Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,537
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects the creation of a new administrator account in WordPress by monitoring for SQL INSERT operations targeting the wp_users and wp_usermeta tables that involve setting the wp_capabilities to administrator. This behavior is indicative of unauthorized account creation often associated with compromised or malicious WordPress plugin updates.
Detects successful API requests to sensitive administrative endpoints on WSO2 systems that lack a corresponding legitimate authentication event (session) from the same SourceIP and user pair, which may indicate the use of forged JWTs or authentication bypass exploitation (e.g., CVE-2026-5430).
Detects successful API requests to sensitive administrative endpoints on WSO2 systems that lack a corresponding legitimate authentication event (session) from the same SourceIP and user pair, which may indicate the use of forged JWTs or authentication bypass exploitation (e.g., CVE-2026-5430).
Detects anomalous access to WSO2 API Manager Store and Publisher endpoints involving the retrieval of sensitive information like consumer keys and secrets. The rule specifically targets requests authenticated with JWTs that exhibit headers indicative of 'alg=none' or other unsupported/forged algorithm patterns, often associated with CVE-2026-5430 exploitation attempts. The rule uses statistical baseline monitoring to identify volume spikes in requests to these sensitive paths.
Detects anomalous access to WSO2 API Manager Store and Publisher endpoints involving the retrieval of sensitive information like consumer keys and secrets. The rule specifically targets requests authenticated with JWTs that exhibit headers indicative of 'alg=none' or other unsupported/forged algorithm patterns, often associated with CVE-2026-5430 exploitation attempts. The rule uses statistical baseline monitoring to identify volume spikes in requests to these sensitive paths.
Detects anomalous access to WSO2 API Manager Store and Publisher endpoints involving the retrieval of sensitive information like consumer keys and secrets. The rule specifically targets requests authenticated with JWTs that exhibit headers indicative of 'alg=none' or other unsupported/forged algorithm patterns, often associated with CVE-2026-5430 exploitation attempts. The rule uses statistical baseline monitoring to identify volume spikes in requests to these sensitive paths.
Detects unauthorized creation of a WordPress administrator account through direct SQL injection or manual database modification by monitoring for insertions into the 'wp_users' table or modifications to the 'wp_usermeta' table with 'administrator' capabilities.
Detects an anomalous burst of git clone, fetch, or download events performed by a single GitHub user account against a large number of private repositories within a short timeframe (15-minute window). This pattern often indicates unauthorized bulk collection or exfiltration of sensitive source code by an actor using a valid account.
Detects an anomalous burst of git clone, fetch, or download events performed by a single GitHub user account against a large number of private repositories within a short timeframe (15-minute window). This pattern often indicates unauthorized bulk collection or exfiltration of sensitive source code by an actor using a valid account.
Detects an anomalous burst of git clone, fetch, or download events performed by a single GitHub user account against a large number of private repositories within a short timeframe (15-minute window). This pattern often indicates unauthorized bulk collection or exfiltration of sensitive source code by an actor using a valid account.
Detects instances where a user account experiences an 'Unusual sign-in' event followed by the registration of a new MFA or security information method within a one-hour window. This behavior is indicative of an attacker attempting to establish persistent access by registering their own authentication device to a compromised account.
Detects GitHub OAuth authorization, repository cloning, or ZIP downloads from source IP addresses that have not been observed for the specific actor within the past 30 days. This rule helps identify potential account compromise or token theft where an attacker attempts to access repository data from a new location, while specifically excluding bot/service accounts known for rotating CI infrastructure IPs.
Detects GitHub OAuth authorization, repository cloning, or ZIP downloads from source IP addresses that have not been observed for the specific actor within the past 30 days. This rule helps identify potential account compromise or token theft where an attacker attempts to access repository data from a new location, while specifically excluding bot/service accounts known for rotating CI infrastructure IPs.
Detects GitHub repository actions (git.clone, oauth_authorization.create, repo.download_zip) from actor IPs not seen for that user in the prior 30 days, requiring either 3+ actions or activity across 2+ distinct repositories from the new IP within the same day. Aggregating to burst/multi-repo behavior (rather than alerting on a single new-IP event) filters out one-off false positives from travel, VPNs, or dynamic IP reassignment while still surfacing sustained anomalous access patterns consistent with account compromise or bulk exfiltration.
Detects the creation of a new user account in Nacos, followed immediately by an authentication failure and then a successful authentication, which may indicate an attacker using automated tools to create and test a backdoored administrative account.
Detects high-volume, automated Pix transfer transactions within a short timeframe from a single source or session, which may indicate unauthorized use of a 'Pix' panel or automated financial fraud.
This rule detects unauthorized GitHub repository access or OAuth activity performed by a user account identified as terminated in the organization's HR system. It uses a watchlist to cross-reference GitHub audit logs against terminated employee records, applying a 2-hour grace period to account for potential log synchronization delays or final offboarding tasks.
This rule detects unauthorized GitHub repository access or OAuth activity performed by a user account identified as terminated in the organization's HR system. It uses a watchlist to cross-reference GitHub audit logs against terminated employee records, applying a 2-hour grace period to account for potential log synchronization delays or final offboarding tasks.
Detects a burst of new user account creation activity on a self-hosted git repository instance. This pattern is indicative of unauthorized mass account creation, potentially following an initial compromise or exploitation, which is often a precursor to further malicious activities like persistent access or unauthorized code access.
Detects a burst of new user account creation activity on a self-hosted git repository instance. This pattern is indicative of unauthorized mass account creation, potentially following an initial compromise or exploitation, which is often a precursor to further malicious activities like persistent access or unauthorized code access.
Detects a burst of new user account creation activity on a self-hosted git repository instance. This pattern is indicative of unauthorized mass account creation, potentially following an initial compromise or exploitation, which is often a precursor to further malicious activities like persistent access or unauthorized code access.
Page 59 of 142