Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12,587 detections
Filters
Last updated
All Time
Detection languages
5,139
3,901
1,034
828
478
Contributors
2,488
1,655
1,442
1,408
970
Categories
3,446
1,826
1,661
1,578
1,417
Platforms
8,041
1,889
1,335
1,053
778
Products / Services
1,979
1,796
1,633
1,096
1,041
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
21
21
21
19
14
IDS Classtypes
136
73
43
15
14
IDS Protocols
150
123
15
12
6
The following analytic detects when a Duo policy is created or updated to allow access without two-factor authentication (2FA) for users in countries other than the default. It identifies this behavior by searching Duo administrator activity logs for policy creation or update actions where the policy description indicates that access is permitted without 2FA for certain user locations. This is achieved by parsing the relevant fields in the logs and filtering for the specific condition of 'Allow access without 2FA.' This behavior is significant for a Security Operations Center (SOC) because bypassing 2FA for any user group or location weakens the organization's security posture and increases the risk of unauthorized access. Attackers or malicious insiders may exploit such policy changes to circumvent strong authentication controls, potentially leading to account compromise, data breaches, or lateral movement within the environment. Early detection of these policy modifications enables the SOC to investigate and respond before attackers can leverage the weakened controls, thereby reducing the risk and impact of a successful attack.
The following analytic identifies instances where a Duo administrator creates or updates a policy to explicitly deny user access within the Duo environment. It detects this behavior by searching Duo administrator activity logs for policy creation or update actions where the authentication status is set to "Deny access." By correlating these events with user and admin details, the analytic highlights potential misuse or malicious changes to access policies. This behavior is critical for a SOC to monitor, as unauthorized or suspicious denial of access policies can indicate insider threats, account compromise, or attempts to disrupt legitimate user access. The impact of such an attack may include denial of service to critical accounts, disruption of business operations, or the masking of further malicious activity by preventing targeted users from accessing resources. Early detection enables rapid investigation and remediation to maintain organizational security and availability.
The following analytic detects when a Duo policy is created or updated to allow the use of outdated Java versions, which can introduce significant security risks. It works by searching Duo administrator activity logs for policy creation or update actions where the policy explicitly sets 'java_remediation' to 'no remediation', indicating that no restrictions are enforced against old Java. The analytic aggregates relevant details such as the user, admin email, and action context for further investigation. Identifying this behavior is critical for a Security Operations Center (SOC) because allowing outdated Java can expose an organization to known vulnerabilities, malware, and exploitation techniques. Attackers or malicious insiders may attempt to weaken security controls by modifying policies to permit insecure software, increasing the risk of compromise. Prompt detection enables SOC analysts to respond quickly, revert risky changes, and mitigate potential threats before they are exploited.
The analytic detects when a Duo policy is created or updated to allow devices without a screen lock requirement. It identifies this behavior by searching Duo administrator activity logs for policy creation or update events where the 'require_lock' setting is set to false. This action may indicate a weakening of device security controls, potentially exposing the organization to unauthorized access if devices are lost or stolen. For a Security Operations Center (SOC), identifying such policy changes is critical, as attackers or malicious insiders may attempt to lower authentication standards to facilitate unauthorized access. The impact of this attack could include increased risk of credential compromise, data breaches, or lateral movement within the environment due to reduced device security requirements.
This detection identifies when the legitimate application DingTalk.exe loads a DLL from a non-standard file path. This behavior is associated with the SLOW#TEMPEST campaign, which uses this DLL sideloading technique to execute its malicious payload.
This rule detects a specific DLL hash (3583cc881cb077f97422b9729075c9465f0f8f94647b746ee7fa049c4970a978) associated with the SLOW#TEMPEST campaign. This file is a DLL that contains an encrypted payload. The rule searches for this hash in both executed processes and files on disk.
Detects the creation of "spinstall0.aspx", a file dropped after the successful exploitation of the SharePoint vulnerability CVE-2025-53770. This file is a known webshell.
The analytic detects when a Duo policy is created or updated to allow tampered or rooted devices, such as jailbroken smartphones, to access protected resources. It identifies this behavior by searching Duo administrator activity logs for policy changes where the allow_rooted_devices setting is enabled. This is accomplished by filtering for policy creation or update actions and parsing the policy description for the relevant configuration. Allowing tampered devices poses a significant security risk, as these devices may bypass built-in security controls, run unauthorized software, or be more susceptible to compromise. For a Security Operations Center (SOC), identifying such policy changes is critical because it may indicate either a misconfiguration or a malicious attempt to weaken authentication requirements, potentially enabling attackers to access sensitive systems with compromised devices. The impact of this attack can include unauthorized access, data breaches, and lateral movement within the environment, making prompt detection and response essential to maintaining organizational security.
Scan for 18 malicious extensions
This detection identifies the creation or modification of the "spinstall0.aspx" webshell file in Microsoft SharePoint directories. This file is a known indicator of compromise associated with the exploitation of CVE-2025-53770 (ToolShell vulnerability). Attackers exploit the vulnerability to drop webshells that provide persistent access to compromised SharePoint servers, allowing them to execute arbitrary commands, access sensitive data, and move laterally within the network.
Detects the creation of new scheduled tasks through Schtasks.exe, specifically those invoking OpenSSH, which could indicate an attempt to establish a reverse SSH tunnel to a remote attacker's server.
This detection identifies when Microsoft Teams applications send messages to groups / users in your organization's tenant. It utilizes the 'BotAddedToTeam' and 'AppInstalled' action types from CloudAppEvents to collect all Teams applications created in the specified timeframe and then joins on MessageEvents, matching events where SenderObjectId equals AppGuid.
This activity is significant as it may uncover unverified applications being added to teams channels and communicating with users in your tenant. Teams application security, compliance, and permissions can be reviewed in the Microsoft Teams Admin portal -
https://admin.teams.microsoft.com/policies/manage-apps/
This activity is significant as it may uncover unverified applications being added to teams channels and communicating with users in your tenant. Teams application security, compliance, and permissions can be reviewed in the Microsoft Teams Admin portal -
https://admin.teams.microsoft.com/policies/manage-apps/
This rule detects attempts to modify the local Administrators group using the 'net localgroup administrators' command. This command is often used by adversaries to add users to the local administrators group for privilege escalation or persistence.
Looking for strings entered into and executed from the Windows run box, which is leveraged by ClickFix campaigns for initial access.
Looking modifications to the Windows Registry's 'RunMRU' key, which stores the history of commands executed via the 'Run' dialog box (Windows Key + R), we can detect when new run box commands are executed.
Looking modifications to the Windows Registry's 'RunMRU' key, which stores the history of commands executed via the 'Run' dialog box (Windows Key + R), we can detect when new run box commands are executed.
This analytic detects exploitation activity of CVE-2025-5777 using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where Snort signature 65118 (Citrix NetScaler memory overread attempt) is triggered. If confirmed malicious, this behavior is highly indicative of a potential exploitation of CVE-2025-5777.
This detection identifies failed file download attempts on ESXi hosts by looking for specific error messages in the system logs. These failures may indicate unauthorized or malicious attempts to install or update components—such as VIBs or scripts
This detection identifies potential exploitation attempts of CVE-2025-5777 (CitrixBleed 2), a memory disclosure vulnerability in Citrix NetScaler ADC and Gateway. The vulnerability is triggered by sending POST requests with incomplete form data to the /p/u/doAuthentication.do endpoint, causing the device to leak memory contents including session tokens and authentication materials. This search looks for POST requests to the vulnerable endpoint that may indicate scanning or exploitation attempts.
This detection identifies the creation, deletion, or modification of a local user account on an ESXi host. This activity may indicate unauthorized access, indicator removal, or persistence attempts by an attacker seeking to establish or maintain control of the host.
Detects the HazyBeacon backdoor, which leverages AWS Lambda URLs for C2 communication and uses custom tools for data exfiltration. The rule identifies known malicious file hashes, suspicious tool drops in C:\ProgramData, specific service creation commands for persistence, and network connections from the sideloaded host process (mscorsvw.exe) to AWS Lambda URLs.
Detects a non-interactive sign-in using a refresh token for the Microsoft Authentication Broker client, targeting the Device Registration Service (DRS) with the 'adrs_access' scope. This specific combination of attributes is highly indicative of an adversary using tools like ROADtools to register a malicious device in the tenant following a successful OAuth phishing attack.
Detects the successful registration of a new FIDO2/WebAuthn security key for a user account. This activity can be legitimate, but attackers who have compromised an account may register their own FIDO key to maintain persistent access. This activity should be correlated with other suspicious events, such as a recent password reset or login from an unusual location.
Page 464 of 600