Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,084 detections
Filters
Last updated
All Time
Detection languages
418
193
163
156
81
Contributors
381
251
92
71
40
Categories
498
271
255
135
123
Platforms
443
441
267
121
114
Products / Services
10,665
9,758
6,692
4,418
3,749
1,084
MITRE Techniques
278
229
180
177
151
CVEs
17
15
13
13
8
IDS Classtypes
4
IDS Protocols
4
Detects a user successfully logging in from multiple different countries within a short time frame (4 hours). This is a strong indicator of account takeover (T1078).
Detects potential fraud: New payment card added, followed by deposit and large withdrawal (>500) within 24 hours
Detects a behavioral sequence where an AI agent runtime (e.g., Node.js, Python) spawns a shell to execute a web request utility like curl or wget. This pattern is a strong indicator of automated data exfiltration, often resulting from a successful prompt injection attack that instructs the agent to steal and send data to an attacker-controlled server.
Detects network connections to known infrastructure associated with the EncystPHP web shell campaign. This IP (45.234.176.202) was observed distributing the 'c' and 'k.php' droppers.
Detects HTTP POST requests to the Appsmith password reset endpoint where the 'Origin' header does not match the expected internal or legitimate application domain. This is indicative of an attempt to exploit CVE-2026-22794 to achieve account takeover.
Detects AI/ML model configuration files (e.g., config.json, model_config.yaml) containing a suspicious '_target_' value, which could indicate an attempt to exploit a Hydra instantiation vulnerability for remote code execution (RCE).
Detects the presence of specific Chrome, Edge, or Firefox browser extension IDs associated with the DarkSpectre Zoom Stealer malware. This rule aims to identify compromised systems exhibiting the installation artifacts of the malicious browser extensions.
Detects potential exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882, which allows for unauthenticated remote code execution. This rule looks for specific web request URIs, post-exploitation process activity, and known indicators of compromise (IOCs).
Detects potential exploitation attempts against Next.js applications vulnerable to CVE-2025-66478 (React2shell). The rule looks for POST requests to Next.js Server Action endpoints with an unusually large request body, which may indicate a malicious payload designed to trigger a deserialization RCE.
Detects installed Next.js versions < 16.0.7 vulnerable to CVE-2025-55182 (React Flight RCE)
Detects the creation of files associated with NPM packages compromised in the "Sha1-Hulud: The Second Coming" campaign. This is a broad query intended for hunting and requires manual verification of package versions.
Detects potential command injection attempts against Citrix NetScaler ADC and Gateway devices. This detection is based on the patterns described in a hypothetical proof-of-concept for CVE-2025-7775, which involves injecting shell commands and referencing sensitive system paths in HTTP requests.
One of the ongoing threats that I feel we face daily is the use of multiple plugins and add-ons across various sites from devices so I focus on identifying common platforms where users might connect and utilize different features. I started with WordPress plugins to gather information and monitor user activity, particularly to stay informed about any connections to specific WordPress sites that employ unknown plugins.
Additionally, if you have installed a WordPress site on any of your devices and it is integrated with Microsoft Defender for Endpoint, this query can be adapted to detect the plugins in use by the users connectives —both from within and externally. It can also help identify potential attacks and vulnerabilities, such as outdated plugin versions.
Additionally, if you have installed a WordPress site on any of your devices and it is integrated with Microsoft Defender for Endpoint, this query can be adapted to detect the plugins in use by the users connectives —both from within and externally. It can also help identify potential attacks and vulnerabilities, such as outdated plugin versions.
This rule detects potential exploitation attempts targeting the Windows Server Update Services (WSUS) Remote Code Execution vulnerability, identified as CVE-2025-59287. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the affected WSUS server.
The following analytic detects the use of default or publicly known named pipes associated with Cobalt Strike. It leverages Sysmon EventID 17 and 18 to identify specific named pipes commonly used by Cobalt Strike's Artifact Kit and Malleable C2 Profiles. This activity is significant because Cobalt Strike is a popular tool for adversaries to conduct post-exploitation tasks, and identifying its named pipes can reveal potential malicious activity. If confirmed malicious, this could indicate an active Cobalt Strike beacon, leading to unauthorized access, data exfiltration, or further lateral movement within the network.
This analytic detects suspicious data transfer activities involving the use of the `split` syscall with the `-b` option, which specifies the size of each output file. This technique can be used by attackers to evade detection by breaking large files into smaller parts, bypassing size-based security controls, and facilitating covert exfiltration of sensitive data. By monitoring for unusual or unauthorized use of the `split` syscall with a specified block size, this analytic helps identify potential data exfiltration attempts.
Detects the use of qoperation.exe with specific command-line arguments to write a JSP file to the webroot, indicating a webshell drop. This activity is associated with a post-authentication step related to CVE-2025-57790, which involves a path traversal vulnerability in Commvault.
This correlation rule identifies multiple risk events associated with the "Living Off The Land" analytic story. It aggregates and correlates events tagged under this story, focusing on systems with a high count of distinct sources (5 or more). The rule aims to detect suspicious behavior involving the use of legitimate tools for malicious purposes, which could lead to code execution, privilege escalation, or persistence within an environment.
This analytic identifies the bulk creation of ransomware notes (e.g., .txt, .html, .hta files) on an infected machine. It leverages Sysmon EventCode 11 to detect multiple instances of these file types being created within a short time frame (10 seconds). A detection is triggered if 15 or more unique readme paths are observed. This activity is a strong indicator of an active ransomware attack, where the attacker is notifying the victim of the encryption. If confirmed malicious, this behavior could lead to widespread data encryption, rendering critical files inaccessible and potentially causing significant operational disruption.
The following analytic detects suspicious attempts to find credentials stored in password stores, indicating a potential attacker's effort to access sensitive login information. Password stores are critical repositories that contain valuable credentials, and unauthorized access to them can lead to significant security breaches. By monitoring for unusual or unauthorized activities related to password store access, this analytic helps identify potential credential theft attempts, allowing security teams to respond promptly and prevent unauthorized access to critical systems and data.
The analytic detects potential exploitation of the CrushFTP authentication bypass vulnerability (CVE-2025-31161). This detection identifies suspicious command execution patterns associated with exploitation of this vulnerability, such as executing mesch.exe with specific arguments like b64exec or fullinstall. This activity is indicative of an attacker exploiting CVE-2025-31161 to gain unauthorized access to the CrushFTP server and perform post-exploitation activities.
Page 46 of 52