Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,310 detections
Filters
Last updated
All Time
Detection languages
682
264
155
72
49
Contributors
237
195
187
166
110
Categories
345
308
229
217
143
Platforms
472
424
224
173
144
Products / Services
264
262
200
176
104
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
1,310
CVEs
5
4
3
3
3
IDS Classtypes
103
67
24
23
12
IDS Protocols
167
51
16
14
7
This rule detects potential credential harvesting attempts by identifying a high volume of short-duration HTTP requests to common login, sign-in, verify, account, or authentication URI stems. It specifically looks for requests originating from user agents commonly associated with bots or scripting tools (e.g., 'bot', 'curl', 'python', 'powershell') and successful HTTP status codes (200). The 'short' session duration is inferred from small response sizes (less than 5000 bytes), suggesting automated access rather than human interaction.
This rule detects reconnaissance activity targeting sensitive employee information within Microsoft Graph. Specifically, it looks for 'Directory.Read.All' actions in Microsoft Graph events where the raw event data contains keywords like 'jobTitle' or 'displayName' and also includes terms such as 'payroll', 'hr', 'finance', or 'admin'. This combination suggests an attacker is attempting to enumerate or collect information about employees in sensitive departments, potentially for purposes like payroll hijacking or social engineering.
This rule detects reconnaissance activity targeting sensitive employee information within Microsoft Graph. Specifically, it looks for 'Directory.Read.All' actions in Microsoft Graph events where the raw event data contains keywords like 'jobTitle' or 'displayName' and also includes terms such as 'payroll', 'hr', 'finance', or 'admin'. This combination suggests an attacker is attempting to enumerate or collect information about employees in sensitive departments, potentially for purposes like payroll hijacking or social engineering.
Detects the creation of a systemd service explicitly named 'gh-token-monitor.service'. This service name is indicative of a credential harvester designed to run as a background daemon, likely targeting GitHub tokens or similar credentials.
Detects high-rate DNS queries indicating subdomain enumeration
Detects DNS AXFR zone transfer requests used for network reconnaissance
Detects high-volume email campaigns that exhibit characteristics of sophisticated phishing, including spoofed sender domains, urgent subject lines, and multiple URLs in the email body, indicative of credential harvesting attempts. The rule specifically looks for emails delivered to 'Deleted' or 'Junk' folders, from non-company domains that resemble company domains, and containing keywords often used in phishing lures.
Detects inbound emails containing Google Forms links with the '/edit?invite=' parameter. This parameter grants editor privileges and is frequently abused in data harvesting campaigns to bypass traditional email gateway URL filtering.
Detects fingerprinting of web application CMS versions for vulnerability research
Detects phishing links with credential harvesting redirects
Detects attempts to discover CDN origin servers to bypass WAF protection
Detects fingerprinting of web application CMS versions for vulnerability research
Detects phishing links with credential harvesting redirects
Detects high-rate DNS queries used for network topology and configuration discovery
This rule detects an unusually high volume (10 or more within an hour) of successful access control or role-related operations initiated by a single caller in Azure Activity logs. Such activity could indicate an adversary attempting to enumerate permissions, escalate privileges, or modify access to resources within an Azure environment.
Detects scraping of partner and vendor relationship pages for supply chain targeting
Detects execution of installers for Binance, Bybit, MEXC, MetaTrader 5, or Exodus wallets loading CRYPTBASE.dll, linked to credential theft campaigns.
Detects access to paid threat intelligence or dark web data platforms
Detects queries to internet-wide scan databases for target infrastructure reconnaissance
FOFA Internet Asset Search Query
Suricata
This rule detects HTTP requests where the host header contains 'fofa.info'. FOFA is an internet asset search engine, similar to Shodan. This detection indicates that a system within the HOME_NET is making queries to FOFA, which could be part of reconnaissance activities to gather information about internet-facing assets.
This rule detects unusual network connection patterns characterized by a high volume of connections to a remote IP address within a 5-minute window, combined with anomalous connection durations. Specifically, it flags scenarios where there are more than 1000 connections and either the 95th percentile of connection durations is very short (less than 50ms) or the 5th percentile of connection durations is very long (greater than 30000ms). These patterns can indicate activities such as network scanning, denial-of-service attempts, or command and control communication.
Page 33 of 63