Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,456
11,839
5,876
5,155
4,865
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
This rule detects potentially unauthorized access or downloading of files from SharePoint and OneDrive, as well as specific MailItemsAccessed events associated with known exfiltration toolkit patterns within Microsoft 365. It flags individual events matching these criteria as a baseline for identifying suspicious data access behaviors.
Detects npm packages exhibiting suspicious metadata characteristics, such as disproportionately high download counts relative to package age, or combinations of trust signals that suggest potential supply chain poisoning or typosquatting, specifically targeting packages mimicking legitimate sorted-btree functionality.
Detects the Kimsuky APT-C-55 'Stella_Gary' attack chain, where PowerShell is used to download a JavaScript verification script from an external C2 (InfinityFree), followed by the execution of that script via cscript.exe in temporary directories. This behavior is used to bypass anti-bot mechanisms and retrieve secondary payloads from hardcoded C2 infrastructure.
Detects bulk uploads or downloads of AI/ML artifacts, such as model weights, datasets, and configuration files, to suspected personal or external cloud storage providers. This rule is designed to identify potential unauthorized exfiltration of proprietary AI/ML assets.
This rule monitors for potential exploitation of AI supply chain vulnerabilities, specifically targeting AML.T0058 (Publish Poisoned Models). It identifies the download of suspicious model artifact files (e.g., .pt, .pkl, .h5, .onnx) via common tools like curl, wget, or pip, and detects the subsequent insecure deserialization of these files using Python's pickle library when dangerous opcodes (REDUCE/GLOBAL) are combined with system command execution primitives (os.system, subprocess).
This rule detects when a user grants OAuth application permissions for high-risk scopes (e.g., Mail, Files) to an application that was registered within the last 7 days. It correlates this event with subsequent suspicious actions performed by the same user, specifically mailbox rule modifications or file download activity, which are common indicators of post-compromise activity following OAuth consent phishing.
Detects proxy requests to typosquatted domains masquerading as major job platforms (LinkedIn, Indeed) that are serving suspicious file extensions (.hta, .ps1) often associated with the 'ClickFix' social engineering technique. This rule monitors for URLs mimicking these brands while attempting to deliver potentially malicious scripts to the user.
Detects the execution of npm commands to install specific, potentially malicious or typo-squatted npm packages. The rule filters for common npm install command line arguments and matches against a predefined list of package names that are often associated with supply chain compromise attempts.
Detects the execution of npm commands to install specific, potentially malicious or typo-squatted npm packages. The rule filters for common npm install command line arguments and matches against a predefined list of package names that are often associated with supply chain compromise attempts.
Detects anomalous large-volume file download or export activity from cloud repositories (SharePoint, OneDrive, or Salesforce) occurring shortly after a help-desk-mediated credential or MFA reset for the same user. This behavior is indicative of account takeover, specifically vishing-to-exfiltration patterns used by threat actors.
Detects network traffic patterns indicative of unauthorized or malicious APK sideloading attempts, specifically targeting fake Google Play delivery mechanisms, lure domains, and known command-and-control (C2) infrastructure.
Detects network traffic patterns indicative of unauthorized or malicious APK sideloading attempts, specifically targeting fake Google Play delivery mechanisms, lure domains, and known command-and-control (C2) infrastructure.
Detects network traffic patterns indicative of unauthorized or malicious APK sideloading attempts, specifically targeting fake Google Play delivery mechanisms, lure domains, and known command-and-control (C2) infrastructure.
Detects network traffic patterns indicative of unauthorized or malicious APK sideloading attempts, specifically targeting fake Google Play delivery mechanisms, lure domains, and known command-and-control (C2) infrastructure.
Detects network activity related to the SectopRAT malware downloading a secondary module named 'WbElevation.dll' from a known command and control (C2) server. This module is typically associated with browser credential theft functionality.
Detects network activity related to the SectopRAT malware downloading a secondary module named 'WbElevation.dll' from a known command and control (C2) server. This module is typically associated with browser credential theft functionality.
This rule detects HTTP GET requests resulting in the download of an Android Package (.apk) file where the host is not a known official Google Play or reputable third-party application distribution source. It further validates the detection by inspecting the HTTP response headers for the specific Android application package MIME type and the response body for indicators commonly associated with fake branded application portals.
Detects anomalous large-volume file download or export activity from cloud repositories (SharePoint, OneDrive, or Salesforce) occurring shortly after a help-desk-mediated credential or MFA reset for the same user. This behavior is indicative of account takeover, specifically vishing-to-exfiltration patterns used by threat actors.
Detects unauthorized or potentially malicious file transfer activity within ScreenConnect sessions. The rule flags file transfers occurring on vulnerable versions of ScreenConnect (prior to 26.6.5), transfers that bypass user confirmation prompts, or instances where files are transferred and subsequently executed.
This rule detects HTTP GET requests to a specific GitHub repository path (raw.githubusercontent.com/omskiwdcvoiuyfd0998/) identified as staging infrastructure associated with Konni/VelvetCake malware operations. This activity is indicative of a compromised host attempting to download malicious payloads or stage tools from actor-controlled infrastructure.
This rule detects HTTP GET requests to a specific GitHub repository path (raw.githubusercontent.com/omskiwdcvoiuyfd0998/) identified as staging infrastructure associated with Konni/VelvetCake malware operations. This activity is indicative of a compromised host attempting to download malicious payloads or stage tools from actor-controlled infrastructure.
Page 22 of 76