTM) attack where both the legitimate user and the attacker have active, authenticated sessions from different locations.
This rule detects the access or creation of Microsoft Office files (docx, xlsx, pptx) that have 'password' or related keywords in their filename or folder path. It also attempts to identify if these files contain password-related content through DLP indicators, suggesting potential sensitive data exposure or staging.
Detects potential adversary-in-the-middle (AiTM) session hijacking by identifying a single session ID being used in successful sign-ins from multiple distinct IP addresses and with different User-Agent strings within a short timeframe. This behavior is indicative of an attacker stealing a session cookie and replaying it from their own machine, a technique commonly used by phishing kits like Tycoon2FA.
Detects potential adversary-in-the-middle (AiTM) session hijacking by identifying a single session ID being used in successful sign-ins from multiple distinct IP addresses and with different User-Agent strings within a short timeframe. This behavior is indicative of an attacker stealing a session cookie and replaying it from their own machine, a technique commonly used by phishing kits like Tycoon2FA.
This rule detects the use of the 'makecab.exe' utility to compress the Active Directory database (ntds.dit) or the SYSTEM registry hive. This is a technique used by attackers to prepare credentials and system secrets for exfiltration, as observed in intrusions following FortiGate compromises.
Azure Blob SAS Access
Cortex XDR
Detects access to Azure Blob Storage using Shared Access Signature (SAS) authentication. This rule specifically looks for successful blob operations where the authentication type is SAS and the identity name matches 'key1' or 'key2', which are often associated with storage account access keys used to generate SAS tokens. Monitoring such access can help identify unauthorized or suspicious use of SAS tokens.
Detects access to the Zimbra mailbox export endpoint (/home/~/?fmt=tgz). This native Zimbra feature is actively abused by APT actors (such as in Operation GhostMail) to silently export emails without deploying custom collection tools.
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Detects Node.js processes performing clipboard monitoring or screenshot capture using npm packages like screenshot-desktop, consistent with Contagious Interview spyware.
Detects the creation of temporary files used by the DarkSword implant to stage stolen data before exfiltration. After exploiting the device, the DarkSword implants copy sensitive user data to temporary files. Detecting the creation of these specific staging files is a strong indicator of compromise.
KQL Query
Detects process command lines containing strings characteristic of the GHOSTBLADE dataminer, a payload deployed by UNC6353 via the DarkSword exploit. These strings are hardcoded file paths used for data collection and exfiltration.
This rule correlates an email URL click with a subsequent risky sign-in from the same user within a short timeframe (1 hour). This is a strong indicator of a successful Adversary-in-the-Middle (AiTM) phishing attack, such as those conducted with the Tycoon2FA kit, where a user is tricked into authenticating through a malicious site, allowing the attacker to capture their session.
Detects a script interpreter process (like node.js or bun) spawning a known credential scanning tool (e.g., trufflehog, gitleaks).
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
This behavior is indicative of an attempt to find and steal secrets, as seen in the "Shai-Hulud: The Second Coming" campaign.
Detects when a single user account successfully signs in from two or more distinct IP addresses within a short timeframe. This can be an indicator of an adversary-in-the-middle (AiTM) attack where both the legitimate user and the attacker have active, authenticated sessions from different locations.
Detects the creation of HTML files with specific formatting tags used by the SlimAgent keylogger, a tool used by Sednit (APT28).
Azure Blob Anonymous Access
Cortex XDR
Detects unauthenticated or anonymous access attempts to Azure Blob Storage. This rule identifies successful operations where the identity is explicitly listed as 'anonymous', indicating potential misconfigurations or unauthorized access to sensitive data.
Detects a FortiGate configuration file download occurring within 10 minutes of a successful administrative login from the same user and source IP address. This rapid sequence of events can indicate an attacker who has gained administrative access and is proceeding to exfiltrate sensitive configuration data, which may contain credentials for other systems.
This rule detects artifacts associated with the APT36 CreepDropper malware, specifically focusing on scheduled task names and staging file markers. It looks for specific strings related to scheduled tasks like 'MicrosoftEdgesUpdatesTasksMachineUAs-Task' and 'MicrosoftEdgesUpdatesTasksMachineUAs-1234-87hy', as well as a staging file named 'ds.png' and other related strings such as 'msedge.exe', 'Task10', and 'System.Reflection.Assembly'. The rule requires at least four of these strings to be present, along with the MZ header, indicating a Windows executable.
Page 131 of 173