Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
151
136
74
42
39
Contributors
103
95
90
56
41
Categories
88
80
76
66
65
Platforms
210
208
110
108
71
Products / Services
10,660
9,755
6,689
4,418
3,748
485
MITRE Techniques
102
93
89
64
54
CVEs
6
6
5
4
4
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Cloud extortion group exploiting exposed credentials and storage
Banking trojan and loader using malicious Office macro delivery
This rule detects multiple failed SSL login attempts from a single source IP to a destination IP within a 24-hour period. A threshold of 10 failed attempts is used to identify potential brute-force attacks or credential stuffing against SSL-enabled services.
This rule detects exploitation attempts targeting CVE-2026-0300 in Palo Alto Networks PAN-OS. It identifies suspicious network connections to User-ID Authentication Portal ports (6081, 6082) from external IP addresses, excluding RFC1918 and loopback ranges. Additionally, it looks for a specific anomalous User-Agent string associated with the CL-STA-1132 threat actor, which has been observed during exploitation of this vulnerability.
Detects HTTP GET requests to the /api/device/gate/ path, a specific behavior associated with EvilTokens phishing kits. Attackers use this gate check endpoint to identify and potentially burn active phishing sessions for security researchers or automated scanners.
Detects web traffic containing HTTP 301/302 redirects to known cloud hosting platforms (Azure, AWS, Cloudflare) that exhibit suspicious URL patterns or originate from identified malicious referrers associated with phishing or credential harvesting campaigns.
This rule detects exploitation attempts targeting CVE-2026-0300 in Palo Alto Networks PAN-OS. It identifies suspicious network connections to User-ID Authentication Portal ports (6081, 6082) from external IP addresses, excluding RFC1918 and loopback ranges. Additionally, it looks for a specific anomalous User-Agent string associated with the CL-STA-1132 threat actor, which has been observed during exploitation of this vulnerability.
Detects anomalous authentication patterns where a single source IP address exhibits multiple failed login attempts followed by at least one successful login within a 10-minute time window, indicative of credential stuffing or password spraying.
Detects successful authentication events from accounts identified as service, managed, or robot accounts (e.g., svc_, sa_, msol, robot) originating from external IP addresses or exhibiting an unusually high number of distinct source IP addresses. This behavior is indicative of potential credential theft, token replay attacks, or unauthorized usage of service account identities.
This rule monitors network logs for potential malicious activity by analyzing subdomain cardinality and identifying known phishing domains. It flags apex domains that exhibit high subdomain rotation (5 or more distinct subdomains within an hour), indicative of fast-flux DNS techniques, or that match a static list of known malicious/phishing infrastructure.
Detects potential exploitation of CVE-2026-0300 targeting PAN-OS and matches anomalous User-Agent string associated with CL-STA-1132 threat actor.
Detects an Antivirus alert in a highly relevant file path or with a relevant file name.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
PlugX C2Beacon
YARA
Modular remote access trojan associated with long-term espionage intrusions
This rule detects potentially malicious inbound HTTP POST requests directed at an API endpoint associated with public build directories. The detection logic monitors for suspicious user agents (e.g., Python requests), specific known malicious flow identifiers, known attacker IP addresses, and payload indicators such as OS command injection or execution patterns (e.g., __import__, os.system).
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Lumma C2Beacon
YARA
Infostealer-as-a-service targeting browser credentials and crypto wallets
Form-grabbing and credential stealing malware-as-a-service
Rust-based ransomware family targeting enterprise environments
Ransomware group exploiting edge devices and managed file transfer software
Detects successful authentication events from accounts identified as service, managed, or robot accounts (e.g., svc_, sa_, msol, robot) originating from external IP addresses or exhibiting an unusually high number of distinct source IP addresses. This behavior is indicative of potential credential theft, token replay attacks, or unauthorized usage of service account identities.
Page 14 of 24