Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,310 detections
Filters
Last updated
All Time
Detection languages
682
264
155
72
49
Contributors
237
195
187
166
110
Categories
345
308
229
217
143
Platforms
472
424
224
173
144
Products / Services
264
262
200
176
104
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,310
CVEs
5
4
3
3
3
IDS Classtypes
103
67
24
23
12
IDS Protocols
167
51
16
14
7
This rule detects network connections, specifically DNS queries or URL hits, to the domain 'facture-in.pages.dev'. It also looks for specific, indicative language within the RemoteUrl often associated with credential harvesting or phishing landing pages (e.g., 'no_mouse', 'wrong_timezone', 'A verificar o acesso').
This rule monitors network traffic over the Telnet protocol (TCP port 23) for patterns indicative of Mirai botnet propagation. It identifies sequences of characters commonly used in Mirai brute-force attempts to guess default credentials (e.g., 'admin' followed by 'password'). The rule utilizes a threshold-based detection filter to trigger only when multiple such attempts are observed from a single source within a 60-second window, helping to filter out individual noise and focus on active scanning behavior.
Detects outbound UDP traffic over port 3478 (STUN) initiated by common web browsers. This pattern is commonly used by phishing-as-a-service (PaaS) platforms like Bluekit to perform WebRTC IP leak checks, potentially revealing a victim's real IP address behind a proxy or VPN. The rule excludes common communication platforms like Microsoft Teams, Zoom, and Webex to reduce false positives.
This rule detects potential vulnerability scanning activity by identifying devices making multiple successful network connections to specific ports commonly used by vulnerability scanners (8834, 8889, 1241). A device is flagged if it makes 3 or more such connections within a one-hour window.
Detects anomalous network traffic from svchost.exe processes exhibiting suspicious behavior indicative of DcRAT, specifically reconnaissance activities that involve gathering system information and security product details for exfiltration to a Command and Control (C2) server.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails containing financial keywords sent to sensitive finance/accounting roles from domains that have not been observed in the last 180 days. It then correlates this email event with subsequent device-level network activity involving banking or financial URLs initiated by the recipient user, which may indicate follow-up reconnaissance or unauthorized access.
Detects read access attempts to the 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion' registry key. Adversaries often query this key during the reconnaissance phase to identify the specific version, build number, and installation details of the host operating system, which aids in tailoring further exploitation or post-exploitation activities.
This rule detects HTTP POST requests containing common credential field names directed at files ending in .php (such as login.php, result.php, or index.php), which is highly characteristic of phishing kits used to harvest credentials.
This rule detects potential Business Email Compromise (BEC) attempts by identifying emails containing financial keywords sent to sensitive finance/accounting roles from domains that have not been observed in the last 180 days. It then correlates this email event with subsequent device-level network activity involving banking or financial URLs initiated by the recipient user, which may indicate follow-up reconnaissance or unauthorized access.
Detects suspicious network connections to 'outlook-one.vercel.app' or 'api.telegram.org' when initiated by common web browsers (msedge.exe, chrome.exe, firefox.exe) or Outlook (outlook.exe). This pattern can indicate phishing attempts, credential harvesting, or data exfiltration via Telegram bots.
This rule detects instances where a user clicks on a URL identified as potentially malicious (phishing-related) and subsequently has a risky sign-in event in Azure AD. The rule correlates URL click events from email with Azure AD sign-in logs, specifically looking for sign-ins marked as risky or originating from suspicious user agents (e.g., specific axios versions). The phishing URLs are identified by keywords such as 'azureapplicationregistration.pages.dev', 'chrnobinson.com', 'workers.dev', '.pages.dev', '.web.core.windows.net', '/oauth2/v2.0/authorize', 'client_id=', and 'scope=openid'.
This rule monitors for security alerts related to Azure AI services, specifically detecting credential theft attempts and LLM jailbreak attempts that have been blocked or detected by Azure's built-in content filtering mechanisms.
Detects use of Google search operators for target site reconnaissance
This rule detects mass scanning activity targeting FortiGate SSL VPN login endpoints on non-standard HTTPS ports (4433, 4443, 8443, 9443, 10443, 541). It specifically looks for HTTP requests containing '/login' in the URI, indicating an attempt to find or interact with the VPN login page. The rule uses a threshold to identify mass scanning, triggering an alert if a source IP makes 10 or more such requests within 60 seconds.
This rule detects the execution of common security reconnaissance and enumeration tools (e.g., subfinder, nuclei, gobuster, httpx) or suspicious Python scripts typically associated with scanning and discovery activities. It uses Sysmon Process Creation events and flags instances where high-volume scanning parameters are used or where multiple distinct tools or executions are observed on a single host.
Detects suspicious network connections to 'outlook-one.vercel.app' or 'api.telegram.org' when initiated by common web browsers (msedge.exe, chrome.exe, firefox.exe) or Outlook (outlook.exe). This pattern can indicate phishing attempts, credential harvesting, or data exfiltration via Telegram bots.
This rule detects potential phishing attempts by identifying emails where the sender's address contains international (Cyrillic) characters that look similar to Latin characters (homoglyphs) and the subject line contains keywords often associated with phishing, such as 'verify', 'confirm', or 'urgent'. This combination suggests an attempt to spoof legitimate domains using visual deception.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
This rule detects the execution of processes with command lines containing keywords associated with common vulnerability scanners such as 'scanner', 'nessus', or 'qualys'. It aggregates these events by computer and account over one-hour intervals to identify potential vulnerability scanning activity within the environment.
Detects anomalous, unauthenticated access to API endpoints commonly associated with table enumeration, often targeting ServiceNow interfaces or similar REST APIs. The rule monitors for a high volume of unique API paths or tables requested by a single IP address without an authorization token present, as well as tracking access from known malicious IP addresses.
This rule monitors network traffic over the Telnet protocol (TCP port 23) for patterns indicative of Mirai botnet propagation. It identifies sequences of characters commonly used in Mirai brute-force attempts to guess default credentials (e.g., 'admin' followed by 'password'). The rule utilizes a threshold-based detection filter to trigger only when multiple such attempts are observed from a single source within a 60-second window, helping to filter out individual noise and focus on active scanning behavior.
Page 28 of 63