Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
292 detections
Filters
Last updated
All Time
Detection languages
131
68
27
24
14
Contributors
66
57
36
28
15
Categories
89
80
43
42
41
Platforms
103
90
45
42
29
Products / Services
69
46
31
25
25
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
10
8
5
5
5
IDS Classtypes
16
6
2
1
IDS Protocols
12
7
4
1
Detects incoming network traffic from external IP addresses to common AI agent and model gateway ports (e.g., Ollama, vLLM, ClawdBot). This could indicate an exposed, unauthenticated service vulnerable to hijacking, potentially leading to unauthorized access or data exfiltration.
Detects a successful SSO administrative login followed by a system configuration download from the same user and source IP address within 5 minutes. This sequence is a strong indicator of compromise related to CVE-2025-59718 and CVE-2025-59719.
Detects the creation or modification of an IAM Role trust policy that grants assume-role permissions to an AWS account that is not part of the organization. This action creates a backdoor for an external entity to gain persistent access to your environment, often used by attackers to maintain unauthorized access. This rule relies on an `aws_org_accounts.csv` lookup table to identify accounts belonging to the organization. If this lookup is not established, manual filtering of AWS accounts will be required.
Service Accounts may need to be filtered.
Service Accounts may need to be filtered.
Query sign-ins with MFA success immediately following multiple failed sign-ins from different regions. Potential session hijack or AiTM (Adversary-in-the-Middle).
Error Code 0
Successful authentication
Normal successful login (validate carefully only when paired with suspicious failures)
Error Code 50053
Account locked or malicious IP
HIGH - Brute force attempts
Error Code 50074
MFA challenge not passed
HIGH - User failed MFA
Error Code 500121
MFA prompt timeout
MEDIUM - Possible MFA fatigue indicator
Error Code 50133
Session revoked or SSO artifact invalid
HIGH - Session hijacking indicator
Error Code 50076
MFA required but not provided
MEDIUM - Possible MFA bypass attempt
Error Code 0
Successful authentication
Normal successful login (validate carefully only when paired with suspicious failures)
Error Code 50053
Account locked or malicious IP
HIGH - Brute force attempts
Error Code 50074
MFA challenge not passed
HIGH - User failed MFA
Error Code 500121
MFA prompt timeout
MEDIUM - Possible MFA fatigue indicator
Error Code 50133
Session revoked or SSO artifact invalid
HIGH - Session hijacking indicator
Error Code 50076
MFA required but not provided
MEDIUM - Possible MFA bypass attempt
This rule detects network traffic indicative of Kraken Ransomware activity, specifically looking for connections to Cloudflared tunnels. It identifies TLS SNI (Server Name Indication) containing '.trycloudflare.com', which is a domain used by Cloudflare for its tunnel services. This behavior is often leveraged by adversaries for command and control or data exfiltration, as it can help bypass traditional firewall rules and obscure the true destination of the traffic.
Detects the addition of a new VPN SSL Web Portal on a Fortinet FortiGate Firewall. This activity can be an indicator of an adversary establishing persistence or initial access, especially when observed in conjunction with other modifications to VPN SSL settings. Attackers might add new web portals to maintain access to the network or to create new entry points.
Detects the modification of VPN SSL Settings (for example, the modification of authentication rules).
This behavior was observed in pair with the addition of a VPN SSL Web Portal.
This behavior was observed in pair with the addition of a VPN SSL Web Portal.
This rule detects the modification of the Windows Registry to install or configure Chrome VPN extensions. Specifically, it looks for changes to the 'Software\Wow6432Node\Google\Chrome\Extensions' registry path where the 'update_url' value is set for a known list of VPN extension IDs. This method can be used by adversaries to establish persistence or gain initial access by forcing the installation of malicious or controlled VPN extensions.
Detects successful RDP logons originating from public IP addresses. This can indicate an exposed RDP port being accessed externally, potentially by an attacker.
Detects successful logon from public IP address via SMB. This can indicate a publicly-exposed SMB port.
Detects a failed logon attempt from a public IP address on a Windows system. This can indicate an attempt to gain unauthorized access, potentially through brute-force attacks or credential stuffing, especially if the system is not intended to be exposed to the internet for direct login.
This rule detects connection attempts to the SSH service running on an OpenCanary honeypot node. OpenCanary is a honeypot designed to attract and detect unauthorized access attempts. A connection attempt to an SSH service on an OpenCanary instance indicates potential reconnaissance or attack activity against the honeypot, which should be investigated as it suggests an adversary is probing for vulnerable services.
This rule detects suspicious sign-in activities that occur shortly after a network connection to an IP address associated with 'Lab539 Clickfix'. It correlates risky sign-in events from Azure Active Directory (AAD) with network connection logs from devices. Specifically, it looks for AAD sign-ins with a risk level of 30 or higher, from non-guest, non-compliant, and non-managed devices, where the IP address has not been seen for that user in the last 30 days. This is then joined with network connection events to IP addresses found in the 'Lab539 Clickfix' external data, ensuring the sign-in occurs after the network connection within a short timeframe. The 'Lab539 Clickfix' reference suggests a connection to a known threat or campaign, possibly related to phishing or credential compromise.
Detects instances where an SSH service on an OpenCanary honeypot node has had a login attempt. This indicates an adversary attempting to gain unauthorized access to a system, likely through brute-force or credential stuffing attacks against the honeypot.
Detects the command line executed when TeamViewer starts a session initiated by a remote host. This rule specifically looks for the `TeamViewer_Desktop` process being launched by `TeamViewer_Service` with specific command-line arguments, indicating a remote connection. An investigator can verify connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Detects the command line executed when TeamViewer starts a session initiated by a remote host. An investigator can verify connection details by viewing the "incoming_connections.txt" log file in the TeamViewer folder.
Detects an unexpected file deletion by the dns.exe process. This activity could indicate remote code execution or other forms of exploitation, potentially related to vulnerabilities like CVE-2020-1350 (SigRed), where an attacker might manipulate DNS server files.
Detects an unexpected process spawning from dns.exe, which may indicate activity related to remote code execution or other forms of exploitation, specifically referencing CVE-2020-1350 (SigRed). The rule filters out legitimate child processes like conhost.exe.
This rule detects login attempts against the Telnet service running on an OpenCanary honeypot. OpenCanary is designed to attract and detect unauthorized access attempts, so any login attempt to its Telnet service indicates potential malicious activity or reconnaissance against the honeypot.
Detects the execution of ScreenConnect, a legitimate remote access tool, when it is used to establish a remote access session. The rule specifically looks for command-line arguments indicative of a guest connection to a ScreenConnect session.
Detects suspicious command execution by child processes of the GoAnywhere Managed File Transfer (MFT) application, which may indicate exploitation such as CVE-2025-10035. This behavior is indicative of post-exploitation activity related to CVE-2025-10035, as observed in campaigns by the threat actor Storm-1175.
Page 11 of 14