Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,151 detections
Filters
Last updated
All Time
Detection languages
2,297
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
2,854
2,017
813
521
213
Products / Services
1,334
1,144
831
576
366
MITRE Techniques
1,820
1,307
787
746
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This detection identifies network traffic to domains known to be used as command and control (C2) infrastructure in recent SharePoint exploitation campaigns. Communication with these domains is a strong indicator of compromise.
Detects an executable initiating a network connection to "ngrok" domains.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
Attackers were seen using this "ngrok" in order to store their second stage payloads and malware.
While communication with such domains can be legitimate, often times is a sign of either data exfiltration by malicious actors or additional download.
This rule detects the creation of a suspicious file named 'spinstall0.aspx' or similar in a specific SharePoint template directory, which is indicative of a potential compromise related to CVE-2025-49704, CVE-2025-49706, or CVE-2025-53770. Additionally, it identifies network connections to known malicious IP addresses associated with these vulnerabilities.
Detects allowed network traffic to the TOR network. Adversaries can use TOR to anonymize their network activity, bypass security controls, and evade detection while conducting malicious operations. This could lead to unauthorized access, data exfiltration, and compliance violations if deemed malicious.
This detection identifies network traffic to or from IP addresses known to be associated with command and control (C2) infrastructure or active exploitation in recent SharePoint vulnerability campaigns. Communication with these IPs is a strong indicator of either an attempted attack or an existing compromise.
This detection identifies when a Microsoft Teams message containing a URL associated with a known Remote Monitoring and Management (RMM) tool was sent and subsequently clicked by the intended recipient or the original sender. The domain is not part of the organization's approved RMM solutions, indicating a potential use of Living-off-the-Land RMM (LOLRMM) techniques often employed in initial access or persistence stages by threat actors.
This activity may reflect attempted remote access, lateral movement, or data collection through unauthorized RMM deployment.
This activity may reflect attempted remote access, lateral movement, or data collection through unauthorized RMM deployment.
Detects network traffic to command and control (C2) servers associated with the Katz Stealer malware, identified by known IP addresses and domains.
This detection identifies outbound SSL connections where the certificate issuer or subject matches suspicious strings associated with PureRAT infrastructure.
This rule detects network connections and DNS queries to known command and control (C2) infrastructure associated with Lumma Stealer malware. It leverages a regularly updated external list of indicators of compromise (IOCs) including IP addresses and domains to identify malicious communication attempts.
This detection identifies when Microsoft Teams applications send messages to groups / users in your organization's tenant. It utilizes the 'BotAddedToTeam' and 'AppInstalled' action types from CloudAppEvents to collect all Teams applications created in the specified timeframe and then joins on MessageEvents, matching events where SenderObjectId equals AppGuid.
This activity is significant as it may uncover unverified applications being added to teams channels and communicating with users in your tenant. Teams application security, compliance, and permissions can be reviewed in the Microsoft Teams Admin portal -
https://admin.teams.microsoft.com/policies/manage-apps/
This activity is significant as it may uncover unverified applications being added to teams channels and communicating with users in your tenant. Teams application security, compliance, and permissions can be reviewed in the Microsoft Teams Admin portal -
https://admin.teams.microsoft.com/policies/manage-apps/
Detects network connections to IP addresses known to be involved in the exploitation of SharePoint vulnerability CVE-2025-53770.
Detects the execution of a Cloudflared that uses 'tunnel run' with a long token, which is indicative of a tunneling tool being used. This pattern is often associated with legitimate remote access tools or potentially malicious C2 frameworks.
Detects the HazyBeacon backdoor, which leverages AWS Lambda URLs for C2 communication and uses custom tools for data exfiltration. The rule identifies known malicious file hashes, suspicious tool drops in C:\ProgramData, specific service creation commands for persistence, and network connections from the sideloaded host process (mscorsvw.exe) to AWS Lambda URLs.
Detects network connections to Visual Studio Code tunnel domains initiated by a process on a system. Attackers can abuse that feature to establish a reverse shell or persistence on a machine.
This detection looks for reverse shell string patterns on an ESXi host, which may indicate that a threat actor is attempting to establish remote control over the system. It specifically identifies patterns commonly used in bash, python, and other shell commands to initiate reverse connections.
This detection looks for activity associated with the Redirection ad-jacking campaign. It detects network connections to known malicious C2 domains and the installation of malicious browser extensions identified by their extension IDs.
Detects network traffic to known Command and Control (C2) IP addresses associated with the SuperBlack ransomware.
Detects PowerShell activity associated with the Kimsuky threat actor, where system information is collected and exfiltrated to a private GitHub repository, or where other IOCs related to this campaign are observed. This technique was observed in a campaign distributing the XenoRAT malware.
This rule detects potentially malicious sign-in attempts that occur shortly after a user clicks on a URL, especially when the sign-in originates from a different IP address or subnet than the URL click. It specifically looks for risky sign-ins to Microsoft first-party applications. The logic aims to identify scenarios where a user might be phished (e.g., via a malicious link) and then their credentials are used to sign in from an attacker-controlled location.
Detects Matanbuchus malware loader IOCs including file hashes, a scheduled task name, domains, and an IP address.
Detects network traffic to known Command and Control (C2) IP addresses used by the Mora_001 group for their SuperBlack ransomware operations.
Page 215 of 246