Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,310 detections
Filters
Last updated
All Time
Detection languages
682
264
155
72
49
Contributors
237
195
187
166
110
Categories
345
308
229
217
143
Platforms
472
424
224
173
144
Products / Services
264
262
200
176
104
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,310
CVEs
5
4
3
3
3
IDS Classtypes
103
67
24
23
12
IDS Protocols
167
51
16
14
7
Detects queries to IP lookup services used by FlexibleFerret for victim identification.
Detects outbound HTTP GET requests consistent with Lumma Stealer's browser fingerprinting activity. This activity involves contacting a C2 endpoint at '/api/set_agent' with specific URL parameters ('id', 'token', 'description') to register the victim and gather system information.
This rule detects inbound HTTP requests containing the User-Agent string 'Salesforce-CLI/1.0'. This activity is considered suspicious as it may indicate reconnaissance or data theft attempts targeting Salesforce instances, potentially leveraging compromised credentials or systems. The presence of this specific User-Agent inbound to a network could be an indicator of malicious activity, as Salesforce CLI is typically used by developers and administrators for managing Salesforce organizations and is not expected to be seen in inbound traffic from external networks to internal systems.
ET INFO Blockchain RPC Domain in DNS Lookup (api .avax .network)
ET INFO Blockchain RPC Domain in DNS Lookup (mainnet .infura .io)
Detects suspicious access to multiple Azure Storage Accounts using a Shared Access Signature (SAS) token from a single external IP address. This pattern can indicate the use of a compromised, potentially overly permissive, SAS token for reconnaissance or lateral movement.
Detects attempts to export user permission data from Bitbucket, which could indicate reconnaissance or data collection activities by an adversary.
This rule detects attempts to export user details from Bitbucket, including successful exports, failed attempts, and the initiation of such exports. This activity could indicate an adversary attempting to collect sensitive user information for further reconnaissance or data exfiltration.
Detects the execution of TruffleHog, an open-source tool used for scanning repositories for secrets and sensitive information, within an AWS environment. This activity can indicate credential harvesting by threat actors. All detections should be investigated to determine if the usage is authorized by security teams or potentially malicious.
Detects the use of TruffleHog for AWS credential validation by identifying GetCallerIdentity API calls where the userAgent indicates TruffleHog. Threat actors leverage TruffleHog to enumerate and validate exposed AWS keys. Successful exploitation allows threat actors to confirm the validity of compromised AWS credentials, facilitating further unauthorized access and actions within the AWS environment.
Detects the execution of TruffleHog, a tool designed to search for secrets across various platforms such as Git, Jira, Slack, and SharePoint. While TruffleHog is a legitimate tool often used in CI pipelines and security assessments, its execution can also indicate malicious activity, as observed in campaigns like Shai-Hulud targeting npm packages to steal sensitive information. The rule triggers on the execution of 'trufflehog.exe' or when its command line arguments indicate searching specific platforms or verifying results.
This rule detects the execution of TruffleHog, a tool designed to find secrets in various platforms such as Git, GitHub, Jira, Slack, Confluence, SharePoint, Docker images, and cloud storage services like S3 and GCS. While TruffleHog is a legitimate tool often used in CI pipelines and security assessments, its execution can also indicate malicious activity, as observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information. The rule triggers on either the image name ending with '/trufflehog' or a combination of command-line arguments indicating its use to scan specific platforms and the '--results=verified' flag.
Detects network connections to the InterPlanetary File System (IPFS) where the URI contains a pattern indicative of an email address. This behavior is associated with recent phishing campaigns that leverage IPFS to host credential harvesting webpages, attempting to collect user credentials.
Detects user data export activity.
Detects user permission data export attempt.
Detects abnormal network activity and connectivity issues in Ollama including non-localhost API access attempts and warning-level network errors such as DNS lookup failures, TCP connection issues, or host resolution problems that may indicate network-based attacks, unauthorized access attempts, or infrastructure reconnaissance activity.
Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks.
This rule detects URLs that contain common redirection or link parameters (u=, url=, redirect=, r=, link=, target=, dest=) where the value of the parameter is a long, alphanumeric string that appears to be an encoded domain. This pattern can indicate attempts to obfuscate the true destination of a link, often seen in phishing campaigns or malicious redirection attempts. The rule specifically looks for encoded parameters containing common top-level domains like .com, .net, or .org.
This rule detects instances where a user clicks on a URL identified as potentially malicious (phishing-related) and subsequently has a risky sign-in event in Azure AD. The rule correlates URL click events from email with Azure AD sign-in logs, specifically looking for sign-ins marked as risky or originating from suspicious user agents (e.g., specific axios versions). The phishing URLs are identified by keywords such as 'azureapplicationregistration.pages.dev', 'chrnobinson.com', 'workers.dev', '.pages.dev', '.web.core.windows.net', '/oauth2/v2.0/authorize', 'client_id=', and 'scope=openid'.
The following analytic identifies processes loading Mozilla NSS-Mozglue libraries such as mozglue.dll and nss3.dll. It leverages Sysmon Event logs, specifically monitoring EventCode 7, which tracks image loaded events. This activity is significant because it can indicate unauthorized access or manipulation of these libraries, which are commonly used by Mozilla applications like Firefox and Thunderbird. If confirmed malicious, this could lead to data exfiltration, credential theft, or further compromise of the system.
This rule identifies Cisco network devices within Microsoft Defender for Endpoint (MDE) telemetry that are running Cisco IOS or Cisco XE operating systems, excluding version '17.15.4a'. The exclusion of a specific OS version suggests the rule is designed to pinpoint devices that may be vulnerable to a known security flaw, potentially CVE-2025-20352 as indicated by the rule's title. It helps in mapping exposure to specific vulnerabilities by identifying potentially unpatched or vulnerable network infrastructure components.
Page 46 of 63