Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,535 detections
Filters
Last updated
All Time
Detection languages
3,970
998
596
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,931
2,196
2,017
1,857
1,411
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
4,107
2,418
1,585
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule detects the usage of cleartext protocols for transmitting sensitive information, such as account usernames and authentication credentials, across networks. It specifically monitors Netflow data for connections to common ports associated with unencrypted services like HTTP, FTP, Telnet, and various database/application ports. The goal is to ensure that all sensitive data and administrative access utilize encrypted channels to prevent credential access and data interception.
Detects the creation of a new local user on a Fortinet FortiGate Firewall. The new local user could be used for VPN connections.
This rule detects the usage of default credentials on assets by correlating vulnerability scan results from Qualys. Specifically, it looks for a predefined list of Qualys vulnerability IDs (QIDs) that indicate the presence of default credentials. The rule aims to identify systems that have not had their default passwords changed, which is a critical security hygiene practice.
Detects the modification of a user group on a Fortinet FortiGate Firewall. This activity could be used by an attacker to grant themselves or other malicious accounts VPN access to a network, facilitating persistence or privilege escalation.
Detects the addition of firewall address objects on a Fortinet FortiGate Firewall. This activity could indicate an adversary attempting to modify network access controls to facilitate command and control, data exfiltration, or to bypass existing security policies.
One of the ongoing threats that I feel we face daily is the use of multiple plugins and add-ons across various sites from devices so I focus on identifying common platforms where users might connect and utilize different features. I started with WordPress plugins to gather information and monitor user activity, particularly to stay informed about any connections to specific WordPress sites that employ unknown plugins.
Additionally, if you have installed a WordPress site on any of your devices and it is integrated with Microsoft Defender for Endpoint, this query can be adapted to detect the plugins in use by the users connectives —both from within and externally. It can also help identify potential attacks and vulnerabilities, such as outdated plugin versions.
Additionally, if you have installed a WordPress site on any of your devices and it is integrated with Microsoft Defender for Endpoint, this query can be adapted to detect the plugins in use by the users connectives —both from within and externally. It can also help identify potential attacks and vulnerabilities, such as outdated plugin versions.
Detects the addition of a new VPN SSL Web Portal on a Fortinet FortiGate Firewall. This activity can be an indicator of an adversary establishing persistence or initial access, especially when observed in conjunction with other modifications to VPN SSL settings. Attackers might add new web portals to maintain access to the network or to create new entry points.
Detects the addition of a new firewall policy on a Fortinet FortiGate Firewall. This activity could indicate an adversary attempting to alter network access controls for defense evasion, persistence, or to facilitate further malicious activity.
Detects inbound emails with a Virtual Hard Disk (VHDX) file attachment. This technique has been used by APT-C-60 to deliver the SpyGlace backdoor, often disguised as a job application.
Detects potential ASP.NET ViewState deserialization attacks, which can occur when an attacker exploits a publicly known machine key. This is often indicated by a POST request to an ASP.NET page containing a large __VIEWSTATE parameter, followed by a 500 Internal Server Error.
Detects URLs that use the `https://user@host` syntax where the 'user' part is crafted to look like a legitimate domain (e.g., `https://example.com@malicious-site.net`). This is a technique used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539) to craft convincing phishing links.
Detects potential exploitation attempts of Citrix NetScaler vulnerability CVE-2025-5777 (CitrixBleed 2). This involves malformed or unusually large HTTP POST requests to the /p/u/doAuthentication.do endpoint, a technique used by groups like Earth Estries.
Detects URLs that use the `https://user@host` syntax where the 'user' part is crafted to look like a legitimate domain (e.g., `https://example.com@malicious-site.net`). This is a technique used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539) to craft convincing phishing links.
Detects multiple TTPs associated with the exploitation of SharePoint ToolShell vulnerabilities (e.g., CVE-2025-53770) by the threat actor Storm-2603. This includes the initial exploit attempt, webshell creation, defense evasion using a vulnerable driver, and C2 communication.
Detects the presence of SVG files containing obfuscated JavaScript and redirection logic. This technique is used by phishing campaigns, such as Tykit, to redirect victims to malicious sites.
Detects communication to known Command and Control (C2) servers associated with the Equation Group, as identified in the operational notes from the ShadowBrokers leak. This rule specifically looks for network connections to or from the hardcoded IP addresses linked to Equation Group C2 infrastructure.
Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing. The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts. It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
Detects DNS queries for domains associated with the Tykit phishing kit infrastructure. These domains are used for hosting phishing pages and for C2 exfiltration.
This rule detects the creation or modification of local user accounts and changes to remote authentication configurations on Cisco devices. It specifically looks for keywords 'username' and 'aaa' in Cisco AAA logs, indicating actions related to account management or authentication settings.
These domains are actively used in phishing campaigns impersonating legitimate software platforms like Homebrew, LogMeIn, and TradingView to distribute Odyssey Stealer and AMOS malware. Blocking these domains can prevent access to malicious download sites.
Detects network connections to the InterPlanetary File System (IPFS) where the URI contains a pattern indicative of an email address. This behavior is associated with recent phishing campaigns that leverage IPFS to host credential harvesting webpages, attempting to collect user credentials.
Page 285 of 312