Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,084 detections
Filters
Last updated
All Time
Detection languages
418
193
163
156
81
Contributors
381
251
92
71
40
Categories
498
271
255
135
123
Platforms
443
441
267
121
114
Products / Services
10,665
9,758
6,692
4,418
3,749
1,084
MITRE Techniques
278
229
180
177
151
CVEs
17
15
13
13
8
IDS Classtypes
4
IDS Protocols
4
Detects potential poisoning of machine learning training data by identifying unauthorized file modifications to datasets, DVC repositories, or model registries that occur outside of authorized ETL or CI/CD windows.
Detects anomalous, exploratory query patterns by an API key or service account against an AI model inference API. High distinct resource access volume in a short timeframe, potentially combined with off-hours activity, indicates reconnaissance phases such as output-ontology or model-family enumeration, which may precede adversarial-example crafting or verification attempts.
Detects unauthorized attempts to access SharePoint's WebPartPage ToolPane and Gallery endpoints via anonymous web requests. This pattern, characterized by the 'DisplayMode=Design' query parameter and suspicious markup in the request body, is indicative of exploitation attempts targeting vulnerable SharePoint installations to execute arbitrary code or bypass authentication mechanisms.
Detects automated API exploitation attempts, specifically Broken Object Level Authorization (BOLA) scanning. The rule triggers when a single source IP or API token exhibits high-frequency request patterns (5+ requests per second) against resource endpoints with sequentially incrementing IDs. It specifically correlates a spike in 401/403 authorization failures followed by a small count of 200 successes, indicating a potential successful bypass of authorization controls.
Detects anomalous AI agent behavior characterized by a significant spike in resource or tool invocations within a 15-minute window, potentially indicating indirect prompt injection or unauthorized agent hijacking where an agent is coerced into excessive or unauthorized actions.
Detects malicious prompt injection attempts within an LLM conversation session. The rule monitors for ingested content containing common instruction-override keywords (e.g., 'ignore previous instructions', 'system prompt override'), followed immediately by the agent process executing unauthorized actions such as process launch, network connections, or file creation within the same session/user context.
Detects artifacts associated with the JWR phishing framework client engine, specifically focusing on the presence of self-referential .toString().search() anti-debugging checks, decoy variable naming conventions, and WebSocket communication components (JWRCID/JWRCVV, ws-worker.js) used for session establishment.
Detects a post-compromise pattern on a WordPress site where an attacker, after an initial login, rapidly accesses multiple sensitive administrative pages (plugins.php, profile.php, etc.) within a short window, suggesting nonce harvesting. This activity is correlated with the subsequent creation of a suspected webshell file named 's.php'.
This rule detects scenarios where an AI agent executes shell commands or system-level tools immediately after receiving a prompt injection attack from an untrusted source. It correlates agent audit logs—specifically identifying tool calls flagged for prompt injection—with actual endpoint process creation events. It flags process execution as 'High' severity if the command line matches common malicious patterns like encoded commands, IEX, or attempts to access credential material (e.g., lsass, mimikatz).
This rule detects network communication with known malicious infrastructure (C2 IPs and URLs), presence of malicious files identified by SHA256 hashes on disk, and execution of known malicious files. It also correlates these activities with specific operator email addresses involved in the malicious campaign.
This rule detects network communication with known malicious infrastructure (C2 IPs and URLs), presence of malicious files identified by SHA256 hashes on disk, and execution of known malicious files. It also correlates these activities with specific operator email addresses involved in the malicious campaign.
Detects Log4Shell (CVE-2021-44228) exploitation attempts by identifying JNDI lookup patterns (e.g., ldap://, rmi://, dns://) and common obfuscation techniques within HTTP headers, user-agents, and query parameters, which could lead to remote code execution.
Detects malicious Android application installation or launch behavior consistent with the 'Corp MDM' implant. This rule specifically identifies instances where a package named 'com.corp.mdm' is installed or launched and rapidly requests a combination of high-risk permissions including SMS and telephony access (RECEIVE_SMS, READ_SMS, CALL_PHONE) alongside notification permissions, which is characteristic of the implant's initial setup phase.
Detects a single Salesforce user or connected-app session performing an anomalous volume of SOQL queries against sensitive objects including Case, Account, Contact, and Opportunity. This behavior is indicative of mass data enumeration and potential exfiltration, as observed in historical incidents where attackers targeted CRM platforms to extract embedded secrets and sensitive record data.
Monitors SaaS application integration service accounts (e.g., Salesforce connected apps) by establishing baselines for API call volume and accessed object types. The rule alerts on anomalous spikes in usage or deviations in the scope of accessed data objects, which could indicate the abuse of compromised OAuth tokens following a vendor supply-chain compromise.
Detects anomalous Salesforce API export patterns where a user or connected application maintains a daily record export volume below typical burst thresholds, yet accumulates a high total volume over a rolling 7-day period. This pattern mimics 'low-and-slow' data exfiltration techniques used by actors like ShinyHunters to evade standard volume-based DLP alerts.
Detects an abnormally high volume of POST requests from a single source to the Salesforce Aura API endpoint (/s/sfsites/aura) within a short window, which is indicative of automated guest profile enumeration and AuraInspector-style probing activity associated with the ShinyHunters Salesforce campaigns.
Detects high-volume, anomalous data read operations performed by the Gainsight integration service account within Salesforce, which may indicate unauthorized use of the integration token for data exfiltration.
Detects anomalous, high-volume data access patterns within Salesforce, specifically monitoring for bulk API or SOQL query requests by a single user or application. This behavior is indicative of mass data exfiltration from a CRM instance, a tactic observed in extortion-themed campaigns such as those associated with the ShinyHunters group.
Detects high-frequency HTTP requests targeting Salesforce Aura endpoints associated with structural introspection, such as retrieving component definitions or field metadata. This behavior is consistent with the use of the AuraInspector reconnaissance tool to map the internal structure of a Salesforce application.
Detects unauthorized access to CRM platforms (Salesforce) using Salesloft or Drift OAuth tokens, where the source IP address does not match the known legitimate service provider IP ranges. This behavior is indicative of potential token theft or misuse, particularly relevant to supply-chain campaign activities.
Page 10 of 52