Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
156 detections
Filters
Last updated
All Time
Detection languages
90
22
17
15
4
Contributors
38
20
18
12
9
Categories
60
42
30
30
23
Platforms
54
49
33
17
9
Products / Services
22
21
20
17
15
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
8
8
4
3
3
IDS Classtypes
19
2
1
IDS Protocols
8
5
4
3
2
Detects the restart action performed on a specific Azure container group named 'fr33m3' within the 'bialystok-rg' resource group. This monitors for lifecycle management activities that could be indicative of service manipulation or persistence resets.
Detects recurring kernel panic or oops events on KVM hosts occurring in rapid succession, typically within a 5-minute window. This behavioral pattern is consistent with an attacker repeatedly exploiting a race condition, such as a use-after-free (UAF) in the KVM shadow MMU, to trigger a persistent host denial-of-service.
Detects a Windows system BugCheck (Blue Screen of Death) event that occurs within two minutes of a process termination event. This behavior can be indicative of a process intentionally causing a system crash, often utilized by malware that abuses critical-process protection or attempts to evade analysis by forcing a system halt.
Detects email bombing attacks via automated subscription signups
Detects an unusually high volume (100 or more within an hour) of API calls (POST, DELETE, PUT methods to URIs containing 'api') originating from a single IP address. This activity could indicate various malicious behaviors such as brute-force attacks, credential stuffing, web application attacks, or a denial-of-service attempt against the API endpoint.
This rule monitors for recurring application crashes involving 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. Frequent crashes of these components may indicate instability, misconfiguration, or an attempt to exploit vulnerabilities within these specific file sharing services.
This rule detects Windows application crash events (Event IDs 1000 and 1001) specifically for 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. The detection triggers when the crash description contains indicators of memory-related instability, such as access violations, heap corruption, or invalid virtual calls, which may suggest exploitation attempts or service instability.
Detects HTTP flood application layer DDoS attacks
This rule detects Windows application crash events (Event IDs 1000 and 1001) specifically for 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. The detection triggers when the crash description contains indicators of memory-related instability, such as access violations, heap corruption, or invalid virtual calls, which may suggest exploitation attempts or service instability.
This rule monitors for recurring application crashes involving 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. Frequent crashes of these components may indicate instability, misconfiguration, or an attempt to exploit vulnerabilities within these specific file sharing services.
This rule detects a high volume (50 or more) of HTTP errors (status codes 400 and above) originating from a single client IP address within a 5-minute time window. This behavior can be indicative of various malicious activities such as brute-force attacks, web application vulnerability scanning, or denial-of-service attempts against a web server.
This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.
Detects repeated restarts of vLLM pods (due to OOMKilled, CrashLoopBackOff, or other failure reasons) that are correlated with a burst of multimodal requests. This pattern can indicate a denial-of-service attack, resource exhaustion, or exploitation of vulnerabilities (such as CVE-2026-22778) targeting the vLLM service, potentially leading to service instability or compromise.
This rule detects potential exploitation of CVE-2026-4892 by correlating inbound DHCPv6 traffic (UDP/547) with a dnsmasq process crash (SIGSEGV/SIGABRT exit codes 132, 134, 135, 139) on the same host within a 60-second window. This vulnerability involves sending crafted DHCPv6 messages with oversized Client Identifier options to a dnsmasq server configured with --dhcp-script, leading to a denial of service.
Detects SSL/TLS handshake flood for service exhaustion attacks
Detects instances where a specific identity or caller triggers Azure Function or Logic App workflows at a high volume (more than 50 successful invocations within a 5-minute window). This threshold may indicate automated exploitation, potential brute-force attempts on API endpoints, or a misconfigured/malfunctioning service causing excessive resource usage.
Detects instances where a specific identity or caller triggers Azure Function or Logic App workflows at a high volume (more than 50 successful invocations within a 5-minute window). This threshold may indicate automated exploitation, potential brute-force attempts on API endpoints, or a misconfigured/malfunctioning service causing excessive resource usage.
This rule detects Windows application crash events (Event IDs 1000 and 1001) specifically for 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. The detection triggers when the crash description contains indicators of memory-related instability, such as access violations, heap corruption, or invalid virtual calls, which may suggest exploitation attempts or service instability.
This rule monitors for recurring application crashes involving 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. Frequent crashes of these components may indicate instability, misconfiguration, or an attempt to exploit vulnerabilities within these specific file sharing services.
Detects segmentation faults or memory corruption crashes in vLLM components associated with media decoding, indicated by specific keywords in syslog messages. This rule aims to identify potential exploitation attempts related to CVE-2026-22778.
Detects a sequence of events where a Protected Process Light (PPL) security process attempts to load a DLL from a non-standard path and then terminates shortly after. This pattern is a strong indicator of the EDRStartupHinder technique, where a critical system DLL is redirected to an invalid copy, causing the PPL process to fail its integrity check and self-terminate.
Page 4 of 8