Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
151
136
74
42
39
Contributors
103
95
90
56
41
Categories
88
80
76
66
65
Platforms
210
208
110
108
71
Products / Services
10,660
9,755
6,689
4,418
3,748
485
MITRE Techniques
102
93
89
64
54
CVEs
6
6
5
4
4
This rule detects unauthorized screen surveillance on Android devices by correlating the execution of the minicap binary with subsequent network activity indicative of screen data exfiltration to a command-and-control (C2) server. It specifically looks for connections to known exfiltration paths associated with screen monitoring or video uploads within 30 minutes of minicap process activity, effectively identifying surveillance that bypasses Android's MediaProjection consent mechanism.
This rule detects unauthorized screen surveillance on Android devices by correlating the execution of the minicap binary with subsequent network activity indicative of screen data exfiltration to a command-and-control (C2) server. It specifically looks for connections to known exfiltration paths associated with screen monitoring or video uploads within 30 minutes of minicap process activity, effectively identifying surveillance that bypasses Android's MediaProjection consent mechanism.
This rule captures all successful login events to serve as the foundational data source for downstream correlation engines. It is designed to identify suspicious patterns such as credential reuse across disparate IP addresses, anomalous device fingerprints following MFA, or account logins shortly after phishing visits. This filter acts as a raw event provider for more complex logic that cannot be evaluated within a single-event context.
This rule detects a multi-stage attack chain targeting a single user within a 2-hour window. It identifies the combination of email bombing (a distraction technique), an incoming external or anonymous Teams call (social engineering channel), and the installation of common remote access tools (e.g., AnyDesk, TeamViewer) on the same host.
This rule detects a multi-stage attack chain targeting a single user within a 2-hour window. It identifies the combination of email bombing (a distraction technique), an incoming external or anonymous Teams call (social engineering channel), and the installation of common remote access tools (e.g., AnyDesk, TeamViewer) on the same host.
This rule detects potential Adversary-in-the-Middle (AiTM) phishing activity by correlating network requests to known malicious lure domains with help-desk or vishing-themed events (such as password resets or unsolicited IT support) for the same user within a one-hour window. This behavior is indicative of a help-desk impersonation campaign where attackers direct users to credential harvesting sites.
Detects repeated, suspicious HTTP requests targeting sensitive management or administrative interfaces (e.g., /admin, /wp-admin, /cgi-bin) that utilize obfuscated, unusually encoded payloads. This activity is consistent with automated attempts to exploit recently disclosed vulnerabilities where traditional WAF/IDS signatures have been bypassed or failed to trigger high-confidence alerts.
Detects high-frequency authentication attempts originating from user agents associated with automation frameworks (Selenium, Playwright, Puppeteer, etc.). This pattern is often indicative of automated credential stuffing, brute force attacks, or CAPTCHA/2FA bypass attempts orchestrated by headless browsers.
Detects high-risk identity modifications (password or MFA resets) following an IT helpdesk ticket that lacks mandatory security controls, such as callback verification, manager approval, or established ticket history. This behavior is indicative of vishing and social engineering attacks aimed at helpdesk personnel to compromise user accounts.
Detects indicators associated with the exploitation of CVE-2025-3248 in Langflow. The rule identifies anomalous web requests targeting the /api/v1/validate/code endpoint, subsequent suspicious process creation (base64 encoded payloads in Python/shell), and network communication with identified command and control (C2) or data exfiltration IP addresses. It also includes alerts for observed contact with known extortion email addresses.
Detects high-frequency authentication attempts originating from user agents associated with automation frameworks (Selenium, Playwright, Puppeteer, etc.). This pattern is often indicative of automated credential stuffing, brute force attacks, or CAPTCHA/2FA bypass attempts orchestrated by headless browsers.
Detects high-risk identity modifications (password or MFA resets) following an IT helpdesk ticket that lacks mandatory security controls, such as callback verification, manager approval, or established ticket history. This behavior is indicative of vishing and social engineering attacks aimed at helpdesk personnel to compromise user accounts.
Detects successful administrative logins to VMware ESXi, vCenter, or related VDI infrastructure (Horizon) by users who have recently performed a password or MFA reset. This pattern is indicative of a helpdesk-based social engineering attack (vishing) or credential compromise where the attacker regains account access and immediately pivots to critical virtualization management infrastructure to facilitate ransomware deployment.
Detects successful administrative logins to VMware ESXi, vCenter, or related VDI infrastructure (Horizon) by users who have recently performed a password or MFA reset. This pattern is indicative of a helpdesk-based social engineering attack (vishing) or credential compromise where the attacker regains account access and immediately pivots to critical virtualization management infrastructure to facilitate ransomware deployment.
This rule monitors process creation, file system activity, and HTTP logs for indicators associated with the 'GHOST-VAULT' or 'GHOST-CRED' threat activity. It specifically triggers on files or paths containing 'GHOST-VAULT-', processes named 'ghost_' or containing 'ghost_' in the command line, and HTTP requests containing 'GHOST-CRED/3.0', 'GHOST-VAULT/', or 'GHOST/0day'.
Detects PNG image files containing an 'iTXt' metadata chunk and a specific byte marker (FF 89 AD 4A). This signature is characteristic of LausivLoader, which hides an encrypted payload within the image using steganographic techniques, intended for subsequent extraction via XOR decryption and DEFLATE decompression.
Detects incoming emails processed by Rspamd that exhibit suspicious authentication header signatures. The rule identifies emails lacking DKIM, ARC, or user agent information while simultaneously showing a zero receive count, potentially indicating spoofed, unauthenticated, or malformed phishing attempts.
This rule monitors network traffic and internal logs for connections to known malicious IP addresses or domain names associated with 'ClickFix' social engineering campaigns (often impersonating services like HBO Max). The logic explicitly filters out known threat intelligence scanners and security researcher probes. It performs correlation by requiring domain/message matches for generic IP-based alerts to reduce noise, and aggregates events per host over 15-minute windows to produce consolidated alerts.
Detects indicators associated with the exploitation of CVE-2025-3248 in Langflow. The rule identifies anomalous web requests targeting the /api/v1/validate/code endpoint, subsequent suspicious process creation (base64 encoded payloads in Python/shell), and network communication with identified command and control (C2) or data exfiltration IP addresses. It also includes alerts for observed contact with known extortion email addresses.
Detects indicators associated with the exploitation of CVE-2025-3248 in Langflow. The rule identifies anomalous web requests targeting the /api/v1/validate/code endpoint, subsequent suspicious process creation (base64 encoded payloads in Python/shell), and network communication with identified command and control (C2) or data exfiltration IP addresses. It also includes alerts for observed contact with known extortion email addresses.
Detects the mass termination of multiple security-related processes on a host within a short timeframe, correlated with the presence of specific driver modules potentially associated with security software interference or evasive behavior.
Page 5 of 24