Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule detects potential indicators of compromise related to CVE-2026-20127 in Cisco Catalyst SD-WAN systems. It focuses on two main areas: 1) suspicious successful SSH authentications for the 'vmanage-admin' account, and 2) SD-WAN control plane connection events indicating a new 'up' state. The first part looks for specific log entries related to publickey authentication for 'vmanage-admin' from any source IP. The second part identifies control connection state changes to 'up' and extracts peer type, peer system IP, and public IP from the raw logs. The rule aims to surface events that require human confirmation by comparing them against known network designs and change records, as these events can indicate unexpected relationships between devices or unauthorized privileged access.
UNC5142 CLEARSHORT - injected Web3 + BSC contract addresses in HTTP response
Detects successful administrative logins ('vmanage-admin') to a Cisco SD-WAN device from an IP address not on the authorized list. This could indicate exploitation of CVE-2026-20127, an authentication bypass vulnerability.
This rule set detects various activities associated with the Dohdoor malware campaign (UAT-10027). It includes detection for known malware hashes, suspicious network communication patterns such as DNS over HTTPS (DoH) to Cloudflare with specific user agents, staging URL patterns, and odd-cased infrastructure domains. Additionally, it identifies endpoint activities like curl downloading batch/command files and DLL sideloading attempts using specific DLL names and LOLBins executed from common public writeable directories. The intent is to provide strong leads for investigation into potential Dohdoor infections.
Identifies network connections to known command and control (C2) and dropper distribution infrastructure associated with the EncystPHP web shell campaign.
Monitors for command-line activity indicating the addition of SSH keys to authorized_keys files or the modification of the SSH daemon configuration to permit root login on Cisco SD-WAN devices. This is a common persistence technique used by attackers after gaining initial access, such as through CVE-2026-20127.
Triofox CVE-2025-12480
Suricata
Triofox CVE-2025-12480 - localhost Host header to admin setup pages
Detects the deletion or clearing of critical Cisco SD-WAN log files. This is a common post-exploitation technique used by attackers to cover their tracks after compromising a device, for instance, after exploiting CVE-2026-20127. The rule identifies direct file deletions and commands used to clear or truncate log file content.
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google Residential Proxy Network Disruption. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: a DNS lookup to a specific domain mentioned in the report. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat-intelligence/disrupting-largest- residential-proxy-network) to document where the indicator came from and to support incident notes and reporting.
DPRK EtherHiding (UNC5342) - DNS lookup for blockchain explorer APIs (multi-provider)
This rule detects activity associated with a specific threat actor targeting FortiGate devices. It identifies network connections to known threat actor infrastructure IPs, attempts to access FortiGate management ports (443, 8443, 10443, 4443) over TCP, and successful administrative or VPN authentications from the threat actor's IPs in Fortinet/FortiGate logs. Additionally, it looks for DCSync-style directory replication access (event ID 4662) in Windows Security logs, indicating potential Active Directory compromise.
This rule detects activity related to the EmEditor watering hole attack, specifically looking for PowerShell execution making requests to known malicious lookalike domains and network connections to the associated infrastructure. A match suggests a potential download of malicious code during what appeared to be a legitimate install or update. Investigation should focus on identifying the host, user, source of activity, and legitimacy of the install source, followed by evidence preservation, credential reset, and a search for follow-up malicious activity.
This rule set detects various stages of activity related to the 'OpenClaw' malware family and associated campaigns. It includes detection for OpenClaw process execution, exposure of a specific administrative port, execution of shell commands via curl (ClawHavoc delivery), outbound webhook exfiltration, and infostealer access to OpenClaw configuration files.
This rule detects suspicious network connections to known threat actor infrastructure associated with FortiGate exploitation, successful administrative or VPN logins to FortiGate devices from these IPs, and DCSync-style directory replication access (EventCode 4662) on Windows systems. The rule is composed of three distinct parts targeting different aspects of the attack chain.
Detects potential JSON Web Token (JWT) authentication bypass attempts where the algorithm in the token header is explicitly set to "none". A vulnerable server might skip signature validation for such tokens, allowing an attacker to forge arbitrary claims and potentially gain unauthorized access or escalate privileges.
Detects HTTP requests to the 'compcheckresult.cgi' script containing the unique parameter 'vXm8DtMJG'. This pattern is a strong indicator of the RESURGE webshell, which is injected into the CGI script on compromised Ivanti Connect Secure devices to allow for remote command execution.
This rule detects various stages of the CastleLoader malware activity, including C2 communication, process hollowing using AutoIt and jsc.exe, and known malware hashes. It correlates network traffic to a specific C2 server, identifies suspicious process creation patterns where AutoIt launches jsc.exe, and sweeps for known SHA256 hashes associated with CastleLoader.
This rule detects indicators associated with the RenEngine campaign, which involves the deployment of HijackLoader, Lumma Stealer, and ACR Stealer. Detection is based on specific MD5 hashes of known malicious files, filenames used in the campaign, and command and control (C2) domains identified as part of the infrastructure.
Detects processes that access Google Sheets API endpoints and parameters described in GRIDTIDE reporting,
where the initiating process is not a common web browser. This may indicate abuse of Sheets as a C2 channel.
where the initiating process is not a common web browser. This may indicate abuse of Sheets as a C2 channel.
This rule detects activity associated with the DYNOWIPER malware, identified by specific SHA256 hashes on endpoint telemetry or by network connections to known command and control (C2) IP addresses. The rule is split into two parts: one for endpoint detection based on file hashes and another for network/authentication logs based on IP addresses.
Detects network and endpoint activity associated with the XWorm LATAM campaign, including C2 communication, payload downloads, CasPol.exe making outbound connections, WMI-spawned PowerShell with Cloudinary fetches and Assembly.Load, and a specific file hash.
Page 260 of 312