Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,310 detections
Filters
Last updated
All Time
Detection languages
682
264
155
72
49
Contributors
237
195
187
166
110
Categories
345
308
229
217
143
Platforms
472
424
224
173
144
Products / Services
264
262
200
176
104
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,310
CVEs
5
4
3
3
3
IDS Classtypes
103
67
24
23
12
IDS Protocols
167
51
16
14
7
Detects network activity associated with Adversary-in-the-Middle (AiTM) phishing kits that perform client-side fingerprinting and geolocation tracking. The rules identify the initial fingerprinting request, the subsequent setting of a geolocation cookie by the proxy, and the query to a third-party geolocation service, using state tracking to correlate the chain of events.
Detects high-volume account enumeration activity associated with the TeamFiltration tool, characterized by the use of legacy Microsoft Teams desktop client User-Agent strings (specific versions of Teams, Electron, and Chrome) within a short time window.
Detects adversary-in-the-middle (AiTM) phishing activity utilizing reverse-proxy kits (such as Evilginx2, EvilProxy, or Modlishka) to bypass MFA. The rule identifies suspicious login requests by correlating common identity provider login paths with missing security headers (CSP/HSTS) and anomalous server or hostname characteristics typical of proxied phishing infrastructure.
Detects Browser-in-the-Browser (BitB) phishing pages by inspecting web proxy or EDR-captured page content for malicious HTML/JS structures. The rule identifies fabricated browser chrome, such as fake address bars and title bars, initialized via window.open with specific dimensions, while ensuring the serving domain is not a known, legitimate identity provider.
Detects network activity related to the exploitation of the CVE-2025-31702 vulnerability in Dahua P2P Relay services. The rules monitor for probe attempts, device parameter fetching (randsalt), serial number enumeration bursts, and successful no-auth channel responses, indicating a bypass of authentication mechanisms on vulnerable Dahua devices.
Detects incoming HTTP requests where the 'pagename' parameter contains directory traversal sequences (e.g., '../', '..%2f'). These attempts are typically indicative of automated vulnerability scanning or exploitation attempts targeting WordPress page-template resolution logic, specifically related to CVE-2026-87902.
Detects high-volume account existence checks targeting the Microsoft Teams API. The rule identifies anomalous authentication attempts characterized by the use of outdated Electron/Chrome user-agent strings associated with the TeamFiltration tool, specifically targeting the Microsoft Teams API AppId (1fec8e78-bce4-4aaf-ab1b-5451cc387264).
Detects high-volume account existence checks targeting the Microsoft Teams API. The rule identifies anomalous authentication attempts characterized by the use of outdated Electron/Chrome user-agent strings associated with the TeamFiltration tool, specifically targeting the Microsoft Teams API AppId (1fec8e78-bce4-4aaf-ab1b-5451cc387264).
Detects non-browser automated HTTP clients (e.g., Python, Wget, Curl, Scrapy) downloading audio/video files from corporate public-facing pages such as Investor Relations, Press Releases, and Executive profiles. This activity is indicative of malicious reconnaissance used to harvest voice or video samples for synthetic media (deepfake) creation for future social engineering or impersonation attacks.
This rule detects email activity containing keywords related to SSO or passkey updates combined with urgent terminology and support request language. This pattern is commonly indicative of phishing attempts aimed at stealing credentials or tricking users into providing sensitive information.
This rule detects potential quishing (QR code phishing) attempts by identifying emails with one or more image attachments and minimal URL content, followed by a risky user authentication event within a 3-hour window. This behavior is indicative of an attacker attempting to harvest credentials via a malicious QR code that redirects the user to a phishing site.
This rule detects potential quishing (QR code phishing) attempts by identifying emails with one or more image attachments and minimal URL content, followed by a risky user authentication event within a 3-hour window. This behavior is indicative of an attacker attempting to harvest credentials via a malicious QR code that redirects the user to a phishing site.
This rule detects suspicious PowerShell activity involving the enumeration and manipulation of COM objects and .NET assemblies, patterns often associated with reconnaissance or post-exploitation activities. It flags instances where PowerShell scripts utilize specific command-line arguments (e.g., Get-ComDatabase, Get-ComClass, Import-Win32Module, NtObjectManager) in conjunction, suggesting automated discovery of COM infrastructure or assembly loading.
Detects the use of OleViewDotNet or NtObjectManager PowerShell tools to enumerate running COM host processes (e.g., dllhost.exe) and check for the absence of specific security mitigations like EOAC_NO_CUSTOM_MARSHAL or COMGLB_UNMARSHALING_POLICY_STRONG. This behavior is indicative of reconnaissance activity aimed at identifying targets for fake-marshaled CoGetInstanceFromIStorage exploit chains.
Detects the presence of a specific Russian-language error string ("Не удалось сгенерировать HWID") within binary files, which is characteristic of the HWID generation mechanism used by Vidar Stealer malware.
This rule detects a potential vishing attack by correlating suspicious IT helpdesk requests (e.g., password or MFA reset without manager approval or verified callback) with subsequent sensitive Entra ID identity changes (e.g., self-service password resets, MFA device registration, or new device registration) occurring for the same user within a short time window. This activity is indicative of an attacker attempting to social-engineer helpdesk staff to bypass authentication controls and compromise a user account.
This rule detects reconnaissance activity targeting Azure App Service instances, specifically looking for attempts to access web-shell-like files, WordPress administration paths, PHP-CGI endpoints, or LangFlow code validation paths. It identifies potential Storm-3168 actor infrastructure through known IOCs or through patterns of high-volume, path-diverse HTTP requests that deviate from typical noise, helping to distinguish targeted probing from common internet background scanning.
Detects instances where a Node.js process spawns another Node.js process as a child. This behavior is often associated with malicious npm packages attempting to evade detection during runtime execution or executing secondary malicious payloads.
Detects anomalous SharePoint search activity that uses 'indexdocid' queries targeting specific site or web content classes. This pattern is often indicative of automated reconnaissance or enumeration of documents within a SharePoint environment, potentially attempting to bypass standard UI navigation to identify or access sensitive content.
This rule detects network connections or DNS requests to domains specifically structured to impersonate MFA registration, passkey setup, or SSO login pages. These domain patterns are commonly associated with phishing campaigns intended to harvest credentials, session tokens, or bypass multi-factor authentication (AiTM phishing).
Detects high-frequency connection attempts to SMB (445) or RDP (3389) ports originating from a single source, which is characteristic of the SoftPerfect Network Scanner (NetScan) tool performing reconnaissance or network discovery sweeps.
Page 10 of 63