Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,084 detections
Filters
Last updated
All Time
Detection languages
418
193
163
156
81
Contributors
381
251
92
71
40
Categories
498
271
255
135
123
Platforms
443
441
267
121
114
Products / Services
10,665
9,758
6,692
4,418
3,749
1,084
MITRE Techniques
278
229
180
177
151
CVEs
17
15
13
13
8
IDS Classtypes
4
IDS Protocols
4
Identifies NetScaler ADC or Gateway software versions in the inventory that are known to be vulnerable to CVE-2026-88771 and CVE-2026-88772, despite having received the patch for CVE-2026-19490.
Detects successful authentication events to Snowflake cloud data warehouse platforms where no secondary authentication factor (MFA) was registered or triggered. This pattern is indicative of potential credential stuffing or reuse attacks, particularly those involving stolen credentials from infostealer malware, where MFA was not configured or successfully bypassed.
Detects web server requests for .aspx files where the User-Agent string identifies as Windows PowerShell and includes the zh-CN locale setting. This behavior is often characteristic of automated exploitation tools or web shells (like China Chopper) interacting with compromised web servers.
Detects unauthorized POST requests to SharePoint WebPart gallery pages that lack valid authentication cookies, which may indicate exploitation of CVE-2026-65660. The rule monitors for POST methods to specific SharePoint pages while excluding requests that already contain standard SharePoint authentication cookies (FedAuth, rtFa).
Identifies NetScaler ADC or Gateway software versions in the inventory that are known to be vulnerable to CVE-2026-88771 and CVE-2026-88772, despite having received the patch for CVE-2026-19490.
Identifies NetScaler ADC or Gateway software versions in the inventory that are known to be vulnerable to CVE-2026-88771 and CVE-2026-88772, despite having received the patch for CVE-2026-19490.
Detects anomalous, high-volume data retrieval from Salesforce via OAuth-authenticated Connected Apps using SOQL or Bulk API. This behavior is indicative of a compromised integration token being used by an adversary to exfiltrate sensitive CRM data, such as User, Account, Case, or Opportunity records, by bypassing standard user interface workflows.
Detects direct prompt-injection attempts submitted to an LLM or AI gateway. The rule monitors HTTP POST requests for common adversarial techniques such as attempting to override system instructions, reassign model roles, bypass safety guidelines, or initiate jailbreak modes (e.g., DAN). It includes stateful tracking to flag users who perform multiple such attempts within a 10-minute window, increasing the risk score for persistent malicious behavior.
This rule monitors package installation logs for indicators of packages potentially generated or suggested by AI tools (e.g., Copilot, code assistants) being installed in a target environment. It specifically looks for a low volume of installations (<=3) for packages that have been published within the last 14 days, which is a pattern often associated with the 'Publish Hallucinated Entities' technique in AI systems, where malicious or hallucinated code packages are introduced into the supply chain.
Detects incoming web server requests containing suspicious, URL-encoded SQL injection patterns indicative of automated probing or exploitation attempts, such as UNION SELECT, boolean-based injection fragments, and comment sequences.
Detects HTTP requests containing common web exploit patterns (SQLi, XSS, RCE) that exhibit characteristics of automated, mutating payload generation often utilized in AI-assisted fuzzing or vulnerability scanning tools. The rule monitors for encoded, obfuscated, or highly varied payload syntax within URI query strings.
Detects anomalous access to the SharePoint WebPartPages.asmx SOAP endpoint, specifically using the GetWebPartPageConnectionInfo method. This query identifies patterns consistent with the exploitation of CVE-2026-65660, where adversaries attempt to smuggle WebPart template markup (e.g., <%@ Register, XamlServices) after legitimate preview methods have been disabled.
Detects the creation of application-specific passwords named 'ZimbraWeb' in Zimbra environments. This pattern is associated with potential persistence mechanisms or credential access attempts where an adversary creates a dedicated service or app password to maintain access, as identified in CVE-2025-66376.
Identifies NetScaler ADC or Gateway software versions in the inventory that are known to be vulnerable to CVE-2026-88771 and CVE-2026-88772, despite having received the patch for CVE-2026-19490.
Detects unauthorized attempts to delete or purge critical Salesforce audit logs, including the Setup Audit Trail, Login History, and Event Monitoring log files. This behavior is indicative of anti-forensic activity, often utilized by threat actors such as ShinyHunters to destroy audit evidence following unauthorized access, data export, or credential manipulation.
Detects the suspicious combination of a file modification within Magento frontend or checkout JavaScript/template directories followed by an outbound network connection initiated by web server processes (e.g., Apache, Nginx, PHP). This pattern is consistent with the injection of a digital skimmer (e.g., Magecart style) and the subsequent exfiltration of stolen payment card data to an attacker-controlled endpoint.
Detects authentication to Snowflake instances where Multi-Factor Authentication (MFA) is absent and the account authenticates from multiple distinct source IP addresses within a 14-day window. This behavior is indicative of potential account takeover using compromised non-MFA credentials, a pattern consistent with activities attributed to threat actors like ShinyHunters/UNC5537.
Detects unauthorized abuse of the OAuth 2.0 device authorization grant flow in Salesforce environments, commonly used by threat actors like ShinyHunters (UNC6240) to gain programmatic access. Attackers register malicious connected apps to impersonate legitimate tools, then use social engineering (vishing) to trick victims into approving device codes. This rule flags token issuance from non-allowlisted connected apps using the device_code grant type.
Detects high-risk administrative activity on VMware ESXi or vCenter servers that is consistent with pre-ransomware staging, such as disabling lockdown mode, disabling syslog forwarding, mass deletion or modification of virtual machine files (.vmdk/.vmx), or shell command execution related to encryption tool staging.
This rule detects potentially malicious POST requests to SharePoint endpoints (such as AddGallery.aspx) that include indicators of WebPartMarkup or ToolPane payloads. This activity attempts to bypass the SPUtility.EnsureAuthentication() check that is typically enforced on the ToolPane.aspx page, potentially allowing unauthorized code execution or configuration manipulation.
Detects potential AI model extraction attacks where an adversary repeatedly queries a private model's inference API. By combining high-volume request counts with high input diversity, the rule identifies behavior indicative of an adversary constructing a labeled dataset to train a substitute, replicated model.
Page 4 of 52