Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,314
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects anomalous process execution and loopback network activity associated with the Model Context Protocol (MCP) 'exec_in_session' method. This pattern indicates an adversary potentially abusing the AI coding assistant's MCP server capabilities to execute arbitrary commands as a C2 channel.
Detects DNS lookups, TLS connections, and network traffic associated with the PoeLLM cryptominer communicating with Kryptex mining pools, as well as Stratum mining protocol login attempts.
The following analytic identifies a LOLBAS process being executed where it's process name does not match it's original file name attribute.
Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.
The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code.
Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.
The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code.
This rule detects when an SAP user generates audit records exceeding a configured hourly threshold (200 for high severity or 4000 for medium severity events) on their system. This behavior may indicate automated scanning, mass data extraction, or anomalous user activity within SAP environments.
Detects when a privileged SAP user's credentials are reset by an administrator and subsequently used to log in from the same IP address that the administrator previously used.
Detects users authenticating to SAP via Dialog Logons from IP addresses that are outside of approved network ranges and RFC1918 internal networks, potentially indicating unauthorized or external access.
A file was downloaded from an SAP system by a host matching a threat intelligence indicator
Detects dynamic ABAP programming events (Insert, Generate, Delete) in SAP environments, excluding pre-defined authorized transactions.
Detects when a privileged SAP account modifies the master record of a different user within a specified timeframe.
Detects successful or failed logon activity by a privileged SAP account on a production system using SAP Security Audit logs.
An ABAP program invoked a remote function call (RFC) using a destination resolved at runtime, which may indicate lateral movement or unauthorized internal communication within an SAP environment.
Detects multiple distinct SAP users authenticating successfully from a single source IP address within a short time window (30 minutes), potentially indicating compromised credentials or shared access anomalies.
Detects legitimate applications writing any type of file to uncommon or suspicious locations that are not typical for application data storage or execution.
Adversaries may leverage legitimate applications (Living off the Land Binaries - LOLBins) to drop or download malicious files to uncommon locations on the system to evade detection by security solutions.
Adversaries may leverage legitimate applications (Living off the Land Binaries - LOLBins) to drop or download malicious files to uncommon locations on the system to evade detection by security solutions.
Sweeps network connection, HTTP/proxy, file, and process telemetry for exact matches against known Cling botnet indicators: dedicated STUN C2/operator IPs, Cling MIPS loader staging URLs, and known Cling sample SHA256 hashes. Tightened to exclude broad domain-level matching on stun.l.google.com (legitimate, ubiquitous Google STUN infrastructure that Cling spoofs/abuses rather than owns) and to match payload-staging hosts only by full URL rather than bare IP, reducing false positives from shared/compromised hosting and unrelated legitimate STUN traffic.
Detects potentially highly relevant antivirus events in the application log based on known virus signature names and malware keywords.
Detects usage of powershell cmdlets to disable or remove ETW trace sessions
This rule detects successful network connections to known malicious IP addresses or the domain 'forgitlab.com', which are associated with the Azazel malware threat infrastructure.
Detects registry modifications related to Google Chrome and Microsoft Edge extension force-install policies (ExtensionInstallForcelist or ExtensionSettings) by processes other than svchost.exe. Attackers may abuse this to install malicious browser extensions for persistence or credential harvesting.
Detects creation of files or folders under the hard-coded staging
directory C:\Users\Public\Temp\ChromeAuto_. Astaroth's spambot
copies the victim's browser "User Data" profile directory to this path so it can
spawn a fresh browser instance carrying the victim's active WhatsApp Web session
cookies and stored browser credentials, bypassing authentication entirely.
directory C:\Users\Public\Temp\ChromeAuto_. Astaroth's spambot
copies the victim's browser "User Data" profile directory to this path so it can
spawn a fresh browser instance carrying the victim's active WhatsApp Web session
cookies and stored browser credentials, bypassing authentication entirely.
This rule detects network communication, DNS queries, email interactions, and URL clicks associated with known TA419 threat actor infrastructure. It monitors multiple telemetry sources to identify indicators of compromise (IOCs) such as specific domains, IP addresses, and email addresses.
IOC sweep for ARTEX campaign indicators: C2 host, nine proxy IPs, xcai.pro and its subdomains, and the CLAUDE.md URL across Defender, CEF/firewall, DNS and Entra sign-in telemetry. Domains match on exact host or subdomain only, connection types are limited to real connection events, and sign-ins are limited to successes and credential failures.
Page 45 of 1907