Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
Sweeps network, process command-line and URL-click telemetry for the Kimsuky payload C2 domain and its subdomains using an anchored match, which avoids lookalike or suffix-matching domains.
Detects hosts with the trojanized version 3.0.123 of the Rank Math PRO WordPress plugin distributed in October 2026. It correlates software inventory, file events, command-line process events, and network connections to identify affected packages, installation activity, and C2 communications.
Detects a high volume of file creation events (greater than 200 files) on an external USB mount session by a non-system account, which may indicate potential data exfiltration or staging to removable media.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects a specific sequence of behavior associated with Gryxa data collection and exfiltration. A single process queries system state or logs (scheduled tasks, WMI, event logs), creates an archive file (.zip, .7z, .rar), and establishes an outbound public network connection shortly thereafter.
Detects an inbound QUIC/UDP port 443 burst targeting a Bun process (bun.exe or bun) from external IP addresses, followed by the process going completely silent on the network within a short time window. This pattern correlates with potential exploitation or denial-of-service conditions involving network parsing anomalies.
Detects the presence of vulnerable Wireshark software versions susceptible to CVE-2025-13945 and detects mitmproxy instances running without HTTP/3 disabled via the --set http3=false command line argument.
Detects processes accessing or enumerating multiple cryptocurrency wallet files or directories across common storage paths (e.g., Exodus, Electrum, Coinomi, Ethereum, Atomic, Guarda) within a short timeframe, which is often indicative of wallet theft or credential harvesting malware.
Detects potential data exfiltration activity where a device first exhibits usage of a remote monitoring and management (RMM) tool, followed by the execution of known data transfer or exfiltration utilities such as WinSCP or Rclone.
This rule performs a sweep across device file and network events for indicators of compromise (IOCs) associated with the UAT-11587/Antino campaign. It detects malicious file hashes, specific C2 domain connections, and known lure URLs (HTA/WSF) identified by Cisco Talos.
Sweeps file, process and image-load telemetry for known Kimsuky (APT-C-55) malware MD5 hashes. Exact hash matches carry very low false-positive risk.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects endpoint execution of specific known brute-force scripts and tools (such as ssh_brute.py, brute3.py, auto_login.py, etc.) using Python or shell interpreters, correlated with a high outbound network connection fan-out (50 or more distinct target IPs) from the same process.
Detects network connections, process executions, file creations, and image loads associated with the UNC7017 AOMEI supply chain campaign IOC sweep, including specific malicious URLs, domains, IPs, file paths, and hashes.
Detects inbound external connections on TCP port 541 (FGFM/FMG-Access protocol) correlated with the creation of .tm archives on the same device, or connections from known malicious IP addresses communicating over TCP 541.
Detects inbound external connections on TCP port 541 (FGFM/FMG-Access protocol) correlated with the creation of .tm archives on the same device, or connections from known malicious IP addresses communicating over TCP 541.
Detects inbound external connections on TCP port 541 (FGFM/FMG-Access protocol) correlated with the creation of .tm archives on the same device, or connections from known malicious IP addresses communicating over TCP 541.
Page 10 of 509