Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,304 detections
Filters
Last updated
All Time
Detection languages
676
264
155
72
49
Contributors
232
195
187
166
110
Categories
344
308
229
217
143
Platforms
472
418
224
173
138
Products / Services
264
262
195
176
104
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,304
CVEs
5
4
3
3
3
IDS Classtypes
103
67
24
23
12
IDS Protocols
167
51
16
14
7
Detects web requests associated with PHP2Shell exploitation attempts: probing for randomized shell_<8 hex> files in common upload directories (.php, .phtml, .php5, .phar) and PoC marker strings in the query string. In the observed campaign these probes returned 404,but a 200 response on a matching path should be treated as a confirmed webshell.
Correlates devices touched by known IoC IP scan waves with PHP software inventory, vulnerability management data for PHP CVEs, and active PHP process execution telemetry to identify vulnerable exposed web servers.
Detects process command lines containing C2 operator start flags or strings alongside reconnaissance tools or platforms like fofa or skynet.
Detects the execution of two or more distinct Active Directory discovery, credential extraction, or coercion tools (such as NetExec, Kerbrute, noPac, PetitPotam, SoftPerfect Network Scanner, or Impacket scripts) on the same device within a 1-hour window.
Detects the deployment of the ARTEX AI penetration testing framework via Docker/Docker-compose combined with the execution of offensive security and scanning tools (such as nmap, sqlmap, nuclei, httpx, apktool, frida) on the same host within a specified timeframe.
Detects high volume and diverse URI requests targeting login, search, or inquiry endpoints on IIS servers within a short time window, indicative of web brute force or active reconnaissance scanning.
Detects potential vulnerability scanning, enumeration, or bulk data extraction against Request Tracker (RT) web paths by monitoring high request volumes, distinct URI counts, or large response byte sizes within CommonSecurityLog data.
Detects high volume and diverse URI requests targeting login, search, or inquiry endpoints on IIS servers within a short time window, indicative of web brute force or active reconnaissance scanning.
Detects Windows PE executable files written to disk with company metadata matching Sysinternals (Sysinternals - www.sysinternals.com). This detection identifies the presence of Sysinternals tools on endpoints for security monitoring and investigation.
Sysinternals tools are legitimate administrative utilities but may also be leveraged by threat actors for reconnaissance, process inspection, credential access, and lateral movement. Review the file path, SHA-256 hash, user context, and associated process activity to determine whether the file is authorized or potentially suspicious.
Note: The presence of a Sysinternals executable alone does not indicate malicious activity.
Sysinternals tools are legitimate administrative utilities but may also be leveraged by threat actors for reconnaissance, process inspection, credential access, and lateral movement. Review the file path, SHA-256 hash, user context, and associated process activity to determine whether the file is authorized or potentially suspicious.
Note: The presence of a Sysinternals executable alone does not indicate malicious activity.
Detects suspicious DNS queries to external service interaction domains often used for out-of-band interactions after successful RCE
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
This rule detects devices with a BIOS release date older than 730 days (2 years), which could indicate unpatched or outdated firmware posing security and stability risks.
Detects non-browser Python-based HTTP clients (such as python-requests, python-urllib, aiohttp, or httpx) targeting specific API endpoints (/user, /profile, /order, /upload) while exhibiting indicators of SQL injection or high-volume object ID enumeration.
Detects clusters of high-volume external source IPs from multiple countries sweeping the same financial web services within an hour.
Detects DNS resolutions to popular threat intelligence, reputation, and sandboxing APIs (e.g., VirusTotal, URLScan, AbuseIPDB) originating from non-browser processes on non-analyst workstations. This behavior may indicate an attacker programmatically querying these services to verify if their infrastructure, payloads, or IP addresses are flagged as malicious, or to conduct reconnaissance.
Another small hunting idea using CallActivityEvents Table. The query extracts the Top-Level Domain (TLD) from the person performing the action in a Microsoft Teams call and enriches it with an external country list. In this example, I exclude .CH to quickly surface activity where the originator is using a domain associated with another country. A different hunting angle to spot unexpected external participants, unusual call activity, or simply identify interactions that deserve a closer look. Of course, a foreign TLD is not malicious by itself — it is just another piece of context for the hunter. 🔎
Detects clusters of high-volume external source IPs from multiple countries sweeping the same financial web services within an hour.
Detects clusters of high-volume external source IPs from multiple countries sweeping the same financial web services within an hour.
Page 1 of 63