Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
745 detections
Filters
Last updated
All Time
Detection languages
319
311
32
25
23
Contributors
208
198
121
84
25
Categories
20,443
11,831
5,875
5,151
4,864
745
Platforms
418
262
181
51
41
Products / Services
328
230
138
84
55
MITRE Techniques
204
124
121
111
109
CVEs
15
10
8
7
7
IDS Classtypes
124
84
26
23
12
IDS Protocols
168
91
30
11
4
This rule detects potential NTLM relay activity directed toward WSUS servers by monitoring network connections. It specifically identifies Windows devices identified as 'wsus' that communicate over both SMB (TCP 445) and Microsoft SQL Server (TCP 1433) ports within a 10-minute window, suggesting an attacker attempting to relay authentication to the WSUS backend database.
Detects unauthorized POST requests to the '/Windchill/login/' directory targeting .jsp files. This path is not used by legitimate PTC Windchill/FlexPLM traffic and is indicative of an adversary attempting to interact with a webshell or exploit a vulnerability such as CVE-2026-12569.
Detects inbound Remote Desktop Protocol (RDP) connections targeting internal Windows devices from public IP addresses. This rule identifies potential unauthorized remote access, brute-force activity, or the exposure of RDP services to the public internet.
Detects sign-in activity in Entra ID where the application display name is blank, despite an Application ID being present, originating from known cloud service provider IP ranges (AWS or Cloudflare). This pattern is consistent with automated enumeration or discovery tools that leverage OAuth client ID spoofing or misconfigurations to identify valid tenants or users.
This rule monitors security logs for evidence of exploitation attempts targeting CVE-2025-2492 or malicious activity related to the 'AiCloud' platform. It scans incoming log messages for these specific indicators to identify potentially compromised network requests.
This rule detects potentially unauthorized access or activity related to MySQL databases. It monitors for external network connections to the MySQL default port (3306) that originate from non-private IP addresses, and identifies suspicious process command lines using Python's PyMySQL library that attempt to authenticate as the 'root' user.
Detects OS fingerprinting commands executed as child processes of a process that is actively listening on a network port, consistent with DOGLEASH.
This rule detects suspicious activity where a process initiates a network listening connection, launches a shell (sh, bash), and engages in file read or rename operations within a short 15-minute window. This behavior is indicative of a potential backdoor setup, lateral movement, or malicious script execution.
Detects indicators associated with CVE-2025-2492 or AiCloud activity in security logs.
This rule identifies successful user sign-ins originating from IP addresses known to belong to VPN services. It leverages an external list of VPN IP ranges to correlate with Azure AD SigninLogs. This can indicate an attempt to bypass geo-restrictions, hide true origin, or could be legitimate use of a VPN by an employee.
Detects network requests targeting port 8013 that generate an error message indicating a missing certificate in the request header. This pattern is associated with attempts to exploit vulnerability CVE-2026-35616.
Detects the execution of OS information gathering commands (e.g., uname, lsb_release) by a process that is also identified as having an active network listener. This pattern is indicative of passive backdoors or C2 agents performing reconnaissance of the host system after establishing a listener.
Detects anomalous access to Cisco SD-WAN Manager (vManage) infrastructure. This includes unauthenticated REST API access, unauthorized NETCONF sessions, and suspicious OMP/DTLS peering connections, which may indicate exploitation of vulnerabilities (such as CVE-2026-20127 or CVE-2026-20182) or unauthorized management access.
Detects anomalous, oversized IKEv1 Phase 1 packets targeting Check Point VPN devices, indicative of an exploitation attempt for CVE-2026-50751.
Detects unauthenticated POST requests directed at the '/accessv2' endpoint of an Azure Application Gateway originating from non-internal IP addresses. This behavior is associated with the exploitation of vulnerabilities like CVE-2026-8037.
This rule detects potential SSH brute force attacks by monitoring syslog for multiple failed SSH login attempts, connection closures, or invalid user attempts from a single source IP address within a short time frame. It specifically looks for keywords like 'error', 'Connection closed', 'authentication failure', and 'invalid user' in SSHD logs.
Detects malicious activities targeting Cisco Catalyst SD-WAN infrastructure, including connections from known malicious IP addresses (UAT-8616), unauthenticated vManage API access attempts indicative of exploitation (CVE-2026-20182), and anomalous control-plane signaling (OMP/DTLS/NETCONF) from unauthorized external sources.
Detects anomalous, oversized IKEv1 Phase 1 packets targeting Check Point VPN devices, indicative of an exploitation attempt for CVE-2026-50751.
Detects evidence of exploitation attempts related to the hypothetical CVE-2026-55200 vulnerability. The rule monitors for known exploit file names, command-line arguments, and specific network patterns targeting SSH ports (22, 2222) that indicate potential LibSSH2 exploitation.
Detects network traffic attempting to modify SSH authorized_keys or the sshd_config file using SCP or SFTP protocols, which is a common technique used by attackers to maintain persistence on compromised systems.
Detects network traffic attempting to exploit the SMBv1 vulnerability (CVE-2017-0144), commonly known as EternalBlue. The rule monitors for specific SMB Trans2 SESSION_SETUP packet structures associated with this remote code execution exploit.
Page 19 of 36