Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,046 detections
Filters
Last updated
All Time
Detection languages
23,955
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
40,154
7,369
6,547
3,915
3,692
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects outbound web or proxy connections to known consumer-grade cloud storage and file-sharing services. This activity is often indicative of data exfiltration, where an adversary uploads staged or archived sensitive data to third-party file hosting services (e.g., Mega, Dropbox, transfer.sh, pastebin) to bypass traditional enterprise exfiltration controls.
This rule detects potentially unauthorized or suspicious repository interactions by monitoring 'git' commands executed by common AI-assisted coding tools or command-line developer utilities. It flags occurrences where a checkout operation occurs without accompanying standard git history or status checks, which may indicate automated exfiltration or lateral movement attempt within a developer environment.
Detects execution of PowerShell or Command Prompt where the command line contains obfuscated indicators or specific suspicious files and IP addresses, while simultaneously bypassing the execution policy. This is characteristic of malicious script execution or payload delivery attempts.
Detects a single developer identity performing a high volume of git push or clone operations across a large number of distinct repositories within a short timeframe. This behavior is indicative of a compromised developer account being used to programmatically inject code into multiple repositories, potentially for a supply chain attack or mass payload propagation.
Detects an identity that performs a 'ListSecrets' operation followed by a high volume of 'GetSecretValue' or 'BatchGetSecretValue' requests within a short timeframe (15 minutes). This behavioral pattern is indicative of automated bulk exfiltration of secrets from AWS Secrets Manager, a common activity following an initial cloud environment compromise.
Detects evidence of a SharePoint pre-authentication RCE exploit chain where an adversary injects a malicious Namespace containing an ExpandedWrapper-wrapped XamlServices payload (e.g., ObjectDataProvider or LosFormatter gadget) into the w3wp.exe worker process. This specifically looks for command-line arguments indicative of deserialization-based exploit attempts targeting SharePoint web server components.
Detects potential exploitation of CVE-2025-3248 in Langflow by identifying suspicious inbound network traffic targeting the /api/v1/validate/code endpoint, correlated with subsequent python child processes containing base64 decoding and execution primitives such as eval, exec, or subprocess.
Detects the execution, network connections, and service installation of MeshAgent or associated binaries (e.g., mvtcs.exe). The rule identifies potential unauthorized or malicious use of this remote management software by looking for process activity, specific network connections to known infrastructure, and service persistence mechanisms.
This rule detects the creation of Git branches or tags using names that match the 40-character or 64-character hexadecimal format of Git commit hashes. This technique, identified in the context of Plugin4Shell, is used to spoof pinned-commit references, potentially misleading automated systems or developers into using malicious code versions.
Detects a git checkout to a specific SHA followed by a git rev-parse HEAD verification command within AI coding assistant plugin directories (e.g., claude, codex, copilot, gemini). This pattern is monitored to identify potential supply chain compromises where a working tree might be silently substituted during plugin installation or updates.
Detects a multi-stage phishing attack targeting cryptocurrency users, specifically Ledger wallet holders. The detection identifies an initial request to a Vercel-hosted domain for a BIP-39 wordlist (a common recovery phrase standard) followed by a POST request to a similar Vercel-hosted endpoint, suggesting the exfiltration of a secret recovery phrase.
Detects a multi-stage phishing attack targeting cryptocurrency users, specifically Ledger wallet holders. The detection identifies an initial request to a Vercel-hosted domain for a BIP-39 wordlist (a common recovery phrase standard) followed by a POST request to a similar Vercel-hosted endpoint, suggesting the exfiltration of a secret recovery phrase.
This rule detects potential Pass-the-Hash lateral movement by identifying NTLM network logons (Event ID 4624, LogonType 3) on a host that lack a preceding interactive (LogonType 2, 10) or Kerberos-authenticated logon, coupled with subsequent access to sensitive administrative shares (Event ID 5140) by the same user account.
This rule detects HTTP POST requests to Vercel-hosted domains containing suspected phishing telemetry (such as device fingerprinting, keystrokes, and user agent collection) originated from a Google Sites frame. This is a common pattern for phishing kits masquerading as legitimate Ledger service pages to harvest credentials and hardware information.
This rule detects HTTP POST requests to Vercel-hosted domains containing suspected phishing telemetry (such as device fingerprinting, keystrokes, and user agent collection) originated from a Google Sites frame. This is a common pattern for phishing kits masquerading as legitimate Ledger service pages to harvest credentials and hardware information.
This rule detects HTTP POST requests to Vercel-hosted domains containing suspected phishing telemetry (such as device fingerprinting, keystrokes, and user agent collection) originated from a Google Sites frame. This is a common pattern for phishing kits masquerading as legitimate Ledger service pages to harvest credentials and hardware information.
Detects attempts to bypass or tamper with the Antimalware Scan Interface (AMSI). This rule monitors for command-line arguments indicative of reflection-based patching of AmsiUtils and forced AmsiScanBuffer failures, as well as registry modifications to AMSI providers.
This rule detects HTTP traffic where a response from a Google Cloud Storage bucket (storage.googleapis.com) initiates a redirect via meta-refresh or JavaScript to a Vercel-hosted domain. This pattern is indicative of phishing infrastructure, where attackers leverage legitimate, trusted storage platforms to redirect users to malicious landing pages.
This rule detects HTTP traffic where a response from a Google Cloud Storage bucket (storage.googleapis.com) initiates a redirect via meta-refresh or JavaScript to a Vercel-hosted domain. This pattern is indicative of phishing infrastructure, where attackers leverage legitimate, trusted storage platforms to redirect users to malicious landing pages.
This rule detects HTTP traffic where a response from a Google Cloud Storage bucket (storage.googleapis.com) initiates a redirect via meta-refresh or JavaScript to a Vercel-hosted domain. This pattern is indicative of phishing infrastructure, where attackers leverage legitimate, trusted storage platforms to redirect users to malicious landing pages.
This rule detects HTTP traffic where a response from a Google Cloud Storage bucket (storage.googleapis.com) initiates a redirect via meta-refresh or JavaScript to a Vercel-hosted domain. This pattern is indicative of phishing infrastructure, where attackers leverage legitimate, trusted storage platforms to redirect users to malicious landing pages.
Page 459 of 2907