Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,046 detections
Filters
Last updated
All Time
Detection languages
23,955
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
40,154
7,369
6,547
3,915
3,692
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Correlates a successful Entra ID sign-in from an unmanaged device/IP with a persistence action (such as OAuth consent, app permission grant, or device registration) performed by the same user from a different IP within 1 hour. This behavior is indicative of post-AiTM or device-code session hijacking where stolen tokens are replayed from attacker infrastructure.
Detects potential device-code phishing attacks where a user successfully authenticates using the device code flow from one IP address, followed shortly by a successful sign-in from a different IP address using the same user account, indicating an attacker has redeemed the stolen device code token.
Detects suspicious curl commands spawned from shell processes on CI runners (such as GitHub Actions) that encode and POST environment variables using command substitution.
Details:
Identifies non-browser processes communicating with Mega/S4 storage services, 0x0.st, or the Telegram Bot API, which may indicate data staging, exfiltration, or automation activity.
Hypothesis:
An adversary may leverage command-line tools or custom scripts to communicate with cloud storage services, anonymous file-sharing platforms, or Telegram Bot APIs in order to stage, automate, or exfiltrate stolen data from a compromised host.
Identifies non-browser processes communicating with Mega/S4 storage services, 0x0.st, or the Telegram Bot API, which may indicate data staging, exfiltration, or automation activity.
Hypothesis:
An adversary may leverage command-line tools or custom scripts to communicate with cloud storage services, anonymous file-sharing platforms, or Telegram Bot APIs in order to stage, automate, or exfiltrate stolen data from a compromised host.
Detects network connections to webhook.site, execution of command-line tools referencing webhook.site or ArtexProbe, and creation or writing of files associated with ArtexProbe or known webshells.
Detects sign-in events and Microsoft Graph API activities originating from known Indicator of Compromise (IOC) IP addresses associated with Storm-0940 threat group activity.
Detects a burst of Kerberos service ticket requests (Event ID 4769) utilizing weak RC4 encryption (0x17) from a single account and IP address within a short time window. This behavior is indicative of Kerberoasting activity, where adversaries request TGS tickets for multiple service principal names (SPNs) to offline brute-force the service account passwords.
Detects HTTP requests made to specific fabricated decoy routes planted as comments in application code or documentation (SpikeStrip comments). Probing these non-existent routes indicates that an agent or adversary has ingested the planted comments and is actively scanning the web application.
Detects processes other than known browsers accessing Chromium-based credential stores, cookies, or chat/messaging app session data, correlated with Wi-Fi profile and cleartext key enumeration via netsh.exe.
Detects a web server worker process (PHP, Apache, Nginx) writing a script file into a web directory, followed by the same web process spawning a shell process with suspicious command line arguments within 1 hour.
Detects the presence and activity of autonomous AI agents, coding agents, and agent frameworks (such as OpenClaw, AutoGPT, CrewAI, Aider, Claude Code, etc.) across process execution, file creation/modification, and network connection telemetry to maintain inventory and visibility.
Detects inbound exploitation attempts and subsequent outbound payload fetching associated with Metro4Shell (CVE-2025-11953) indicators of compromise, including known malicious source IPs and payload hosting endpoints.
Detects the addition of Windows Defender exclusions using PowerShell (either in clear text or via encoded command launched from cmd.exe) referencing common temporary or working directories, potentially indicating an attempt to hide malicious files.
Detects a cmd.exe one-liner that downloads a VBS file with curl into TEMP, runs it with cscript, and deletes it, matching the CVE-2026-24423 CommandMount payload. The strict regex on the full chain keeps false positives low.
This threat hunting query identifies Microsoft Entra ID workload identity authentication activity originating from 199.19.77.84, an IP address publicly reported by Todyl during an investigation into unauthorized access leveraging compromised application credentials and service principals.
Detects Linux kernel log messages such as oops, panic, BUG, general protection fault, or use-after-free conditions whose call trace includes TCP handshake-path functions. This serves as a hunting heuristic for potential exploitation of kernel vulnerabilities like CVE-2026-98432.
Generic rule content from file: Potential C2 Activity via Outbound Network Connections - T1071.cql
Correlates external Microsoft Teams chat, impersonation, or security risk events targeting a user with the subsequent launch of the Quick Assist application on that user's device within a short timeframe, indicating potential social engineering or tech support scams.
Detects when Kubernetes Secrets are Modified or Deleted.
Detects DNS queries containing patterns associated with Kerberos coercion attacks via DNS object spoofing.
The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.
Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.
It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records
to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
The pattern "1UWhRCAAAAA..BAAAA" is a base64-encoded signature that corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure.
Attackers can use this technique to coerce authentication from victim systems to attacker-controlled hosts.
It is one of the strong indicators of a Kerberos coercion attack, where adversaries manipulate DNS records
to spoof Service Principal Names (SPNs) and redirect authentication requests like CVE-2025-33073.
Detects the use of reg.exe to disable the Event Tracing for Windows (ETW) Autologger session for Windows Defender API and Audit events.
By setting the 'Start' value to '0' for the 'DefenderApiLogger' or 'DefenderAuditLogger' session, an attacker can prevent these critical security events
from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique.
By setting the 'Start' value to '0' for the 'DefenderApiLogger' or 'DefenderAuditLogger' session, an attacker can prevent these critical security events
from being logged, effectively blinding monitoring tools that rely on this data. This is a powerful defense evasion technique.
Page 4 of 2907