Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,456
11,839
5,876
5,155
4,865
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
Detects the installation of software packages in build or CI pipelines where the package was published to its registry between 30 and 90 days prior to being first used in the environment. This pattern is indicative of potential dependency confusion or typosquatting attacks, where adversaries use newly created packages to deliver malicious code.
Detects the publication or upload of RubyGems packages containing embedded Server-Side Template Injection (SSTI) payloads within their author metadata, specifically targeting common testing strings like '<%= 7*7 %>'. This behavior is indicative of supply chain testing or potential exploitation attempts against package registry infrastructure or downstream consumers.
Detects Microsoft Teams messages containing keywords related to authentication updates, passkey enrollment, or SSO changes combined with urgent language or calls to action (e.g., clicking links). The rule attempts to identify potential credential harvesting or account takeover attempts within the chat platform.
Detects high-frequency requests to various Microsoft Graph API endpoints, such as users, groups, applications, and mailboxes, within a short timeframe. This behavior is indicative of an adversary attempting to map out a target's cloud identity infrastructure and environment, often as a precursor to more focused attacks like phishing, data exfiltration, or lateral movement within M365.
Detects the creation of an administrator-level user account in a WordPress environment within a one-hour window after the 'Admin Menu Editor Pro' plugin is updated to known trojanized versions (2.35 or 2.36), which is indicative of a backdoor installation.
Detects multiple successful GitLab authentication events from a specific source IP that contain parameters indicating an attempt to skip or bypass two-factor authentication, consistent with known GitLab 2FA bypass vulnerabilities.
Detects administrator-privileged actions in JFrog Artifactory audit logs attributed to the 'token:anonymous' identity, the tell-tale signature left when CVE-2026-42018 (unauthenticated token retrieval) is chained with CVE-2026-42016 (privilege escalation) to mint an admin-scope token that retains the anonymous username. Also relevant to CVE-2026-82329 authentication bypass activity.
Detects administrator-privileged actions in JFrog Artifactory audit logs attributed to the 'token:anonymous' identity, the tell-tale signature left when CVE-2026-42018 (unauthenticated token retrieval) is chained with CVE-2026-42016 (privilege escalation) to mint an admin-scope token that retains the anonymous username. Also relevant to CVE-2026-82329 authentication bypass activity.
Detects administrator-privileged actions in JFrog Artifactory audit logs attributed to the 'token:anonymous' identity, the tell-tale signature left when CVE-2026-42018 (unauthenticated token retrieval) is chained with CVE-2026-42016 (privilege escalation) to mint an admin-scope token that retains the anonymous username. Also relevant to CVE-2026-82329 authentication bypass activity.
Detects high-frequency password reset or credential recovery attempts originating from a single source IP against multiple user accounts. This behavior is indicative of an automated enumeration or brute-force attack, potentially exploiting vulnerabilities such as the referenced CVE-2026-18963.
Detects anomalous unauthenticated password reset requests targeting the Keycloak reset-credentials endpoint. The rule monitors for high-volume password reset attempts from single source IP addresses, specifically flagging those that target common administrative usernames or attempt to reset passwords across multiple distinct user accounts, which may indicate exploitation attempts (e.g., CVE-2026-18963).
Detects GitLab CI/CD pipeline configuration (.gitlab-ci.yml) that sets job artifacts to 'untracked: true' with 'when: always', which publishes every untracked file as a downloadable CI artifact -- the exact misconfiguration that exposed the leaked GitLab token in the GnuTLS incident.
Detects GitLab CI/CD pipeline configuration (.gitlab-ci.yml) that sets job artifacts to 'untracked: true' with 'when: always', which publishes every untracked file as a downloadable CI artifact -- the exact misconfiguration that exposed the leaked GitLab token in the GnuTLS incident.
Detects GitLab CI/CD pipeline configuration (.gitlab-ci.yml) that sets job artifacts to 'untracked: true' with 'when: always', which publishes every untracked file as a downloadable CI artifact -- the exact misconfiguration that exposed the leaked GitLab token in the GnuTLS incident.
Detects a direct push to the protected 'gnutls_3_7_x' release branch with no associated merge request, bypassing code review even when the pusher's role technically satisfies branch-protection rules.
Detects a direct push to the protected 'gnutls_3_7_x' release branch with no associated merge request, bypassing code review even when the pusher's role technically satisfies branch-protection rules.
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects instances where a specific user creates or deletes a Microsoft Power Automate flow that has active sharing permissions configured, potentially indicating unauthorized workflow manipulation or persistence attempts.
Detects a single GitLab token/account holding Owner-level access across an unusually large number of projects (50+), the standing-privilege condition that turned one leaked token into a 55-project supply-chain exposure.
Page 38 of 83