Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
247 detections
Filters
Last updated
All Time
Detection languages
114
83
40
6
2
Contributors
100
26
26
17
12
Categories
71
47
33
29
24
Platforms
93
89
54
28
8
Products / Services
10,661
9,758
6,692
4,418
3,749
247
MITRE Techniques
80
67
56
52
50
CVEs
4
4
3
2
2
Detects DNS responses linking the adtimizer.co domain (specifically tekma.adtimizer.co) to the known Discover-Tech ALB infrastructure associated with Controlium/Intelos ADINT operations.
Detects DNS responses linking the adtimizer.co domain (specifically tekma.adtimizer.co) to the known Discover-Tech ALB infrastructure associated with Controlium/Intelos ADINT operations.
Detects the creation or modification of system users and groups on NetScaler ADC/Gateway appliances by monitoring Syslog events (e.g., nsconmsg, audit logs). The rule specifically triggers when these actions occur outside of standard business hours or on weekends, indicating potential unauthorized account manipulation or unauthorized persistence mechanisms.
Detects high-frequency restarts, HA failovers, or process crashes (e.g., nsppe, nsaaad) on Citrix NetScaler appliances. This behavior is indicative of potential denial-of-service exploitation, such as the CVE-2026-88772 DTLS memory-overflow vulnerability.
Detects network or system activity associated with the 'p2pwn' backdoor account on Dahua cameras, which is introduced by exploiting the CVE-2024-39943 vulnerability. The rule monitors for the presence of 'p2pwn' and 'p2password' strings across logs, including RPC/login events.
Detects evidence of an argument-injection attack against MikroTik RouterOS (CVE-2026-86060), where the attacker provides the literal username '-2' during the login process. This action allows the attacker to bypass standard credential validation by exploiting a forged privilege mask. This is typically observed in conjunction with unauthorized access attempts following CVE-2026-67279.
This rule monitors network device audit logs for suspicious activities that indicate potential persistence or defense evasion on edge/VPN/router appliances. It specifically flags configuration changes, creation of new administrative accounts, addition of unauthorized SSH keys, and the disabling of logging/syslog export, which are common tactics for maintainig unauthorized access on network infrastructure.
Detects instances where a successful login occurs on an ESXi/vCenter hypervisor, followed by the creation or power-on of a virtual machine on that same host within a two-hour window. This behavior is indicative of an attacker establishing access to a hypervisor environment to spin up rogue, unmonitored virtual machines to evade detection tools and facilitate further malicious activity.
Detects the presence of an unauthorized administrative account (e.g., 'ops') on MikroTik RouterOS devices following a system 'Flagged' indicator. This rule correlates administrative account creation or modification events with system-reported compromise indicators to identify post-exploitation persistence mechanisms related to known RouterOS vulnerabilities.
The following analytic identifies instances where CrushFTP has blocked access due to exceeding the maximum number of simultaneous connections from a single IP address. This activity may indicate brute force attempts, credential stuffing, or automated attacks against the CrushFTP server. This detection is particularly relevant following the discovery of CVE-2025-31161, an authentication bypass vulnerability in CrushFTP versions 10.0.0 through 10.8.3 and 11.0.0 through 11.3.0.
This rule monitors for suspicious credential-related activity targeting ONVIF interfaces on network devices (such as IP cameras). It detects a pattern where a successful 'global.login' RPC authentication is quickly followed (within 300 seconds) by commands or RPC methods related to credential dumping or user enumeration (e.g., OnvifUser, GetUsers). This sequence is indicative of an adversary using legitimate access to gain unauthorized information from a device.
Detects the creation of a new administrator account in WordPress by monitoring for SQL INSERT operations targeting the wp_users and wp_usermeta tables that involve setting the wp_capabilities to administrator. This behavior is indicative of unauthorized account creation often associated with compromised or malicious WordPress plugin updates.
Detects login or authentication attempts to a Cisco Firewall Management Center (FMC) management interface from non-authorized source IP addresses. The rule specifically flags connections targeting potential low-privilege or service accounts that may indicate unauthorized access attempts or brute-force behavior directed at critical network infrastructure.
Detects login or authentication attempts to a Cisco Firewall Management Center (FMC) management interface from non-authorized source IP addresses. The rule specifically flags connections targeting potential low-privilege or service accounts that may indicate unauthorized access attempts or brute-force behavior directed at critical network infrastructure.
This rule detects unauthorized access or modifications to hardware watchdog device files (/dev/watchdog, /dev/watchdog0, /dev/misc/watchdog, /dev/FTWDT101_watchdog) on Linux systems. Adversaries may manipulate these files to disable the hardware watchdog's automatic reboot functionality, potentially to maintain persistence or to ensure system stability while performing malicious actions without the risk of an unexpected forced reboot.
This rule detects potential Domain Generation Algorithm (DGA) activity by analyzing network connection logs. It identifies suspicious domains based on their structure (length, character set) and then filters them using a trigram analysis. Domains with non-repeating trigrams and rare trigrams (not found in a baseline of Alexa Top 1M domains) are flagged as DGA candidates. The rule then joins these candidates back to the original network logs to identify actual connections to these suspicious domains.
This rule detects potential Domain Generation Algorithm (DGA) activity by analyzing network connection logs. It identifies suspicious domains based on their structure (length, character set) and then filters them using a trigram analysis. Domains with non-repeating trigrams and rare trigrams (not found in a baseline of Alexa Top 1M domains) are flagged as DGA candidates. The rule then joins these candidates back to the original network logs to identify actual connections to these suspicious domains.
This rule detects the exploitation of CVE-2026-48558 in SimpleHelp, where an OIDC authentication bypass allows unauthenticated attackers to forge identity tokens. The lack of cryptographic signature verification permits the registration of unauthorized, privileged Technician accounts, effectively bypassing MFA. The detection logic monitors for specific log patterns indicating OIDC response processing followed by technician account registration and configuration changes.
This rule detects network connections or DNS queries to a specific Internet Computer Protocol (ICP) domain and canister ID (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io or tdtqy-oyaaa-aaaae-af2dq-cai). This pattern is associated with command and control (C2) activity, where compromised systems communicate with an adversary-controlled server.
Detects network traffic associated with the EvilTokens phishing kit's 'killed' gate check mechanism. The kit GETs /api/device/gate/<PAGE_ID> with the ngrok-skip-browser-warning header. When the backend returns a killed flag, the phishing page wipes the DOM and renders a fake 'Page Not Found - Microsoft' error to evade analysis or block specific victims.
Detects the execution of MeshCentral agent commands, specifically the 'RunCommand' feature, which is often used by adversaries for post-compromise remote command execution and payload staging. This rule monitors both endpoint process activity and system logs for command-line arguments involving meshctrl.js and RunCommand.
Page 3 of 12