Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,022 detections
Filters
Last updated
All Time
Detection languages
23,931
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,580
11,924
5,908
5,189
4,871
Platforms
40,137
7,364
6,547
3,913
3,687
Products / Services
10,799
9,795
6,757
4,421
3,768
MITRE Techniques
18,173
15,727
12,654
8,468
6,288
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects DNS queries to public wildcard DNS services that dynamically resolve subdomains to IP addresses embedded in the subdomain.
Adversaries abuse these services to establish C2 channels or stage phishing infrastructure without registering a custom domain, potentially to evade detection and attribution.
Adversaries abuse these services to establish C2 channels or stage phishing infrastructure without registering a custom domain, potentially to evade detection and attribution.
Detects web server worker processes or PHP interpreters spawning suspicious child processes associated with reverse shells, network sockets, or reconnaissance commands.
Detects AnyDesk being silently installed with the --install and --silent flags or having an unattended-access password configured via the --set-password and _unattended_access parameters, typically piped via stdin from a batch dropper using cmd.exe.
Detects successful Entra ID sign-ins using the device code authentication flow by users who have no prior device code sign-in history within a 30-day baseline window. This behavior can indicate device code phishing or abuse of the device code grant mechanism.
Detects a sequence of process execution events where a device first downloads a public key (id_tunnel.pub) using curl or wget, subsequently downloads a private/tunnel key file (id_tunnel), and finally establishes an SSH tunnel or port forwarding session using ssh or a tun4000 script within a 4-hour window.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects correlation between an external Microsoft Teams chat creation and the subsequent launch of a remote access or monitoring (RMM) tool on the same user's device within a 30-minute window, which is indicative of potential social engineering or tech support scam initial access campaigns.
Detects reconnaissance commands (whoami, systeminfo) and PowerShell execution spawned as children of remote-access tools (such as AnyDesk, ScreenConnect, TeamViewer/QuickAssist variants, etc.), followed shortly by an outbound network connection to a .top domain from the same device.
Detects user accounts that have been disabled for an extended period (greater than 100 days), which could potentially be abused or overlooked.
Detects repeated PHP memory exhaustion (OOM) errors combined with segmentation faults or session warnings within a short timeframe, which may indicate application instability, resource exhaustion attacks, or exploitation attempts.
Detects Check Point SmartDefense logs for network detections associated with PHP2Shell, specifically CVE-2026-109618 and CVE-2026-109619
Detects potential DLL sideloading of "edputil.dll"
Detects uncommon network connections to the Active Directory Web Services (ADWS) from processes not typically associated with ADWS management.
Detects usage of the Quarks PwDump tool via commandline arguments
Detects PHP fatal out-of-memory errors reported in Unknown on line 0, indicating a memory exhaustion bailout before request initialization (pre-RINIT), associated with CVE-2026-109618 and CVE-2026-109619 exploitation attempts. Note - the logsource product php / service error is not defined by SigmaHQ. Map it with a processing pipeline to wherever PHP error lines land in your stack (PHP error_log file, nginx or Apache error log, PHP-FPM log, or syslog/journal). If log_errors is Off, or FPM runs with fastcgi.logging Off and catch_workers_output no, the line is never written.
Detects instances where the Claude Code AI assistant CLI or related node processes spawn command-line shells (such as cmd, powershell, bash, sh, zsh), followed by system firewall rule modifications on the same device within a 4-hour window.
Detects when typical discovery commands (whoami, id, uname, ipconfig) are executed under a web server or PHP process parent, potentially indicating post-exploitation activity following a web application compromise. The rule aggregates distinct commands within a 15-minute window to reduce false positives.
Detects remote thread creation (CreateRemoteThreadApiCall) where the source process is an Office application, browser, or script host, and the target process is a critical system binary such as rundll32.exe, svchost.exe, or explorer.exe.
Detects PHP error log entries indicating a session object decode failure, which may indicate exploitation attempts of CVE-2026-109618 and CVE-2026-109619. Note - the logsource product php / service error is not defined by SigmaHQ. Map it with a processing pipeline to wherever PHP error lines land in your stack (PHP error_log file, nginx or Apache error log, PHP-FPM log, or syslog/journal).
Detects process command lines containing C2 operator start flags or strings alongside reconnaissance tools or platforms like fofa or skynet.
Detects when a user authenticates via device code flow or performs device registration/ownership addition, followed by a bulk download of SharePoint or OneDrive files (25 or more distinct files) within a 60-minute window. This behavior can indicate session hijacking or unauthorized access where an attacker uses device code phishing to gain access and quickly exfiltrate cloud documents.
Page 25 of 2906