Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,217 detections
Filters
Last updated
All Time
Detection languages
714
206
154
38
26
Contributors
191
190
181
159
113
Categories
420
398
389
334
167
Platforms
838
349
199
85
56
Products / Services
10,680
9,761
6,694
4,418
3,744
1,217
MITRE Techniques
424
365
352
279
258
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
Detects attempts to overwrite web server content files for defacement
Detects the creation of hidden configuration files (e.g., .sv_config.json) in hidden directories, indicating the installation or configuration phase of the SPECTRALVIPER backdoor. The rule specifically looks for files created in a directory matching the pattern `/.config/spectralviper/` or files named `.sv_config.json`.
This rule detects suspicious network connections originating from specific processes (DbgView64.exe or VirtualBox.exe) to Microsoft Teams TURN relay servers, where the RemoteUrl does not start with "teams.microsoft.com". This indicates potential protocol tunneling or an attempt to exfiltrate data or establish command and control through an unexpected channel, possibly leveraging Microsoft Teams infrastructure in an unauthorized manner. The use of DbgView64.exe or VirtualBox.exe as initiating processes for such connections is highly unusual and indicative of malicious activity.
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
Detects network connections to known or suspected Command and Control (C2) IP addresses and ports associated with ransomware activity. This rule specifically looks for outbound connections from devices to a predefined list of suspicious remote IP addresses on common C2 ports (443, 8443, 6379, 27017).
Detects web shell files written to web server directories
Detects web shell files written to web server directories
This rule detects an unusually high number of downloads of files identified as 'octet-stream' or 'executable' from a single IP address within a one-hour window, based on W3CIISLog data. This behavior could indicate various malicious activities, including the distribution of malware, data exfiltration, or the use of a compromised web server for command and control.
Detects the host-level command execution artifact left behind by the published ITScape (CVE-2026-46316) exploit proof-of-concept. The PoC specifically executes a payload containing '/bin/touch /ITScape' after achieving host kernel privilege from a KVM/arm64 guest. This rule looks for processes executing this specific command string.
This rule tracks the process tree where the execution of 'setup.cjs' leads directly to the creation of a '.pkg_history' file. This behavior is indicative of the Mastra NPM supply chain compromise, where malicious packages use 'setup.cjs' to drop marker files for persistence or further stages of the attack.
Detects DNS lookups to Pastebin used for dead drop C2 configuration retrieval
Detects when non-Node.js scripts, specifically Python or Bash/Shell, modify or create a 'package.json' file. This activity can indicate an attempt to silently inject malicious dependencies into clean repositories, a technique observed with malware like Miasma.
Detects modifications to user profile scripts (.profile, .bash_profile) that inject 'gh-token-monitor' or 'spectralviper' to establish persistence upon user login.
This rule detects multiple attempts (10 or more within an hour) from a single IP address to access administrative interfaces on a web server. It specifically looks for URI queries containing keywords like 'admin', 'wp-admin', or 'administrator' in W3CIISLog data. Such activity often indicates a brute-force attack or scanning for administrative login pages.
This rule correlates successful VPN authentication events with the subsequent execution of tools commonly associated with ransomware staging activities within a 6-hour window. It aims to detect initial access via VPN followed by preparatory actions for ransomware deployment. The rule specifically looks for VPN logins from 'Check Point' devices and process executions of 'rclone.exe', '7z.exe', 'powershell.exe', 'wevtutil.exe', 'vssadmin.exe', or 'nltest.exe'.
This rule identifies potential data exfiltration or unusual data transfer activity by detecting a high volume of large data transfers (over 1MB per transfer) from or to an IIS web server. It aggregates these transfers hourly by client IP and alerts if 10 or more such transfers occur within that hour from a single IP.
This rule detects potential SQL Injection attempts by monitoring IIS web server logs (W3CIISLog) for URI queries containing common SQL keywords such as 'union', 'select', or 'drop'. It aggregates these attempts by client IP address over one-hour intervals and flags any IP address with 5 or more such attempts within that hour.
Detects an unusually high volume (100 or more within an hour) of API calls (POST, DELETE, PUT methods to URIs containing 'api') originating from a single IP address. This activity could indicate various malicious behaviors such as brute-force attacks, credential stuffing, web application attacks, or a denial-of-service attempt against the API endpoint.
Detects the China Chopper web shell spawning CMD from IIS (w3wp.exe) with suspicious command line patterns.
This rule detects potential reconnaissance activity by identifying IP addresses that generate a high volume of HTTP requests with user agents indicating bots, crawlers, or scanners. It counts requests per IP address within one-hour bins and flags those with 50 or more such requests.
This rule detects potential Cross-Site Scripting (XSS) attempts by identifying multiple URI queries containing common XSS payloads such as '<script>', 'javascript:', or 'onerror=' within a one-hour window from the same client IP address. A count of 3 or more attempts triggers the alert.
Page 31 of 58