Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12,583 detections
Filters
Last updated
All Time
Detection languages
5,139
3,901
1,034
828
476
Contributors
2,488
1,655
1,442
1,408
970
Categories
3,444
1,825
1,661
1,578
1,416
Platforms
8,040
1,889
1,334
1,053
778
Products / Services
1,979
1,796
1,633
1,096
1,041
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
21
21
21
19
14
IDS Classtypes
136
73
43
15
14
IDS Protocols
150
123
15
12
6
Detects configuration changes to the PAM platform itself. Vault configuration governs
who may retrieve which credentials and what is recorded; altering it is how an
attacker grants themselves durable privileged access while suppressing the evidence
of having done so.
Changes made by an account that does not normally administer the vault are the ones
worth escalating.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='PAM360' and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip, role
who may retrieve which credentials and what is recorded; altering it is how an
attacker grants themselves durable privileged access while suppressing the evidence
of having done so.
Changes made by an account that does not normally administer the vault are the ones
worth escalating.
Onboarding: PAM360 is ingested via Syslog (Bloo extractor 879).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=configuration where sourcename='PAM360' and action='CONFIGURATION_CHANGED'
| groupby user, config, srcip, role
Detects a process launch whose command line both references a cron persistence path (crontab, /etc/cron.d/, /etc/crontab, /etc/cron.{hourly,daily,weekly,monthly}/, /var/spool/cron/crontabs/) and contains a download-and-execute or reverse-shell marker (curl/wget piped to a shell, /dev/tcp/ redirection, base64-decoded payload, nc -e) or installs the crontab from a file staged under /tmp/. Attackers commonly install a scheduled cron entry so a malicious command re-executes on a fixed interval, surviving reboots and process kills (T1053.003).
Detects modification of core Ivanti Connect Secure system files on the
appliance. Attackers patch shared libraries and Perl modules such as
/home/lib/libdsplibs.so and /home/perl/DSUpgrade.pm to install an implant that is
loaded by legitimate services, blending malicious code into normal appliance
operation and surviving reboots.
appliance. Attackers patch shared libraries and Perl modules such as
/home/lib/libdsplibs.so and /home/perl/DSUpgrade.pm to install an implant that is
loaded by legitimate services, blending malicious code into normal appliance
operation and surviving reboots.
Detects potential Linux privilege escalation and persistence activities by monitoring for the creation of persistence scripts in post_boot.d, modifications to the sudoers.template file appending NOPASSWD, or system configuration rebuilds shortly after sudoers template changes.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Detects potential web shell activity where a web or application server process (such as IIS, Apache, Nginx, or Tomcat) writes a script file (e.g., .aspx, .jsp, .php) into a web-accessible directory, followed shortly by spawning a command-line shell or utility process.
Define a baseline threshold for failed sign-ins due to Conditional Access failures
Detects potential DLL sideloading of DLLs that are part of antivirus software suchas McAfee, Symantec...etc
Detects creation of a new local administrative account on or through a
BeyondTrust Remote Support / Privileged Remote Access appliance. Post-exploitation of
the pre-auth vulnerability, attackers create local admin accounts (T1136.001) to
maintain persistent access to the appliance and connected managed endpoints.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
BeyondTrust Remote Support / Privileged Remote Access appliance. Post-exploitation of
the pre-auth vulnerability, attackers create local admin accounts (T1136.001) to
maintain persistent access to the appliance and connected managed endpoints.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
Lists accounts that still sign in successfully with Authenticated SMTP over the last 30 days. Microsoft plans to disable Basic auth for SMTP AUTH by default for existing tenants at the end of December 2026.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
Rows come from SigninLogs and AADNonInteractiveUserSignInLogs, grouped per account with source IP count, apps and first and last seen.
Triage: Find the owner of each account, then move the sender to OAuth or a mail relay before the change. Inventory query, not an alert.
Limitations: Covers only sign-ins that reach the logs. Cross check with the Exchange admin center SMTP AUTH Clients Submission Report, which keeps 90 days.
Detects the VS Code CLI (code-insiders / code) being used to install a remote tunnel as a service, run from outside normal application install locations (e.g. the Windows debug folder). Keyed on the tunnel service install behavior and unusual location rather than a specific file path, so renamed or relocated copies still match. Abuse enables covert remote access via Microsoft tunnel infrastructure. Rotation test: still fires if the actor changes the directory, flags order or infrastructure, as long as the binary is run with tunnel + service install outside standard paths.
Detects modification or creation of .htaccess files within WordPress directory structures followed within 24 hours by the creation or modification of .cache files in the same directory. This behavioral pattern is often indicative of web shell deployment or persistence installation via compromised web applications.
Detects external inbound FortiGate Fabric Management Protocol (FGFM) traffic on TCP port 541 followed by a FortiGateCloud administrative configuration download, backup, or running-config event on the same FortiGate device within a one-hour window, potentially indicating unauthorized configuration access or device compromise.
The following analytic detects when a unprivileged user changes an Admin accounts password. This is a common artifact of successful exploitation of the BlueHammer Windows Defender privilege escalation. The attacker's process momentarily changes the passwords of high-value local accounts including the built-in Administrator to spawn an authenticated shell session, then immediately reverts the passwords to avoid detection. This uses EventID 4723 to log this activity.
The following analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. Utilities in the lookup include AnyDesk, GoToMyPC, LogMeIn, TeamViewer and much more. Review the lookup for the entire list and add any others.
Detects post-exploitation activities associated with FortiMail vulnerability CVE-2026-104286 (FG-IR-26-175). The rule identifies potential unauthorized persistence and data exfiltration, including the creation or modification of archive accounts with remote destinations, execution of 'migadmin' via root cron, and specific admin logout anomalies.
Detects hosts exhibiting multiple persistence mechanisms (Run keys, Scheduled Tasks, and Windows Services) within a short timeframe, indicating potential adversary persistence setup.
Detects the creation of persistence artifacts associated with the 'gh-token-monitor' service utilized by the Shai-Hulud worm across Linux systemd user services, macOS LaunchAgents, and Windows scheduled tasks or local application directories. This service acts as a dead-man's switch designed to wipe the user's home directory if the stolen GitHub token is revoked.
Detects creation of Windows registry hive files (ntuser.dat or UsrClass.dat) outside the expected user profile path hierarchy. LegacyHive writes a modified ntuser.dat to a GUID-named staging directory at C:\\ root (e.g. C:\\{GUID}\\ntuser.dat) and copies UsrClass.dat there as well to set up the oplock-based race condition. Any hive file materialising outside C:\\Users\\ or C:\\Windows\\ is a strong indicator of this exploit chain or equivalent offline hive manipulation.
Detects post-exploitation activity against Ivanti ICS / Connect Secure
appliances on Windows hosts, where a script host (cmd.exe, powershell.exe, w3wp.exe)
drops a web shell (.aspx/.ashx/.asmx) into the appliance WebRoot or reaches into the
CredentialStore / system binaries. These behaviors are the hallmark of attackers
converting an authenticated file-write or SSRF into persistent remote code execution
and credential theft on edge devices.
appliances on Windows hosts, where a script host (cmd.exe, powershell.exe, w3wp.exe)
drops a web shell (.aspx/.ashx/.asmx) into the appliance WebRoot or reaches into the
CredentialStore / system binaries. These behaviors are the hallmark of attackers
converting an authenticated file-write or SSRF into persistent remote code execution
and credential theft on edge devices.
Detects creation or modification of cron entries on the BeyondTrust
Remote Support / Privileged Remote Access appliance. After exploiting the pre-auth
vulnerability, attackers establish recurring execution for persistence and C2
beaconing via cron (T1053.003) on the Linux-based appliance.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
Remote Support / Privileged Remote Access appliance. After exploiting the pre-auth
vulnerability, attackers establish recurring execution for persistence and C2
beaconing via cron (T1053.003) on the Linux-based appliance.
Follows CISA's urgent patch advisory for BeyondTrust appliances.
Page 9 of 600