Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,146 detections
Filters
Last updated
All Time
Detection languages
679
377
340
230
173
Contributors
630
378
354
143
119
Categories
835
831
746
387
348
Platforms
1,580
584
492
263
118
Products / Services
10,680
9,761
6,694
4,418
3,744
2,146
MITRE Techniques
655
561
377
331
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
This rule detects attempts to execute files from external WebDAV shares. It specifically looks for HTTP GET requests where the User-Agent header starts with 'Microsoft-WebDAV-MiniRedir/' and the requested URI ends with common executable or script file extensions. This behavior is often observed in initial access campaigns where adversaries leverage WebDAV to deliver and execute malicious payloads.
This rule detects when a file is downloaded via HTTP and subsequently created on a system, where the file's SHA256 hash and the URL it was downloaded from are identified as malicious through VirusTotal relationships. It correlates HTTP network events with file creation events, ensuring the download precedes the file creation, and then enriches this information with VirusTotal data to confirm the malicious nature of the file and its source URL.
This rule detects HTTP web access to domains that exhibit low prevalence within the monitored environment. It specifically filters out internal RFC 1918 IP addresses and ensures that only valid Fully Qualified Domain Names (FQDNs) are considered. The prevalence is determined by a rolling maximum count of unique days a domain has been observed, with alerts triggering for domains seen 3 or fewer times. The risk score is incremented based on how low the prevalence is, with the lowest prevalence (1 day) resulting in the highest risk score.
This rule detects when a file is downloaded from an IP address and subsequently created on a system, where both the file hash and the IP address are identified by VirusTotal Relationships as being associated with each other, specifically through a 'DOWNLOADED_FROM' relationship. This indicates that the downloaded file is known to have been served from that particular IP address, potentially flagging malicious file distribution.
Detects exploitation attempts targeting Arcadyan routers, specifically looking for path traversal (CVE-2021-20090) and configuration file injection (CVE-2021-20091) vulnerabilities. The rule identifies requests containing '..%2f' (URL-encoded path traversal) and, for the configuration file injection, also 'apply_abstract.cgi', combined with requests to unauthenticated paths.
Detects network web access to a low prevalence domain
Detects executables launched from external WebDAV shares using the WebDAV Explorer integration, commonly seen in initial access campaigns.
Detect network connection to an ip address that was only seen for the first time in the past 24 hours
Alert on downloading a known file hash from a known IP with VT Relationships.
Example usage of WHOIS data, detecting an executable file download from a domain that's recently expired
Detects access attempts to a newly created domain via WHOIS enrichment.
This analytic identifies high-severity intrusion events based on the classification assigned to Snort rules within Cisco Secure Firewall logs. It leverages Cisco Secure Firewall Threat Defense logs and focuses on events classified as: A Network Trojan was Detected, Successful Administrator Privilege Gain, Successful User Privilege Gain, Attempt to Login By a Default Username and Password, Known malware command and control traffic, Known malicious file or file based exploit, Known client side exploit attempt, Large Scale Information Leak. These classifications typically represent significant threats such as remote code execution, credential theft, lateral movement, or malware communication. Detection of these classifications should be prioritized for immediate investigation.
Detect the update check performed by Advanced IP/Port Scanner utilities.
Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0. CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass, which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through template injection. This sequence enables unauthenticated remote code execution, significantly increasing the impact of exploitation.
This analytic detects Lumma Stealer download attempts using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signatures with specific IDs have been triggered. If confirmed malicious, this behavior could indicate an active infection of Lumma Stealer.
Detects potential exploitation attempt of CVE-2023-1389, an Unauthenticated Command Injection vulnerability in TP-Link Archer AX21 routers. The rule looks for specific URI patterns and keywords indicative of an attempt to inject commands via the 'country' parameter.
This analytic aggregates and summarizes alerts from Microsoft Defender for Endpoint. It extracts details such as source, file name, severity, process command line, IP address, registry key, signature, description, and unique ID. The detection is not intended to identify new activity from raw data but rather to leverage existing Microsoft Defender for Endpoint alerts for correlation and risk-based alerting. It filters out alerts with a 'clean' verdict and dynamically maps MITRE techniques and assigns risk scores based on the alert's severity.
This analytic identifies Snort signatures that have triggered only once in the past 7 days across all Cisco Secure Firewall IntrusionEvent logs. While these rules typically do not trigger in day-to-day network activity, their sudden appearance may indicate early-stage compromise, previously unseen malware, or reconnaissance activity against less commonly exposed services. Investigating these outliers can provide valuable insight into new or low-noise adversary behaviors.
The analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes. It leverages network traffic data to detect large ICMP packets that aren't blocked and are directed toward external networks. This can indicate information smuggling, covert communication, or command-and-control (C2) activities, potentially signaling ICMP tunneling, unauthorized data transfer, or compromised endpoints.
This analytic detects the use of known suspicious SSL certificates by comparing the SHA1 fingerprint from Cisco Secure Firewall logs against a blacklist. This is crucial for identifying malware distribution, C2 infrastructure, or phishing campaigns that reuse or self-sign certificates. Detection of such activity may indicate beaconing, malware download, or data exfiltration over TLS/SSL.
This correlation rule identifies when a user exceeds a predefined risk threshold based on multiple suspicious Okta activities within a 24-hour period. It aggregates risk events from "Suspicious Okta Activity," "Okta Account Takeover," and "Okta MFA Exhaustion" analytic stories. The detection is significant as it highlights potentially compromised user accounts exhibiting multiple tactics, techniques, and procedures (TTPs). If confirmed malicious, this activity could indicate a serious security breach, allowing attackers to gain unauthorized access, escalate privileges, or persist within the environment.
Page 95 of 103