Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
151
136
74
42
39
Contributors
103
95
90
56
41
Categories
88
80
76
66
65
Platforms
210
208
110
108
71
Products / Services
10,660
9,758
6,692
4,418
3,748
485
MITRE Techniques
102
93
89
64
54
CVEs
6
6
5
4
4
This rule monitors for high-risk modifications to Zscaler security policies such as disabling SSL inspection or DLP engines, or deleting/modifying firewall and URL filtering rules. It also flags administrative logins from locations previously unseen for that user, which may indicate account compromise or unauthorized access.
Detects anomalous access attempts to Netskope Private Access applications, specifically identifying connections from unmanaged devices, access occurring outside of typical business hours, or access from unusual/unexpected geographic locations.
Imperva Protected Site Removed from WAF
Cortex XDR
Detects an audit event in Imperva Cloud WAF indicating that a protected site configuration has been removed. This action results in the loss of application-protection coverage for the specific site and may indicate unauthorized defensive impairment.
Detects configuration events in BeyondTrust Password Safe where a user is removed from a group containing 'Administrators' in its name. This monitors for potential unauthorized removal of administrative privileges or interference with operational access.
This rule detects data synchronization activities between sanctioned enterprise applications and unsanctioned or personal cloud applications using Netskope logs. This pattern often indicates potential shadow IT usage or unauthorized data exfiltration from controlled environments to personal storage services.
This rule monitors for administrative role updates recorded by PUSH Security. It detects when an actor grants or modifies privileged roles for a target account, which is a common indicator of potential account manipulation, privilege escalation, or persistence establishment within a managed environment.
Imperva New Protected Site Created
Cortex XDR
Detects the creation of a new site object within the Imperva Cloud WAF environment, as captured by audit trail logs. This event serves as an administrative signal to track onboarding of new applications and monitor for unauthorized or unexpected configuration changes.
This rule detects potentially malicious AI prompt injection attempts targeting web-based AI assistants like Microsoft Copilot or Atlassian Rovo. It monitors CommonSecurityLog data for specific URL parameters (rovoChatPrompt, q, prompt) containing suspicious keywords (e.g., 'ignore', 'system', 'exfiltrate') or unusually long parameter values, which are indicators of efforts to bypass AI safety guardrails or perform data exfiltration via prompt manipulation.
This rule analyzes recent agent telemetry to identify and summarize the distribution of local agent vendors present in the environment over a 30-day lookback period. It extracts vendor information from agent metadata and provides a frequency count to assist in auditing deployed infrastructure agents.
Detects the SourTrade browser-side build-pipeline setup sequence: a ServiceWorker registered at /sw.js immediately followed, within the same page load, by a SharedWorker instantiated from an in-page Blob URL carrying an application/javascript MIME type — restricted to domains flagged as newly-registered or low-reputation — consistent with the pre-download preparation stage of browser-assembled malware.
Detects the creation of a PHP file with a specific malicious naming convention ('disable-batch-api-for-unauth.php') commonly associated with wp2shell post-exploitation activity in WordPress plugin or upload directories.
This rule monitors for processes, file names, or command lines that contain the string 'telepuz', which is indicative of a specific malware or malicious toolset. It alerts on any occurrence within process image names, process command lines, or file paths.
Detects instances where a 'node.exe' process spawns common reconnaissance utilities (tasklist.exe, wmic.exe, sc.exe) or attempts to access registry keys associated with security software (e.g., CrowdStrike, SentinelOne, Windows Defender). This behavior is indicative of a Node.js-based application potentially being leveraged as a platform for post-exploitation activities, such as environment discovery or tampering with security controls.
This rule detects the use of HTML tables to render QR codes without external image files. This technique, often referred to as 'imageless QR codes', involves creating a grid using HTML table cells (td) with CSS background colors (white and black) to form the QR pattern. Attackers use this method in phishing emails to embed QR codes that redirect victims to malicious websites, bypassing simple image-based security filters.
Detects static HTML/JS/CSS artifacts matching the DEBULL device-code phishing template via admin.css SHA256, Composer content-hash, and Turkish-language code markers
This rule detects the creation of sensitive files (e.g., AGENTS.md, MEMORY.md, IDENTITY.md) on a host where there is either no corresponding chat interaction or the corresponding chat interaction lacks specific warning or security-related flags. This is intended to surface potentially unauthorized local data staging or access of system-level metadata files.
This rule detects attempts to jailbreak Large Language Models (LLMs) by monitoring event logs and process command lines for indicators of 'Prompt Shields' activity. It specifically identifies when a jailbreak attempt is either detected or blocked by security controls.
This rule detects execution of commands or network traffic containing strings indicative of EDR bypass attempts, obfuscation frameworks, or C2 hosting/infrastructure. This usually signals active adversary efforts to evade defensive controls or setup command-and-control communication.
This rule monitors security logs for evidence of exploitation attempts targeting CVE-2025-2492 or malicious activity related to the 'AiCloud' platform. It scans incoming log messages for these specific indicators to identify potentially compromised network requests.
Detects unauthorized access to sensitive credential files, such as credentials.json or .env, through HTTP GET requests, or the creation/staging of a credentials file at /tmp/creds.json, which may indicate attempts to exfiltrate or steal credentials from the local system.
Detects indicators associated with CVE-2025-2492 or AiCloud activity in security logs.
Page 12 of 24