Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
191 detections
Filters
Last updated
All Time
Detection languages
95
36
20
19
10
Contributors
35
34
27
18
13
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
58
51
41
23
22
Products / Services
40
30
18
17
13
MITRE Techniques
90
44
34
28
27
CVEs
6
2
2
2
2
IDS Classtypes
14
8
6
3
1
IDS Protocols
20
9
4
1
Detects the unauthorized PyPI release of mrmustard 0.7.4 uploaded during the known malicious publish window following the maintainer account compromise.
Detects anomalous activity in Microsoft 365 calendar events where potential C2 data is exfiltrated or synchronized. This is identified by the creation or modification of calendar events containing suspicious file names (e.g., File0.txt, File1.txt) or specific command-and-control markers within the event subject.
This rule detects 'Push', 'Put', or 'PutManifest' operations on the 'mongo' repository using specific tags ('mongofr', 'latest'), which may indicate an attempt to overwrite or inject a malicious container image into a critical database registry.
Detects a PyPI release of mrmustard 0.7.4 with no corresponding GitHub tag, indicating the package was published outside the project's normal release process.
Detects anomalous activity in Microsoft 365 calendar events where potential C2 data is exfiltrated or synchronized. This is identified by the creation or modification of calendar events containing suspicious file names (e.g., File0.txt, File1.txt) or specific command-and-control markers within the event subject.
This rule monitors system and audit logs on network appliances (like Cisco vManage) for unauthorized attempts to escalate privileges to a rogue root user ('troot') and suspicious file manipulation or command execution related to tenant list management, often associated with exploitation of specific vulnerabilities.
This rule detects potential large-scale exfiltration or staging of sensitive documents to common cloud storage locations (Dropbox, Google Drive, OneDrive) or removable media. The rule specifically triggers when a high count (more than 20) of files labeled as sensitive are accessed or transferred by a single user within a session, specifically outside of standard business hours (before 7 AM or after 8 PM).
Detects potential data exfiltration activity to the file sharing service 'easyupload.io' by monitoring DNS queries, HTTP POST requests, and general network connections to the domain.
This rule detects potential data exfiltration by monitoring for the creation of zip archives followed by an network connection to Telegram's API by the same device within a 10-minute window. This behavior often indicates that a user or an attacker is staging data in an archive and subsequently uploading it to a cloud file-sharing service.
Detects a high volume of file uploads (greater than 50) to OneDrive or SharePoint by a single user within a 5-minute window, potentially indicating bulk exfiltration of data.
This rule detects users uploading a high volume of files (50 or more within an hour) to SharePoint or OneDrive. This activity could indicate data exfiltration or unauthorized mass data transfer.
Detects exploitation of CVE-2026-20245 on Cisco Catalyst SD-WAN Manager, where a malicious CSV file is uploaded via the tenant-list workflow to trigger a script that injects a root-privileged account into system files.
Detects upload of executable files to file sharing services for staging
Detects the upload and execution of a specific malicious CSV file (evil_tenant.csv) on Cisco SD-WAN Manager (vManage) systems. This file is associated with exploitation of CVE-2026-20245, enabling attackers to inject a persistent root backdoor account into the system files.
This rule detects network connections or process command lines referencing 'easyupload.io' and 'limewire.com', as well as searches for 'eayupload'. These indicators are often associated with unauthorized file transfers or potentially malicious activity involving known file sharing platforms.
Detects anomalous outbound network connections initiated by media server processes (Jellyfin, FFmpeg, or Nextcloud) immediately following an inbound video file upload (AVI) to the media server's API, indicative of post-exploitation activity related to the PixelSmash (CVE-2026-8461) heap out-of-bounds write vulnerability.
This rule detects the exploitation of CVE-2026-20245 on Cisco SD-WAN Manager (vManage). It monitors for two distinct phases: 1) The suspicious upload of a tenant-list CSV file via CLI using a malicious filename, and 2) A subsequent privilege escalation attempt where the 'admin' user executes 'su' to switch to a 'troot' user, which is indicative of a backdoor account creation following successful exploitation.
This rule detects the use of native network utilities (wget.exe, curl.exe) executing with flags indicative of file uploads (HTTP PUT or POST) targeting archive files (zip, rar, 7z). This behavior is often associated with the direct exfiltration of staged data to attacker-controlled infrastructure.
Detects a high volume of file uploads (greater than 50) to OneDrive or SharePoint by a single user within a 5-minute window, potentially indicating bulk exfiltration of data.
Detects upload of potentially malicious VIB packages to ESXi hosts
Detects unauthorized npm package publish events or file uploads associated with compromised maintainer accounts (czirker, llxlr) and specific malicious packages linked to the Miasma Mini Shai-Hulud supply chain attack.
Page 5 of 10