Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
505 detections
Filters
Last updated
All Time
Detection languages
245
92
78
48
19
Contributors
141
113
53
46
41
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
210
138
110
80
76
Products / Services
147
74
61
41
28
MITRE Techniques
243
128
69
68
55
CVEs
10
9
5
5
5
IDS Classtypes
4
IDS Protocols
4
Detects potential privilege escalation in Entra ID (Azure AD) by monitoring for the assignment of high-privileged administrative roles to users or the granting of admin consent to applications, which can be leveraged to maintain persistence or escalate privileges.
Detects the modification of a GitHub Actions release workflow that removes manual approval/gate requirements and introduces a push-to-main trigger, followed closely by an automated npm publish event. This behavior suggests an attempt to establish an unattended supply chain release path.
Detects multiple rapid modifications to GitHub Actions workflow files (.github/workflows/*.yaml) within a short timeframe (<= 20 minutes). This pattern is indicative of potential CI/CD pipeline poisoning or suspicious activity where an actor may be attempting to inject malicious code or configurations into the build process.
Detects unauthorized modifications to GitHub Actions workflow configuration files (.github/workflows/*.yml) that explicitly enable automated publishing triggers (push to main branch). The rule looks for specific content patterns in the workflow file indicating a push-to-main trigger and monitors for suspicious or known bad commit hashes associated with such changes.
This rule identifies instances of Cisco Secure Email Gateway (AsyncOS) running vulnerable versions that are susceptible to CVE-2026-76461. It parses the software inventory data to identify appliances within branches 15.5, 16.0, and 16.5, comparing the patch and build versions against the known secure release versions (15.5.5-0141, 16.0.4-302, 16.5.0-780).
Detects administrator-privileged actions in JFrog Artifactory audit logs attributed to the 'token:anonymous' identity, the tell-tale signature left when CVE-2026-42018 (unauthenticated token retrieval) is chained with CVE-2026-42016 (privilege escalation) to mint an admin-scope token that retains the anonymous username. Also relevant to CVE-2026-82329 authentication bypass activity.
Detects compromised versions (2.35 and 2.36) of the 'Admin Menu Editor Pro' WordPress plugin that were distributed via the official update infrastructure. These versions include embedded web shell code, as indicated by the presence of both plugin identification strings and common PHP execution or command-line utility functions used in backdoors.
Detects malicious activities associated with the SilkParasite campaign targeting Redis servers. The rules identify the initiation of a 'SLAVEOF' command to a rogue replication host, subsequent handshake (PSYNC/REPLCONF) with an external attacker-controlled node, and the modification of server configuration ('CONFIG SET dbfilename') to potentially facilitate unauthorized file persistence or data exfiltration through the Redis replication mechanism.
Detects malicious activities associated with the SilkParasite campaign targeting Redis servers. The rules identify the initiation of a 'SLAVEOF' command to a rogue replication host, subsequent handshake (PSYNC/REPLCONF) with an external attacker-controlled node, and the modification of server configuration ('CONFIG SET dbfilename') to potentially facilitate unauthorized file persistence or data exfiltration through the Redis replication mechanism.
This rule identifies instances of Cisco Secure Email Gateway (AsyncOS) running vulnerable versions that are susceptible to CVE-2026-76461. It parses the software inventory data to identify appliances within branches 15.5, 16.0, and 16.5, comparing the patch and build versions against the known secure release versions (15.5.5-0141, 16.0.4-302, 16.5.0-780).
This rule identifies instances of Cisco Secure Email Gateway (AsyncOS) running vulnerable versions that are susceptible to CVE-2026-76461. It parses the software inventory data to identify appliances within branches 15.5, 16.0, and 16.5, comparing the patch and build versions against the known secure release versions (15.5.5-0141, 16.0.4-302, 16.5.0-780).
Detects unauthorized usage of Android Debug Bridge (ADB) commands for self-pairing or remote connection, along with behavioral indicators linked to the RatHat Go agent, including manual power management exemption settings, silent package installation with permission granting, and persistence via accessibility service enablement.
Detects anomalous administrative activity within Microsoft Exchange by identifying accounts performing multiple suspicious operations within a short timeframe. This rule flags activities like modifying transport rules, virtual directories, or management role assignments, which are often indicative of malicious persistence or configuration tampering, while excluding known authorized service accounts.
Detects the creation or modification of email inbox rules that perform actions such as forwarding, deleting, or moving messages combined with keywords often associated with financial fraud, business email compromise (BEC), or credential harvesting. Adversaries often use these rules to hide communications, redirect financial emails, or automate data exfiltration.
This rule identifies instances of Cisco Secure Email Gateway (AsyncOS) running vulnerable versions that are susceptible to CVE-2026-76461. It parses the software inventory data to identify appliances within branches 15.5, 16.0, and 16.5, comparing the patch and build versions against the known secure release versions (15.5.5-0141, 16.0.4-302, 16.5.0-780).
Detects potential post-authentication persistent actions (e.g., OAuth app grants, MFA changes, mailbox rule updates) performed shortly after a successful Google Workspace login, specifically flagging actions originating from IP addresses different from the login session to identify session hijacking or token replay (AiTM) activity. Includes suppression for known corporate IP ranges, trusted OAuth application consents, and recurring user behavior.
Detects potential post-authentication persistent actions (e.g., OAuth app grants, MFA changes, mailbox rule updates) performed shortly after a successful Google Workspace login, specifically flagging actions originating from IP addresses different from the login session to identify session hijacking or token replay (AiTM) activity. Includes suppression for known corporate IP ranges, trusted OAuth application consents, and recurring user behavior.
Detects malicious Android application activity where an app attempts to enable accessibility services and wireless debugging to perform unauthorized ADB pairing and connection. This technique is associated with the RatHat malware family to bypass sandbox protections and perform self-pairing for ADB access without user interaction.
Detects anomalous administrative activity within Microsoft Exchange by identifying accounts performing multiple suspicious operations within a short timeframe. This rule flags activities like modifying transport rules, virtual directories, or management role assignments, which are often indicative of malicious persistence or configuration tampering, while excluding known authorized service accounts.
Detects modifications or creation of the VS Code 'settings.json' file within a '.vscode' folder where the configuration includes 'workbench.startupEditor' and 'readme'. This pattern is frequently used in malicious extensions or malicious repository configurations to trick users into opening a malicious README file upon starting the editor, potentially leading to further compromise.
This rule identifies instances of the Acronis backup plugin for cPanel, WHM, or Plesk running on versions older than 1.9.3 HF3. This versioning threshold corresponds to the patch level required to mitigate the security vulnerability identified as CVE-2026-87886.
Page 10 of 25