Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,084 detections
Filters
Last updated
All Time
Detection languages
418
193
163
156
81
Contributors
381
251
92
71
40
Categories
498
271
255
135
123
Platforms
443
441
267
121
114
Products / Services
10,665
9,773
6,704
4,421
3,749
1,084
MITRE Techniques
278
229
180
177
151
CVEs
17
15
13
13
8
IDS Classtypes
4
IDS Protocols
4
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
This rule detects instances where a user enters a protected password into an application that has not been configured or registered for SSO (Single Sign-On). It achieves this by identifying 'Protected password entered' events and using a join-anti operation to filter out sessions where an 'SSO_PASSWORD_USED' event was previously recorded for the same user and domain.
Detects non-git processes such as VS Code, VS Code Server, or Node.js reading .git/HEAD or .git/refs files, which may indicate a malicious editor extension harvesting git repository metadata (branch names, commit refs) as observed in the Open VSX 'evil twin' extension campaign.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
This rule monitors for suspicious activity by detecting two distinct patterns: first, network connections initiated by Java processes located in tomcat/catalina directories on high-risk ports; second, suspicious administrative audit actions (Add admin, Modify credential, Export device list) within N-central where the initiating user context is missing.
Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.
Detects incoming web requests (via URI queries or form data) containing common OS command injection characters, shell metacharacters, or command execution patterns indicative of attempts to execute unauthorized commands on the underlying web server.
Detects unauthorized POST requests to the '/Windchill/login/' directory targeting .jsp files. This path is not used by legitimate PTC Windchill/FlexPLM traffic and is indicative of an adversary attempting to interact with a webshell or exploit a vulnerability such as CVE-2026-12569.
This rule monitors web server access logs for common attack patterns, including SQL injection, Cross-Site Scripting (XSS), Path Traversal/LFI, Remote File Inclusion (RFI), potential JNDI-based RCE (e.g., Log4Shell patterns), web shell activity, and sensitive endpoint discovery or enumeration (specifically targeting WordPress/CMS).
This rule monitors for suspicious activity by detecting two distinct patterns: first, network connections initiated by Java processes located in tomcat/catalina directories on high-risk ports; second, suspicious administrative audit actions (Add admin, Modify credential, Export device list) within N-central where the initiating user context is missing.
Suspicious Script and Utility Execution
Cortex XDR
This rule detects the execution of common command-line interpreters and utility tools frequently abused by attackers for reconnaissance, execution, and post-exploitation activities. Monitored binaries include script interpreters (python.exe, powershell.exe, pwsh.exe, bash.exe, sh.exe) and command-line utilities (cat, grep, find).
Detects registry-level signals of the SleeperGem RubyGems supply chain attack:
a long-dormant maintainer account publishing a new gem version, the trusted Dendreo gem receiving a new version that adds git_credential_manager as a dependency, and an unrelated maintainer (fastlane-plugin-run_tests_firebase_testlab) publishing a version referencing the same dependency within a short window - indicating coordinated, multi-account compromise rather than a single takeover.
a long-dormant maintainer account publishing a new gem version, the trusted Dendreo gem receiving a new version that adds git_credential_manager as a dependency, and an unrelated maintainer (fastlane-plugin-run_tests_firebase_testlab) publishing a version referencing the same dependency within a short window - indicating coordinated, multi-account compromise rather than a single takeover.
Detects registry-level signals of the SleeperGem RubyGems supply chain attack:
a long-dormant maintainer account publishing a new gem version, the trusted Dendreo gem receiving a new version that adds git_credential_manager as a dependency, and an unrelated maintainer (fastlane-plugin-run_tests_firebase_testlab) publishing a version referencing the same dependency within a short window - indicating coordinated, multi-account compromise rather than a single takeover.
a long-dormant maintainer account publishing a new gem version, the trusted Dendreo gem receiving a new version that adds git_credential_manager as a dependency, and an unrelated maintainer (fastlane-plugin-run_tests_firebase_testlab) publishing a version referencing the same dependency within a short window - indicating coordinated, multi-account compromise rather than a single takeover.
Detects the creation of overlay windows on top of sensitive financial or cryptocurrency applications and the granting of the SYSTEM_ALERT_WINDOW (draw-over-other-apps) permission to third-party applications. This behavior is highly characteristic of Android banking trojans attempting to capture credentials or PII via phishing overlays.
Detects high-frequency requests to WordPress REST API batch endpoints, which are commonly used in automated exploitation or scanning attempts against WordPress installations. An unusual volume of these requests from a single client IP within a short time window is a strong indicator of unauthorized probing or exploit activity.
Detects rapid outbound meeting-invite fan-out from a Telegram account to numerous contacts (RecipientCount >= 10), excluding accounts flagged as known legitimate bulk-messaging/bot accounts, consistent with BlueNoroff's GhostCall self-propagation pipeline where compromised trusted-contact accounts distribute fake meeting invites. This rule captures only the fan-out behavior; for full GhostCall self-propagation confirmation it should ideally be paired with a companion rule detecting Telegram session reuse on a new device/IP (same UserId, within approximately 15 minutes), since that temporal join between session hijack and invite fan-out cannot be expressed as a single Sigma query.
Detects the wp2shell unauthenticated SQL injection chain (CVE-2026-63030 / CVE-2026-60137) abusing the REST API batch-route confusion via author_exclude/author__not_in parameters against wp-json/wp/v2/posts or wp-json/batch/v1, where the extraction result reflects the WordPress 6.9 $wp$2y$ bcrypt-over-HMAC-SHA384 hash marker in the request query or response body. Requires both the specific unauthenticated REST SQLi vector AND the hash-format marker to fire, excluding legitimate authenticated admin export/reporting tools that reference wp_users through normal means.
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
Detects the wp2shell unauthenticated SQL injection chain (CVE-2026-63030 / CVE-2026-60137) abusing the REST API batch-route confusion via author_exclude/author__not_in parameters against wp-json/wp/v2/posts or wp-json/batch/v1, where the extraction result reflects the WordPress 6.9 $wp$2y$ bcrypt-over-HMAC-SHA384 hash marker in the request query or response body. Requires both the specific unauthenticated REST SQLi vector AND the hash-format marker to fire, excluding legitimate authenticated admin export/reporting tools that reference wp_users through normal means.
Detects web server request patterns associated with a 'Kali365' phishing campaign that utilizes device code authorization flows. The rule identifies suspicious JSON design payloads that simulate various enterprise brands (e.g., Microsoft 365, DocuSign, Adobe) in combination with a 'device_code' flow identifier, indicative of a credential or token-harvesting attack.
Detects a Telegram account session being authorized from a new device/IP, which BlueNoroff has been observed abusing as the precursor step in the GhostCall self-propagation pipeline: operators reuse stolen/hijacked Telegram session cookies from a new device or IP, then use the hijacked session to send fake meeting invites to trusted contacts, enabling cyclical propagation to subsequent victims.
This rule only detects the session authorization event in isolation. Analysts should correlate matches on this rule with a companion rule that detects rapid meeting-invite fan-out for the same UserId occurring within roughly 15 minutes, since that cross-event correlation cannot be expressed within a single Sigma detection. A standalone match here does not confirm active self-propagation and requires that follow-up correlation to raise confidence.
This rule only detects the session authorization event in isolation. Analysts should correlate matches on this rule with a companion rule that detects rapid meeting-invite fan-out for the same UserId occurring within roughly 15 minutes, since that cross-event correlation cannot be expressed within a single Sigma detection. A standalone match here does not confirm active self-propagation and requires that follow-up correlation to raise confidence.
Page 34 of 52