Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,225 detections
Filters
Last updated
All Time
Detection languages
1,118
30
19
17
15
Contributors
391
236
131
85
62
Categories
313
252
228
185
166
Platforms
651
438
268
228
200
Products / Services
10,650
9,755
6,688
4,418
3,745
1,225
MITRE Techniques
264
259
234
217
208
CVEs
8
8
6
6
6
IDS Classtypes
2
2
1
1
1
IDS Protocols
2
1
This rule detects potentially malicious software supply chain attacks by identifying suspicious child processes spawned by package managers (pip, npm) or Python scripting engines within a short timeframe. It specifically looks for shells (cmd, powershell, bash, etc.) being invoked immediately after a package installation or script execution, and correlates this activity with suspicious outbound network connections originating from these processes.
Detects one external source repeatedly requesting PeopleSoft administrative endpoints across multiple destinations or URLs within fifteen minutes. This activity could indicate an attacker performing reconnaissance or vulnerability scanning against public-facing PeopleSoft applications.
Detects process executions containing sensitive keywords related to trust, certificates, and multi-factor authentication (e.g., 'mfa', '2fa', 'otp') that are not initiated by standard trusted system processes (services.exe, wininit.exe, smss.exe). This pattern is often indicative of credential manipulation, certificate harvesting, or tampering with authentication mechanisms.
Detects the creation, modification, or renaming of a JSP file within the 'PSEMHUB.war' directory. This activity can indicate the deployment of a web shell or other malicious code within the PeopleSoft PSEMHUB web application, often associated with server compromise.
Correlates a downloaded remote support installer with execution of the same file on the endpoint shortly afterwards. This rule identifies instances where a known remote access tool installer (e.g., AnyDesk, Bomgar, BeyondTrust) is downloaded and then executed on the same device within a 15-minute window, which could indicate an attacker establishing remote access.
Detects when collaboration applications (like Microsoft Teams or Zoom) or web browsers launch remote support utilities. This activity may indicate social engineering tactics during a screen sharing session, where an attacker convinces a user to install or run remote access software.
Detects the use of 'sshpass' to supply a password to SSH while simultaneously disabling strict host key checking. This combination is often indicative of automated lateral movement or credential stuffing attempts where an attacker is trying to bypass host key verification to connect to multiple systems without manual intervention.
Detects network share enumeration commands executed inside a remote desktop session, matching post-access discovery of mapped corporate storage. This rule specifically looks for commands like 'net use', 'net view', PowerShell cmdlets such as 'Get-SmbShare', 'Get-PSDrive', 'Get-SmbMapping', WMI queries for 'Win32_LogicalDisk', or UNC path references ('\\') executed via 'cmd.exe', 'powershell.exe', 'pwsh.exe', 'net.exe', or 'net1.exe' within a remote session.
This rule detects unusual outbound network connections from devices to well-known public DNS servers (Google DNS, Cloudflare DNS, Quad9, OpenDNS) on ports other than the standard DNS (53), HTTP (80), or HTTPS (443) ports. A high number of such connections (5 or more within an hour) could indicate command and control activity, data exfiltration, or the use of DNS tunneling.
Detects rclone remote configuration or config file creation when the binary is running from a portable user writable location, such as Downloads, Temp, AppData, Desktop, /tmp/, or /var/tmp/. This activity can indicate an attempt to exfiltrate data to cloud storage services.
Detects inbound messages whose subject closely matches the campaign's reported stolen client data extortion wording. The rule looks for specific keywords like 'lost', 'confidential', 'data', 'clients' (all present) and 'very important', 'important', 'client data' (any present) in the email subject, specifically for inbound emails that are either the first contact or have no threat types identified.
Detects installation of common remote management products from Downloads, Temp, AppData, Desktop, or Public user paths with silent installation options. This activity is often associated with adversaries establishing persistence or gaining remote access.
Detects rclone copy, sync, move, or copyto operations with options commonly used for unattended bulk transfer, indicating potential data exfiltration to cloud storage.
Detects the creation of archive files (ZIP, 7z, RAR, TAR, GZ) within common user staging directories such as Downloads, AppData Roaming, Desktop, or Temp folders. The detection specifically targets archives created by command-line shells (cmd, PowerShell), dedicated archiving utilities (7z, WinRAR, tar), or remote access tools (AnyDesk, Bomgar, ScreenConnect, Splashtop, Atera). This activity is indicative of data staging prior to exfiltration.
Detects the creation of a new deviceManagementScript or deviceShellScript object in Intune, indicating a PowerShell (Windows) or Shell (macOS/Linux) script has been uploaded to the Intune management platform. This is considered a high-fidelity indicator of script-based abuse as these scripts execute as SYSTEM on targeted endpoints and leave minimal forensic traces. The rule also identifies script creation initiated by service principals that might bypass human-UPN-based monitoring.
Detects the unique start and end markers (VAPTb3gin, VAPTfin) used by the VAPT autonomous framework to confirm exploit success across network or host logs. This rule searches across process and network events for these confirmation markers.
Detects outbound network connections to URLs containing strings associated with Qakbot (Qbot) malware infrastructure and common ports used by the malware for command-and-control communication.
This rule detects network connections from internal devices to identified APT Command and Control (C2) IP address ranges over common ports (8080, 443, 21, 22, 23, 25, 445). This traffic pattern is indicative of unauthorized external communication commonly associated with malware or adversary activity.
Detects outbound network traffic from endpoints to known malicious IP addresses associated with Loader-as-a-Service (LaaS) campaigns. The rule monitors DeviceNetworkEvents for connections to specific indicators of compromise (IOCs) and checks for URL patterns commonly associated with file staging and malware loading (e.g., /drop, /stage, /loader).
Detects the use of two or more distinct remote access products by the same user on the same device within a one-hour window. This could indicate suspicious activity, such as an attacker attempting to maintain persistence or using multiple tools for different stages of an attack, or a legitimate user having multiple remote access tools installed and running concurrently.
Detects the creation or modification of large Zstandard (.zst or .tar.zst) archive files (100MB or larger) within common temporary, data exfiltration, staging, or PeopleSoft-related directories. This activity can indicate an attacker archiving collected data for exfiltration or staging it for further actions.
Page 43 of 59