Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,154 detections
Filters
Last updated
All Time
Detection languages
2,300
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,453
11,838
5,876
5,154
4,865
Platforms
2,857
2,017
816
524
213
Products / Services
1,335
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects network connections via finger.exe, which can be abused by threat actors to retrieve remote commands for execution on Windows devices.
In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server.
Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion.
Investigating such network connections can also help identify potential malicious infrastructure used by threat actors
In one ClickFix malware campaign, adversaries leveraged the finger protocol to fetch commands from a remote server.
Since the finger utility is not commonly used in modern Windows environments, its presence already raises suspicion.
Investigating such network connections can also help identify potential malicious infrastructure used by threat actors
Detects the macOS Script Editor (`Script Editor.app`) launching child processes or initiating network connections. This behavior can indicate the execution of a malicious AppleScript used to download secondary payloads or execute arbitrary commands, as seen in campaigns delivering stealers like MacSync and Odyssey.
Detects execution of Node.js from unusual locations or associated with network connections to known C2 infrastructure, as seen in campaigns distributing backdoors disguised as legitimate software.
The query below correlates device inventory, IP assignment and network events to identify internal endpoints attempting to connect to routers — including whether they succeeded and via Web or Application access. Attack traffic often aligns with failed HTTP/HTTPS attempts or unknown device names.
Detects the use of PuTTY Link (plink.exe) with command-line arguments indicative of SSH tunneling, executed from a suspicious file path. This technique is used by the xHunt APT group for lateral movement and to create covert communication channels.
ET MOBILE_MALWARE Observed Klopatra Domain (guncel-tv-player-lnat .]com) in TLS SNI
Detects network connections to Command and Control (C2) servers associated with the LANDFALL Android spyware. LANDFALL communicates over HTTPS, often on non-standard ports.
Detects network traffic to Large Language Model (LLM) providers that have not implemented mitigations for the Whisper Leak side-channel attack. Communication with these providers is more susceptible to topic inference attacks.
Detects outbound HTTP POST requests to the LeakyStealer C2 server 'everstead.group' using a specific user-agent and URI paths.
SQL Database Version Discovery
Suricata
This rule detects attempts to discover the version of a SQL database, often a precursor to SQL injection attacks or other reconnaissance activities. It specifically looks for SQL queries containing keywords like 'select' and 'version' in various common formats used to retrieve database version information.
This rule identifies and summarizes the usage of various Remote Monitoring and Management (RMM) tools across an environment. It correlates process execution events (based on executable and process names) and network connection events (based on remote URLs/domains) with a predefined list of known RMM tools. The output provides a count of unique devices using each RMM tool, grouped by machine group, allowing for an overview of RMM tool prevalence and distribution.
This rule detects TLS Server Name Indication (SNI) requests for 'store.steampowered.com'. This domain is associated with the Valve Steam Store and its presence in TLS SNI could indicate activity related to information stealers like Vidar Stealer, which has been observed targeting Steam accounts.
This rule detects HTTP POST requests to github.com's /login/device/code endpoint that contain a 'client_id=' in the request body. This pattern is indicative of a device code authentication flow, which could be leveraged in phishing attacks (device code phishing) to steal application access tokens.
ET INFO WatchGuard Fireware OS IKEv2 Unauthenticated Vulnerable Version Disclosure (CVE-2025-9242)
This rule detects attempts to retrieve PowerShell scripts (.ps1) from an external server using WebDAV (PROPFIND method) with a 'Microsoft-WebDAV-MiniRedir/' user agent. This activity is often associated with adversaries attempting to transfer tools or malicious scripts into a compromised environment.
This rule detects attempts to exploit CVE-2021-20021, an unauthenticated arbitrary user creation vulnerability in SonicWall Email Security. The rule specifically looks for HTTP POST requests to the '/createou' URI with 'data=' in the request body, indicating an attempt to create a new organizational unit or user.
This rule detects HTTP POST requests to github.com's /login/device/code endpoint containing a 'client_id=' parameter in the request body. This pattern is indicative of a device code authentication flow, which could be leveraged in phishing attacks (device code phishing) to steal application access tokens or facilitate unauthorized access to GitHub accounts.
ET INFO Remote Monitoring and Management (RMM) Tool in TLS SNI (gorelo-rmm .azurewebsites .net)
This rule detects attempts to exploit a deserialization vulnerability (CVE-2018-8421) in Microsoft SharePoint via a crafted workflow. The detection specifically looks for HTTP POST requests to the `/_vti_bin/webpartpages.asmx` endpoint containing `ValidateWorkflowMarkupAndCreateSupportObjects` and `workflowMarkupText` with CDATA, indicating an attempt to inject malicious XML.
This rule detects HTTP requests to archive.org for image files (png, jpg, jpeg, svg, gif, tiff) that have minimal request headers, specifically lacking both 'User-Agent' and 'Referer' headers. This behavior can be indicative of automated tools or malware attempting to retrieve content while trying to evade detection or hide their origin.
Detects network connections to known Command and Control (C2) servers associated with the LANDFALL Android spyware. The spyware communicates over HTTPS, often on non-standard ports.
Page 202 of 246