Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,613 detections
Filters
Last updated
All Time
Detection languages
1,725
690
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
728
629
473
Platforms
2,069
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
3,613
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects large data transfers to removable storage media for physical exfiltration
This rule detects a Link-Local Multicast Name Resolution (LLMNR) poisoning response from a rogue host. It specifically looks for UDP traffic on port 5355 (LLMNR) where the content contains the byte sequence '|80 00|' at a depth of 4 bytes. A threshold is applied to trigger an alert if 5 such responses are observed from the same source IP within 10 seconds, indicating potential malicious activity like credential harvesting.
Detects the creation or modification of 'gh-token-monitor.sh', a script identified as part of the Miasma toolkit, used for harvesting developer credentials. This script's presence or alteration on a system indicates potential credential access attempts.
Detects the staging of the Lucid Stealer hidden self-copy loader and the SQLite CLI helper binary in the Temp directory. This rule specifically looks for file creation events in the user's Temp directory with filenames matching patterns associated with Lucid Stealer's staging activities: 'winupd_*.exe' for its self-copy loader and '_sq3e_*.exe' for its SQLite helper.
Detects the creation of specific staging archives and log files used by Lucid Stealer before exfiltration. This rule looks for 'uac.log.txt', 'lucid_err.log', or 'Data_*.zip' files being created in the user's local temporary directory.
Detects cloud resources created in rarely used geographic regions for evasion
Detects high volume Google Cloud Storage (GCS) object listing and downloads, which can indicate reconnaissance of cloud storage contents or data exfiltration. The rule aggregates operations by identity, bucket, and project ID over a one-hour period and flags activity exceeding 50 total operations.
Slack Canvas External Access & Tampering
Cortex XDR
Detects external users accessing internal Slack canvases and suspicious canvas deletion or access level changes. Canvases can contain sensitive runbooks, credentials, and organizational data, making these actions critical to monitor for potential data exfiltration or unauthorized access.
Detects creation of inbox rules to hide attacker communications from victim
Detects SMB NTLM relay attacks used for credential capture and lateral movement
Identifies the creation of '.node' payload modules by Lucid Stealer in the Common AppData folder, indicative of the SEA payload staging its remote control and theft modules. This rule specifically looks for file creation events where the file name ends with '.node' and the folder path matches a pattern under the user's local AppData 'Common' folder.
Detects access to browser profile data outside of authorized browser processes
Detects access to browser profile data outside of authorized browser processes
This rule detects users uploading a high volume of files (50 or more within an hour) to SharePoint or OneDrive. This activity could indicate data exfiltration or unauthorized mass data transfer.
Detects when a single user account creates 5 or more files within an hour that contain keywords like 'confidential', 'secret', or 'restricted' in their filenames. This behavior could indicate an attempt to stage sensitive data for exfiltration or unauthorized access to sensitive information.
Detects unauthorized access to webcam for video surveillance collection
Detects data staged on remote network shares prior to exfiltration
Detects bulk email collection via IMAP protocol for mass email harvesting
Detects bulk IMAP email collection from remote mail servers
Detects rogue DHCP server used for credential interception via DNS spoofing
Detects creation of large archives used to stage data for exfiltration
Page 119 of 173