Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,613 detections
Filters
Last updated
All Time
Detection languages
1,725
690
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
728
629
473
Platforms
2,069
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
3,613
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects a suspected ransomware double-extortion sequence: the bulk creation of password-protected archives using compression utilities (e.g., 7z, RAR), followed by significant outbound network connections to common cloud storage or anonymization endpoints, and concluding with mass file modifications indicative of encryption activity.
Detects browser extension updates that request a combination of high-risk permissions capable of account takeover (e.g., cookies, webRequest, identity) for extensions previously classified as low-risk. This pattern often indicates a supply chain compromise where a benign extension is acquired and subsequently updated with malicious capabilities.
Detects browser extension updates that request a combination of high-risk permissions capable of account takeover (e.g., cookies, webRequest, identity) for extensions previously classified as low-risk. This pattern often indicates a supply chain compromise where a benign extension is acquired and subsequently updated with malicious capabilities.
Detects browser extension updates that request a combination of high-risk permissions capable of account takeover (e.g., cookies, webRequest, identity) for extensions previously classified as low-risk. This pattern often indicates a supply chain compromise where a benign extension is acquired and subsequently updated with malicious capabilities.
Detects network traffic associated with Adversary-in-the-Middle (AiTM) phishing kits that impersonate Microsoft and Google login pages. The rules identify the presence of specific HTML elements (like Cloudflare Turnstile anti-bot gates) and authentication session cookie headers served from non-authorized/non-official domains, indicating a reverse-proxy phishing attack.
Detects the execution of command-line archiving utilities (e.g., 7z, rar, zip) to create potentially password-protected archives within common staging directories (Temp, Public, ProgramData), followed by an outbound network connection to an external destination. This behavior is consistent with data staging and subsequent exfiltration.
Detects a suspicious sequence of events where a user exhibits signs of account compromise—either through impossible travel patterns or the use of OAuth tokens on a new device—followed within one hour by the modification of mailbox settings, such as creating new inbox rules or modifying mailbox permissions, which is a common indicator of persistence and email exfiltration.
Detects high-risk GitHub events indicating data or asset exposure, such as creating public repositories with specific naming conventions, changing private repositories to public, or creating new gists, which could indicate exfiltration of sensitive assets or information.
Detects high-risk GitHub events indicating data or asset exposure, such as creating public repositories with specific naming conventions, changing private repositories to public, or creating new gists, which could indicate exfiltration of sensitive assets or information.
Detects sign-in patterns indicative of Adversary-in-the-Middle (AiTM) phishing attacks such as EvilProxy or Tycoon2FA. The rule identifies a sequence where a user fails an MFA challenge (using codes 50074 or 50140) followed by a successful authentication within a short period (1 hour) where the MFA claim appears as 'Previously satisfied' or 'already succeeded' from a different IP address or user-agent string, suggesting the session was stolen or replayed.
This rule detects unauthorized processes attempting to read sensitive configuration files (secrets.json, config.yaml) associated with AI coding assistants like Cline and Continue. By filtering out known, legitimate IDE and development processes, the rule highlights potential file-grabber activity indicative of an infostealer attempting to exfiltrate plaintext LLM API keys.
Detects command-line operations indicative of bulk data export, dumping, or unauthorized scanning against vector databases (e.g., Pinecone, Chroma, Milvus, Qdrant) and caching backends (e.g., Redis). Such activities may indicate an adversary attempting to exfiltrate training data, embeddings, or context stored within an AI agent's memory backend.
Detects network activity associated with the LONGTALE malware family (attributed to APT31/JungleBamboo). This includes identification of specific malicious browser extension IDs in HTTP traffic and signature-based detection of periodic HTTPS/HTTP beaconing patterns indicative of session or cookie exfiltration.
Detects the behavior of LunexStealer targeting cryptocurrency wallets. The rule monitors for the enumeration of known crypto wallet files and browser-stored extension data, followed closely by the creation of a 'wallet.zip' archive by the same process, which is indicative of staged data collection for exfiltration.
Detects a suspicious sequence of events where a host performs multiple reconnaissance-style probes (health checks, documentation, or OpenAPI definitions) followed within 10 minutes by access to sensitive artifact-related URLs on the same remote host. This pattern is indicative of an attacker profiling a target server for metadata and then proceeding to exfiltrate files or sensitive artifacts.
Detects the creation of a 'roblox_cookies.txt' file within a Roblox-related directory, correlated with a process command line containing the '.ROBLOSECURITY' token. This behavior is indicative of malware harvesting session tokens for credential theft.
Detects anomalous SMB network logon events (Logon Type 3) that are characteristic of NTLM relay attacks. This includes logons involving NTLM V1, anonymous logins, or logons lacking workstation information, which are often indicative of tools like Responder or other relaying utilities.
Detects Salesforce Experience Cloud guest user sessions performing queries or reads on objects not within the authorized allowlist. This behavior, characterized by an abnormal volume of records retrieved or anomalous query patterns, is consistent with attempts to exploit misconfigured guest profile permissions to access internal sensitive data.
Detects user authentication events where the MFA redirect URL points to an unrecognized or potentially malicious domain. This behavior is indicative of an Adversary-in-the-Middle (AiTM) attack, such as the TrustSink credential capture technique, where the user is diverted from the legitimate identity provider to an attacker-controlled OIDC endpoint to capture credentials or session tokens.
Detects anomalous AWS IAM and Secrets Manager API activity indicative of credential abuse following suspected exposure. The rule identifies suspicious patterns such as unauthorized enumeration of access keys, secret retrieval, and creation of new keys by non-service principals, reflecting activity associated with ShinyHunters-style operations where compromised credentials are abused.
Detects a burst of file access or download operations from SharePoint or OneDrive by a single user account within a short timeframe. This behavior is indicative of bulk data collection or exfiltration, often associated with post-credential-theft activity where an attacker stage and extract organizational data.
Page 9 of 173