Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,138 detections
Filters
Last updated
All Time
Detection languages
3,224
1,086
498
476
469
Contributors
1,824
1,607
872
505
300
Categories
2,976
2,470
1,061
1,024
908
Platforms
39,790
7,138
6,515
3,861
3,597
Products / Services
1,325
1,067
970
655
490
MITRE Techniques
2,227
1,319
1,319
874
873
CVEs
66
65
33
32
28
IDS Classtypes
81
79
56
27
10
IDS Protocols
149
98
6
5
4
Detects DNS queries to domains that are suspiciously similar to trusted ones, which may indicate typosquatting, phishing, or user deception tactics. The detection compares unknown domains to a known safe allowlist using a fuzzy character-difference heuristic.
This detection identifies potential usage of the Naabu port scanner by searching for its process execution or its specific network user-agent string. Naabu is a fast port scanner that can be used for network reconnaissance.
This detection identifies suspicious authentication failure patterns that may indicate brute-force attacks. It detects four common scenarios:
- Repeated failed login attempts to a single account from a single IP address.
- Distributed login attempts to a single account from multiple IPs.
- A single IP address targeting multiple accounts.
- Broad-scale attempts involving multiple accounts and multiple IPs in a short timeframe.
This rule focuses on failed login attempts only and is intended for early brute-force detection and threat hunting.
Note:
Consider tuning the TimeWindow (default: 10 minutes) and Threshold (default: 5 attempts) values to reflect your organization’s normal login activity. A more permissive or stricter threshold may be necessary depending on your environment (e.g., high-traffic services, mobile users, VPNs).
Includes both a readable union-based version and a compact case()-based variant for performance-conscious deployments.
- Repeated failed login attempts to a single account from a single IP address.
- Distributed login attempts to a single account from multiple IPs.
- A single IP address targeting multiple accounts.
- Broad-scale attempts involving multiple accounts and multiple IPs in a short timeframe.
This rule focuses on failed login attempts only and is intended for early brute-force detection and threat hunting.
Note:
Consider tuning the TimeWindow (default: 10 minutes) and Threshold (default: 5 attempts) values to reflect your organization’s normal login activity. A more permissive or stricter threshold may be necessary depending on your environment (e.g., high-traffic services, mobile users, VPNs).
Includes both a readable union-based version and a compact case()-based variant for performance-conscious deployments.
Detects files based on common ransomware file extensions or ransom note filenames. This rule is based on a community-sourced list and is intended for broad detection.
This rule detects attempts by scripting language interpreters (Node.js, Python, PowerShell) to access sensitive browser credential files such as 'Login Data', 'Web Data', and 'Cookies' from Chrome and Brave browser user data directories. It also includes specific file paths that might be associated with known browser extensions or malware that target these files. This activity is indicative of credential dumping or information stealing.
This rule detects when an email with a detected threat (e.g., malware, phishing) has an attachment that is subsequently observed on an endpoint device. This indicates that a malicious attachment from an email was downloaded and executed or saved on a device.
The analytic detects the execution of the 'gdrive' tool on a Linux host. This tool allows standard users to perform tasks associated with Google Drive via the command line, such as downloading, uploading, listing, updating, syncing, sharing, and managing accounts or files. Adversaries can use this tool to stage other tools or exfiltrate data. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. If confirmed malicious, this activity could lead to system compromise or sensitive data theft.
This rule detects suspicious activity where scripting interpreters (node.exe, python.exe, pwsh.exe, powershell.exe) are observed accessing a large number of potentially sensitive files (e.g., .env, secret, wallet, keypair, credential, recovery files, or common document/data file types like .pdf, .docx, .csv, .json, .txt) and subsequently exfiltrating a significant amount of data over the network. It correlates file access events with network outbound traffic from the same process within a 10-minute window, flagging instances where more than 20 distinct sensitive files are accessed and over 500KB of data is sent out.
This rule detects the installation of specific malicious open-source packages using npm or pip. It looks for process executions of 'npm.exe', 'pip.exe', 'pip3.exe', 'npm', or 'pip3' with 'install' in their command line, specifically targeting known malicious package names like 'winston-compose', 'nodemailer-helper', 'servula', 'velocky', 'vite-postcss-helper', 'pycryptoconf', and 'pycryptoenv'. This activity is indicative of supply chain compromise attempts, potentially by groups like Lazarus Group, who have been known to leverage such tactics.
The following analytic detects the creation of suspicious service files within the systemd directories on Linux platforms. It leverages logs containing file name, file path, and process GUID data from endpoints. This activity is significant for a SOC as it may indicate an adversary attempting to establish persistence on a compromised host. If confirmed malicious, this could lead to system compromise or data exfiltration, allowing attackers to maintain control over the system and execute further malicious activities.
This rule identifies devices that have software installed which has reached its End-Of-Support (EOS) status. This is crucial for identifying potential security vulnerabilities due to unpatched software and for maintaining compliance with organizational security policies. The rule summarizes the count of such software instances per device, along with the software name and its End-Of-Support date.
https://www.nextron-systems.com/2025/08/01/plague-a-newly-discovered-pam-based-backdoor-for-linux/
Detects suspicious use of curl or wget on Linux systems to download content from external domains. The detection extracts target domains from the command line arguments and filters out known legitimate destinations (e.g., GitHub, Linux package mirrors).
Optionally, it enriches results with data from the ThreatIntelligenceIndicator table to highlight known malicious domains associated with malware, C2, or APT activity. This can be used to prioritize alerts or support automated scoring.
The detection is based on syslog and is designed to reduce noise while preserving high-value findings.
Optionally, it enriches results with data from the ThreatIntelligenceIndicator table to highlight known malicious domains associated with malware, C2, or APT activity. This can be used to prioritize alerts or support automated scoring.
The detection is based on syslog and is designed to reduce noise while preserving high-value findings.
Detects potential Unicode-based homograph attacks by scanning for non-ASCII characters in both DeviceNetworkEvents.RemoteUrl and EmailUrlInfo.Url. These attacks leverage visually deceptive domain names—using characters from non-Latin scripts (e.g., Cyrillic "а" instead of Latin "a")—to mimic legitimate sites and deceive users.
The detection covers both network activity and email delivery paths, helping uncover phishing attempts, credential harvesting links, or other malicious redirects.
Recommendation: If available, include telemetry from DNS logs (e.g., DnsEvents) and firewall/proxy logs to improve detection coverage and correlate threats across multiple layers of the kill chain.
The detection covers both network activity and email delivery paths, helping uncover phishing attempts, credential harvesting links, or other malicious redirects.
Recommendation: If available, include telemetry from DNS logs (e.g., DnsEvents) and firewall/proxy logs to improve detection coverage and correlate threats across multiple layers of the kill chain.
Detects potential_APT-style process hollowing on Linux using syscall stubs and string camouflage
A USB device with Vendor ID 0E90 is associated with vendor WiebeTech (a.k.a "CRU"), which is known to manufacture "mouse jigglers." These hardware devices can be used to prevent a computer from automatically locking the screen or going to sleep. Illegitimate use can range from policy violation to nefarious activity like remote desktop abuse.
Ngrok is a legitimate tool that creates secure tunnels to localhost servers through NAT/firewalls, often used by developers.
Additionally, Ngrok tunnels have been used by Iranian APT groups, among others, to support their operations particularly for Command and Control (C2), data exfiltration, and initial access staging.
Additionally, Ngrok tunnels have been used by Iranian APT groups, among others, to support their operations particularly for Command and Control (C2), data exfiltration, and initial access staging.
This rule looks for the usage of the torsocks process which can be used by threat actors to proxy connections through the Tor network to exfiltrate data or download further payloads. The usage of this process should always be considered suspicious.
The following EQL query can be used to hunt for XMRIG executions within your environment.
Detects the installation of specific malicious npm packages associated with the North Korean "Contagious Interview" campaign. These packages are known to deliver the XORIndex malware loader.
This rule detects the execution of common command-line utilities (wget, curl, nc, bash, python, perl, php, sh) within web server directories. This activity is highly suspicious as it could indicate an attacker attempting to download malicious files, execute web shells, or perform other post-exploitation activities on a compromised web server.
Page 312 of 340