Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
151
136
74
42
39
Contributors
103
95
90
56
41
Categories
88
80
76
66
65
Platforms
210
208
110
108
71
Products / Services
10,660
9,755
6,689
4,418
3,748
485
MITRE Techniques
102
93
89
64
54
CVEs
6
6
5
4
4
Ransomware group exploiting edge devices and managed file transfer software
Rust-based ransomware family targeting enterprise environments
This rule monitors for DNS queries, network connections, and HTTP proxy requests originating from node/npm processes or targeting known infrastructure associated with the Trum3it campaign. It covers common malicious domains and specific Vercel subdomains identified as command-and-control (C2) endpoints.
Detects high-frequency port scanning activity from external, non-private IP addresses targeting common network services. The rule identifies different scanning profiles, including wide port sweeps and targeted multi-port scans, which are consistent with reconnaissance behaviors observed in botnet activity like the KV/JDY clusters.
This rule detects email spoofing attempts where the sender's display name is set to 'Monitoring', but the sender's email address does not contain 'monitoring', specifically targeting activity associated with the 'gasparinutrition.com' domain. This behavior is indicative of an impersonation attempt, commonly used in phishing campaigns to establish trust.
Detects unauthorized or anomalous modifications to local vector database files by non-standard processes.
This rule detects suspicious process creation events where a process is spawned from common user-writable directories (AppData\Roaming, AppData\Local\Temp, Desktop) and subsequently allocates memory with characteristics often associated with code injection or execution (VirtualAlloc, NtAllocateVirtualMemory, PAGE_EXECUTE_READWRITE, 0x40). It filters out known legitimate Windows processes that might exhibit similar behavior.
Detects anomalous authentication patterns where a single source IP address exhibits multiple failed login attempts followed by at least one successful login within a 10-minute time window, indicative of credential stuffing or password spraying.
This rule detects Content Security Policy (CSP) violations related to 'netdna-ssl.com' or 'wpengine.netdna-ssl.com' domains. Specifically, it looks for violations where the blocked URI contains 'netdna-ssl.com' or the violated directive is 'script-src', 'font-src', or 'connect-src'. This could indicate attempts to inject malicious content or bypass CSP protections.
Detects anomalous network connections to HTTP/S ports (80, 443, 8080) by suspicious processes (e.g., Python, Netcat, Socat) or those executing known tunneling/web shell scripts (Neo-reGeorg, Chisel). This rule identifies potential egress-blocked environment bypass attempts by monitoring for high-frequency outbound connections that deviate from standard browser or signed-application behavior.
Detects the execution of commands used to parse /etc/hosts for PeopleSoft-related node names (WEB, APP, csprd) for lateral movement targeting. Threat actors (e.g., ShinyHunters) use this to discover internal application and web servers.
This rule detects potential network reconnaissance activity by looking for keywords such as 'scan', 'sweep', 'probe', 'recon', 'nmap', and 'nessus' within the 'Message' field of CommonSecurityLog entries. This could indicate an adversary actively gathering information about the network infrastructure.
This rule detects exploitation attempts targeting CVE-2026-0300 in Palo Alto Networks PAN-OS. It identifies suspicious network connections to User-ID Authentication Portal ports (6081, 6082) from external IP addresses, excluding RFC1918 and loopback ranges. Additionally, it looks for a specific anomalous User-Agent string associated with the CL-STA-1132 threat actor, which has been observed during exploitation of this vulnerability.
Detects DNS queries or network connections to known PhantomRaven Wave 5 command-and-control infrastructure (domains and IP addresses). This rule identifies communication with specific malicious domains and IP addresses associated with the PhantomRaven campaign, indicating potential compromise or attempted communication with adversary infrastructure.
This rule detects potential network reconnaissance activity by looking for keywords such as 'scan', 'sweep', 'probe', 'recon', 'nmap', and 'nessus' within the 'Message' field of CommonSecurityLog entries. This could indicate an adversary actively gathering information about the network infrastructure.
This rule alerts when Cato's inline Anti Malware engine identifies a file in transit as malicious. It fires on both blocked and allowed malware to catch cases where the engine detects but fails to block, indicating a potential compromise or a misconfiguration requiring immediate investigation.
Detects when a Microsoft Cloud App Security reported a risky sign-in attempt due to a login associated with an impossible travel.
Detects when a Microsoft Cloud App Security reported when a user signs into your sanctioned apps from a risky IP address.
Detects install-time execution context consistent with the Axios npm supply chain compromise. This rule looks for 'node setup.js' launched from within 'node_modules/plain-crypto-js' or related npm install working directories, or for npm install commands involving 'axios' or 'plain-crypto-js'.
This rule detects a potential software supply chain compromise by correlating `npm install`, `npm ci`, or `npm update` activity with the subsequent execution of a `node setup.js` script on the same device within a 30-minute window. It specifically looks for `setup.js` execution or processes running from the `/node_modules/plain-crypto-js` directory, which is indicative of the Axios npm supply chain compromise.
Detects potential NetScaler administrative session hijacking by monitoring for the usage of SESSID or NITRO_SK administrative cookies from multiple source IPs. Attackers leverage CVE-2026-3055 to steal these specific session cookies to gain unauthorized administrative access.
Page 16 of 24