Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,934
7,265
6,535
3,866
3,645
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects web server request patterns associated with a 'Kali365' phishing campaign that utilizes device code authorization flows. The rule identifies suspicious JSON design payloads that simulate various enterprise brands (e.g., Microsoft 365, DocuSign, Adobe) in combination with a 'device_code' flow identifier, indicative of a credential or token-harvesting attack.
Detects Microsoft Graph API requests targeting user mailboxes within a tenant or organization structure likely associated with Israeli legal entities, identified by .co.il domain patterns in the Request URI.
Detects a Telegram account session being authorized from a new device/IP, which BlueNoroff has been observed abusing as the precursor step in the GhostCall self-propagation pipeline: operators reuse stolen/hijacked Telegram session cookies from a new device or IP, then use the hijacked session to send fake meeting invites to trusted contacts, enabling cyclical propagation to subsequent victims.
This rule only detects the session authorization event in isolation. Analysts should correlate matches on this rule with a companion rule that detects rapid meeting-invite fan-out for the same UserId occurring within roughly 15 minutes, since that cross-event correlation cannot be expressed within a single Sigma detection. A standalone match here does not confirm active self-propagation and requires that follow-up correlation to raise confidence.
This rule only detects the session authorization event in isolation. Analysts should correlate matches on this rule with a companion rule that detects rapid meeting-invite fan-out for the same UserId occurring within roughly 15 minutes, since that cross-event correlation cannot be expressed within a single Sigma detection. A standalone match here does not confirm active self-propagation and requires that follow-up correlation to raise confidence.
Detects an HTTP GET request to the Microsoft Graph API (/v1.0/users/*/calendarView) containing a specific hardcoded far-future date (2050-05-13) in the startDateTime parameter. This pattern is indicative of a command-and-control (C2) mechanism leveraging a legitimate cloud service to maintain persistent communication channels.
Detects the malicious GitHub Actions workflow that exfiltrates PyPI/Codecov CI secrets to the attacker's known webhook.site endpoint.
Detects web server request patterns associated with a 'Kali365' phishing campaign that utilizes device code authorization flows. The rule identifies suspicious JSON design payloads that simulate various enterprise brands (e.g., Microsoft 365, DocuSign, Adobe) in combination with a 'device_code' flow identifier, indicative of a credential or token-harvesting attack.
Detects Microsoft 365 Outlook calendar events with highly anomalous future dates (specifically the year 2050) or specific subject patterns, which are indicative of a command-and-control (C2) communication channel established via calendar item properties.
Detects instances where a WordPress customization changeset is published by a session user that differs from the user associated with the changeset, specifically when the changeset owner holds an administrator role. This behavior may indicate account hijacking or unauthorized privilege escalation within the WordPress administration interface.
Detects network requests to the Google OAuth device authorization flow endpoint, which is commonly abused in phishing campaigns to trick users into authorizing a malicious application on their behalf, allowing an attacker to steal session tokens.
Detects the malicious GitHub Actions workflow that targets self-hosted runners to run identity-reconnaissance commands (whoami) from the known malicious branch and workflow path.
Detects registry-level signals of the SleeperGem RubyGems supply chain attack:
a long-dormant maintainer account publishing a new gem version, the trusted Dendreo gem receiving a new version that adds git_credential_manager as a dependency, and an unrelated maintainer (fastlane-plugin-run_tests_firebase_testlab) publishing a version referencing the same dependency within a short window - indicating coordinated, multi-account compromise rather than a single takeover.
a long-dormant maintainer account publishing a new gem version, the trusted Dendreo gem receiving a new version that adds git_credential_manager as a dependency, and an unrelated maintainer (fastlane-plugin-run_tests_firebase_testlab) publishing a version referencing the same dependency within a short window - indicating coordinated, multi-account compromise rather than a single takeover.
This rule detects non-interactive sign-in events involving the 'Microsoft Authentication Broker' where the authentication was performed using only single-factor authentication and originated from a device that is not recognized or lacks trust information (unmanaged/unknown device). This pattern is consistent with token replay attacks or session hijacking, where an adversary uses stolen authentication artifacts to access resources without undergoing standard multi-factor authentication.
Detects the creation of user accounts or identity updates that utilize naming conventions or email domains associated with 'wp2shell' malicious activity patterns. This is commonly used in WordPress exploitation scenarios to establish persistent unauthorized administrative access.
Detects suspicious batch requests to the WordPress REST API (/wp-json/batch/v1) containing both a DELETE operation on category ID 0 and a POST operation to the core block-renderer, which is characteristic of attempts to exploit vulnerabilities like CVE-2024-27956 to achieve unauthenticated remote code execution.
Detects suspicious modifications or deletions of Outlook calendar events using the Microsoft Graph API, potentially indicating the use of calendar infrastructure as a command-and-control (C2) heartbeat or exfiltration channel. The rule monitors for specific pattern-based event updates or deletions following calendar enumeration, which is a technique used to maintain persistent communication or exfiltrate small amounts of data.
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
Detects the creation of a WordPress administrator account via the REST API using username prefixes associated with the 'wp2shell' exploit (e.g., 'wp2_' or 'w2s_'). This activity is indicative of an attacker attempting to establish persistence on a compromised WordPress site.
Detects suspicious batch requests to the WordPress REST API (/wp-json/batch/v1) containing both a DELETE operation on category ID 0 and a POST operation to the core block-renderer, which is characteristic of attempts to exploit vulnerabilities like CVE-2024-27956 to achieve unauthenticated remote code execution.
Detects Microsoft Graph API requests targeting user mailboxes within a tenant or organization structure likely associated with Israeli legal entities, identified by .co.il domain patterns in the Request URI.
Detects anomalous activity in Microsoft 365 calendar events where potential C2 data is exfiltrated or synchronized. This is identified by the creation or modification of calendar events containing suspicious file names (e.g., File0.txt, File1.txt) or specific command-and-control markers within the event subject.
Detects Microsoft 365 Outlook calendar events with highly anomalous future dates (specifically the year 2050) or specific subject patterns, which are indicative of a command-and-control (C2) communication channel established via calendar item properties.
Page 97 of 142