Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,044 detections
Filters
Last updated
All Time
Detection languages
23,953
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,589
11,933
5,910
5,193
4,872
Platforms
40,153
7,368
6,547
3,915
3,691
Products / Services
10,809
9,795
6,757
4,421
3,770
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects the SmarterMail service process spawning cmd.exe /c or bash/sh -c, consistent with command injection via the unauthenticated connect-to-hub API (CVE-2026-24423). Parent match is limited to MailService or SmarterMail install paths to reduce noise.
Detects the addition of Windows Defender exclusions using PowerShell (either in clear text or via encoded command launched from cmd.exe) referencing common temporary or working directories, potentially indicating an attempt to hide malicious files.
Detects potential exploitation of CVE-2025-11953 (Metro4Shell) where a Node.js development server spawns a command shell executing an encoded PowerShell command. The PowerShell script performs defense evasion via Windows Defender exclusions (Add-MpPreference), downloads a payload over raw TCP sockets (System.Net.Sockets.TcpClient), and executes it using Start-Process.
Detects behavioral artifacts associated with Impacket remote execution tools (such as wmiexec, smbexec, and atexec) on target hosts using Microsoft Defender XDR process telemetry. It identifies command-line signatures spawned by system processes like WmiPrvSE.exe, services.exe, and svchost.exe.
This analytic detects multipart POST traffic with a serialized PHP structure in an uploaded filename, which may indicate an attempt to exploit PHP session upload-progress handling and can be associated with PHP2Shell activity.
Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.
Suricata EVE's standard HTTP events do not expose multipart form field names, so this Suricata variant cannot confirm the PHP_SESSION_UPLOAD_PROGRESS field without additional request-body inspection.
Detects potential pass-the-hash (PtH) attacks via command-line execution of offensive tooling (such as Impacket, CrackMapExec, NetExec, Evil-WinRM) specifying NT hashes, as well as remote NTLM network logons from non-standard workstation names characteristic of Linux-based attacker tools spreading across multiple endpoints.
Detects potential ESC8 NTLM relay attacks against Active Directory Certificate Services (AD CS) Web Enrollment, where a domain controller machine account authenticates over NTLM from a non-DC IP address followed by a certificate request or retrieval via IIS.
Details:
Baseline detection to identify rare usage of Salesforce bulk API operations initiated by a user/service account not previously seen performing similar actions within the last 7 days. This includes the specific attack chain where a victim is socially engineered into granting consent to a malicious OAuth application which is subsequently used to perform bulk API operations.
Hypothesis:
An adversary associated with Shinyhunters may use a compromised Salesforce identity to perform first-time bulk API activity in order to enumerate and collect large volumes of CRM records for data theft and extortion.
Actions:
Review detection details to identify: affected Salesforce instance, the initiating user/service account and any associated connected apps. Pivot on these details to identify wider activity and, if necessary, reach out to the appropriate application owner to confirm directly.
References:
https://cybersecuritynews.com/shinyhunters-6-million-customers-records-odido/
https://www.microsoft.com/en-us/security/blog/2026/07/13/defending-saas-based-applications-against-shinyhunters-oauth-abuse/
https://developer.salesforce.com/docs/platform/api-asynch/guide/asynch-api-intro.html
Baseline detection to identify rare usage of Salesforce bulk API operations initiated by a user/service account not previously seen performing similar actions within the last 7 days. This includes the specific attack chain where a victim is socially engineered into granting consent to a malicious OAuth application which is subsequently used to perform bulk API operations.
Hypothesis:
An adversary associated with Shinyhunters may use a compromised Salesforce identity to perform first-time bulk API activity in order to enumerate and collect large volumes of CRM records for data theft and extortion.
Actions:
Review detection details to identify: affected Salesforce instance, the initiating user/service account and any associated connected apps. Pivot on these details to identify wider activity and, if necessary, reach out to the appropriate application owner to confirm directly.
References:
https://cybersecuritynews.com/shinyhunters-6-million-customers-records-odido/
https://www.microsoft.com/en-us/security/blog/2026/07/13/defending-saas-based-applications-against-shinyhunters-oauth-abuse/
https://developer.salesforce.com/docs/platform/api-asynch/guide/asynch-api-intro.html
Flags endpoints tied to anonymous file-drop sites, paste services and chat platforms abused for exfiltration and C2. Sanctioned services (Dropbox, Drive, OneDrive, Box) are left out as in the original; an optional block is included.
Detects when a non-system process creates a named pipe with a non-standard name, followed within 10 minutes by an inbound SMB connection (port 445) from another host to the same device. This behavior can indicate lateral movement or post-exploitation framework activities like Adaptix using named pipes and SMB.
Detects endpoints browsing or connecting to known replacement or backup Telegram and X (Twitter) channels associated with Dark Storm Team, based on specific URL regex matching in device network and browser events.
Detects a sequence where an unsigned or untrusted kernel driver is loaded from a user-writable path (potentially indicating a Bring Your Own Vulnerable Driver / BYOVD pattern), followed by a security tampering attempt or antivirus tamper event on the same device within a 30-minute window.
Detects a potential web shell by identifying a web server or runtime process creating or modifying a script file (PHP, JS, MJS) in a web-accessible directory, followed closely by the same web server process spawning a shell or command interpreter.
Detects behavior where a download utility such as curl or wget downloads and executes a dot-prefixed executable (like .kworker or .sys_update) in the /tmp directory, running detached via nohup. It also covers Node-RED parent process contexts and specific payload server indicators.
Detects indicators of compromise associated with a trojanized Claude Code VS Code extension distributed through Cursor's marketplace. The rule identifies file modifications to authorized_keys, process executions establishing reverse SSH tunnels, specific hardcoded C2 IP addresses, and references to the attacker's SSH key 'svc-telemetry'.
Detects a sequence where a Terraform provider process executes on a developer host, followed by the same device establishing a network connection to known ROOFDECK or FLATROOF C2 domains or IP addresses within 1 hour.
Correlates a certificate-based (PKINIT) Kerberos logon by an account with a DCSync-style directory replication from the same account within a 5-minute window, using Microsoft Defender for Identity logs.
Detects Remote Desktop Protocol (RDP) logons, reconnections, and session disconnections involving specific actor hostnames or client names over a 7-day aggregation window, summarizing by IP address and source name.
Detects a sequence where a local user account is created or added to a local group using net.exe or net1.exe, followed by reg.exe configuring AnyDesk persistence under the SafeBoot Network registry key on the same device within a 24-hour window.
Detects the process-level execution of agentic offensive tooling and servers associated with the BOSSAI report, including HexStrike, Kali MCP, HalberdStrike, and CyberStrike.
Identify potential defense evasion activity where attackers abuse built-in Windows administration tools to stop services, clear logs, or modify auditing and security controls.
Page 8 of 2907