Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,154 detections
Filters
Last updated
All Time
Detection languages
2,300
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,453
11,838
5,876
5,154
4,865
Platforms
2,857
2,017
816
524
213
Products / Services
1,335
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
ET MALWARE Observed Win32/Lumma Stealer Related Domain (sanguen .courses) in TLS SNI
ET EXPLOIT_KIT LandUpdate808 Domain (imf1 .com) in TLS SNI
ET MALWARE TA569 Middleware Server Domain in TLS SNI (buildtoolsrvcore .com)
ET INFO Observed VNT VPN Domain (vnt .wherewego .top in TLS SNI)
This rule detects an unauthenticated command injection vulnerability (CVE-2025-25256) in Fortinet FortiSIEM's phMonitor component. The detection is based on specific byte sequences and a PCRE regex matching command injection characters within the 'archive_nfs_archive_dir' parameter in TCP traffic to port 7900.
ET INFO Observed VNT VPN Domain (vnt .8443 .eu .org in TLS SNI)
Detects network communication patterns associated with the LANDFALL Android spyware C2 servers. This includes connections to known malicious domains/IPs and specific HTTP POST requests used for beaconing.
ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (secure .kasindramaharaj .com)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (sessionstorexint .com)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (parserapiprocess .com)
ET INFO DYNAMIC_DNS HTTP Request to a *.itafricagroup .com domain
ET INFO DYNAMIC_DNS HTTP Request to a *.3trust .com domain
Detects usage of the windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack refereed to as PetitPotam.
The usage of this RPC function should be rare if ever used at all.
Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate.
View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'
The usage of this RPC function should be rare if ever used at all.
Thus usage of this function is uncommon enough that any usage of this RPC function should warrant further investigation to determine if it is legitimate.
View surrounding logs (within a few minutes before and after) from the Source IP to. Logs from from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc..'
Detects the presence of default Cobalt Strike certificate in the HTTPS traffic
DNS TOR Proxies
Sigma
Identifies IPs performing DNS lookups associated with common Tor proxies.
ET MALWARE TA569 Middleware Server Domain in TLS SNI (taskrunnersrvmod .com)
ET INFO Remote Monitoring and Management (RMM) Tool in TLS SNI (gorelo .tech)
ET INFO Blockchain RPC Domain in TLS SNI (cloudflare-eth .com)
ET INFO Observed Commonly Actor Abused Cloud Hosting Service Domain (caspio .com in TLS SNI)
Detects suspicious access to multiple Azure Storage Accounts using a Shared Access Signature (SAS) token from a single external IP address. This pattern can indicate the use of a compromised, potentially overly permissive, SAS token for reconnaissance or lateral movement.
This rule detects HTTP traffic where the User-Agent string contains the case-insensitive substring 'iot'. This could indicate activity from Internet of Things (IoT) devices, potentially malicious botnet activity, or other suspicious automated traffic originating from or targeting IoT devices.
Page 203 of 246