Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule performs a retrospective sweep across Microsoft Defender XDR data sources (DeviceFileEvents, DeviceProcessEvents, DeviceNetworkEvents, and EmailEvents) to identify activity associated with the Star Blizzard (COLDRIVER) campaign. It monitors for specific file hashes, file names, known C2 IP addresses and domains, malicious URL patterns, and known phishing email sender addresses identified in threat intelligence reporting.
This rule performs a retrospective sweep across Microsoft Defender XDR data sources (DeviceFileEvents, DeviceProcessEvents, DeviceNetworkEvents, and EmailEvents) to identify activity associated with the Star Blizzard (COLDRIVER) campaign. It monitors for specific file hashes, file names, known C2 IP addresses and domains, malicious URL patterns, and known phishing email sender addresses identified in threat intelligence reporting.
This rule detects potential lateral movement activity by identifying the execution of PsExec service components or common lateral movement tools (PsExec, WMIC, CMD) interacting with Windows administrative shares (via UNC paths or specific network ports 135, 139, 445). It specifically looks for process creation events associated with these tools and network activity indicative of remote administration. Legitimate administrative tools signed by Microsoft or known management software (SolarWinds, Tanium, Ivanti, IBM BigFix) are explicitly excluded.
Detects automated HTTP GET requests directed at government or council calendar endpoints (specifically targeting mgCalendarMonthView or GetMeetings parameters) using a common generic User-Agent. This behavior is indicative of an automated scripted client potentially using public infrastructure as a Command and Control (C2) relay.
This rule monitors for two related scenarios targeting the RubyGems legacy API-key endpoint. First, it identifies suspicious responses indicating an API key might have been served from a CDN cache, potentially leading to cross-user credential leaks. Second, it flags a high volume of requests to the same endpoint using gzip compression, which is a known technique associated with edge-cache poisoning attacks.
Detects instances of mshta.exe initiating network connections to cloud storage providers (CloudFront, Cloudflare R2/pages) to retrieve multiple remote files (specifically .js or .txt). This behavior is indicative of an exploit stage where mshta.exe is used as a LOLBAS to fetch orchestrator scripts and gadget payloads for memory-based deserialization attacks.
Detects HTTP responses containing patterns associated with a malicious HTA stager hosted on Cloudflare Pages. The rule looks for specific URL structures often used in phishing campaigns that attempt to deliver malicious payloads, specifically involving a cloned Gmail attachment widget.
Detects Heartbleed (CVE-2014-0160) exploitation attempts by monitoring for malformed TLS heartbeat requests (undersized payload) followed by oversized responses from the server that indicate potential memory disclosure.
Detects Heartbleed (CVE-2014-0160) exploitation attempts by monitoring for malformed TLS heartbeat requests (undersized payload) followed by oversized responses from the server that indicate potential memory disclosure.
Detects SQL injection exploitation attempts against MOVEit Transfer targeting the CVE-2023-34362 vulnerability, followed by the deployment and subsequent interaction with the 'human2.aspx' webshell associated with Cl0p ransomware mass-exploitation campaigns.
Detects network activity associated with the 'ClickFix' social engineering campaign, which commonly targets users with fake error messages to trick them into executing malicious commands. The rule identifies communication with known malicious infrastructure (domains and IP addresses) found in CommonSecurityLog events, while implementing filters to exclude common security scanners and deduplicating per-host alerts.
Detects network requests to specific GitHub, Blogspot, and Telegram endpoints, which are known to be used by the 'VPN-for-X' extension to fetch proxy configuration files. This behavior is indicative of C2 channel configuration retrieval.
Detects outbound network connections to known SectopRAT C2 infrastructure, specifically targeting the hardcoded IP 98.142.252.140 or the non-standard port 15847 often used for encrypted exfiltration.
Detects anomalous activity where a single compromised AI agent identity attempts to connect to a high volume of internal agent, API, or RPC endpoints within a short time window. This behavior is indicative of lateral movement across an interconnected agent mesh.
IOC hunt across DNS, network, and file-hash telemetry for the Ledger Google Ads phishing campaign. Vercel redirect domains are matched by exact hostname (DNS query name / parsed URL host) rather than substring, eliminating false positives from unrelated strings that merely contain a look-alike domain fragment. GCS bucket and Google Sites path IOCs remain substring-matched since the bucket IDs and page slugs are already highly specific.
Detects network navigation to Google Sites pages that match patterns associated with known Ledger-impersonating phishing campaigns. These sites are often reached through redirect chains involving Google Ads, cloud storage, and rotating domains.
Detects network activity (TCP, DNS, TLS, HTTP) associated with the UNC6240 threat actor's infrastructure, specifically targeting communications with known malicious IP addresses and domains used in a campaign leveraging PeopleSoft-related lures.
Detects established, bidirectional TCP connections between internal hosts and known infrastructure associated with the SIDEEYE backdoor on specific control and data ports (3333 and 3334).
Detects network, HTTP, and DNS activity associated with the known three-tier delivery infrastructure (phishing sites, relay/dispatcher servers, and payload hosts) used by the threat actor UNC6671/SilverFox/Aurora. The rule distinguishes between high-confidence confirmed connections and low-confidence DNS-only events.
Detects network activity associated with the LONGTALE malware family (attributed to APT31/JungleBamboo). This includes identification of specific malicious browser extension IDs in HTTP traffic and signature-based detection of periodic HTTPS/HTTP beaconing patterns indicative of session or cookie exfiltration.
Detects HTTP beaconing and WebSocket command-and-control (C2) communication associated with the AgtaBackup RAT. This includes identifying specific check-in URIs, hardcoded 'X-Agent-Secret' header authentication, and the initialization of a WebSocket connection.
Page 21 of 246