Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,310 detections
Filters
Last updated
All Time
Detection languages
682
264
155
72
49
Contributors
237
195
187
166
110
Categories
345
308
229
217
143
Platforms
472
424
224
173
144
Products / Services
264
262
200
176
104
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,310
CVEs
5
4
3
3
3
IDS Classtypes
103
67
24
23
12
IDS Protocols
167
51
16
14
7
This rule detects network activity and cloud API events indicative of an adversary utilizing the VAPI.ai platform to orchestrate automated voice-phishing (vishing) campaigns. It correlates outbound network connections to VAPI.ai endpoints with specific webhook callback patterns used to track call status for victim records.
Detects Microsoft Graph API requests targeting user information endpoints (/v1.0/users or /v1.0/me) using specific search filters associated with payroll or human resources and identified by the Axios HTTP client User-Agent string. This pattern is consistent with reconnaissance activities.
Detects a specific multi-stage exfiltration pattern characterized by initial reconnaissance/fingerprinting probes against sensitive service endpoints (/health, /docs, /openapi.json) followed by unauthorized access to artifact storage endpoints (/files or /file?name=) from the same device against the same host within a short timeframe.
Detects a specific multi-stage exfiltration pattern characterized by initial reconnaissance/fingerprinting probes against sensitive service endpoints (/health, /docs, /openapi.json) followed by unauthorized access to artifact storage endpoints (/files or /file?name=) from the same device against the same host within a short timeframe.
Detects an abnormally high volume of POST requests from a single source to the Salesforce Aura API endpoint (/s/sfsites/aura) within a short window, which is indicative of automated guest profile enumeration and AuraInspector-style probing activity associated with the ShinyHunters Salesforce campaigns.
Detects high-frequency HTTP requests targeting Salesforce Aura endpoints associated with structural introspection, such as retrieving component definitions or field metadata. This behavior is consistent with the use of the AuraInspector reconnaissance tool to map the internal structure of a Salesforce application.
This rule detects reconnaissance activity targeting Azure App Service instances, specifically looking for attempts to access web-shell-like files, WordPress administration paths, PHP-CGI endpoints, or LangFlow code validation paths. It identifies potential Storm-3168 actor infrastructure through known IOCs or through patterns of high-volume, path-diverse HTTP requests that deviate from typical noise, helping to distinguish targeted probing from common internet background scanning.
Detects network activity associated with the FlowerStorm/Storm-1167 phishing campaign. The rule monitors for credential exfiltration to a specific malicious URI (e.g., /google.php) containing login parameters, as well as the delivery of spoofed Microsoft sign-in pages from the associated phishing infrastructure.
Detects a multi-stage attack pattern against publicly exposed AI service endpoints. The detection correlates: (1) Enumeration of sensitive AI/MCP-related API endpoints (minimum 3 distinct hits) in a 10-minute window; (2) Subsequent POST requests to AI service endpoints within 15 minutes of the enumeration; and (3) A spike of 5 or more server errors (HTTP 5xx) within 10 minutes following the POST activity. This pattern suggests automated reconnaissance followed by attempted exploitation of exposed AI model interfaces or orchestration services. Covers T1595.002, T1190
Detects the execution of multiple distinct host reconnaissance commands (e.g., systeminfo, whoami, ipconfig, AV/EDR checks, and domain enumeration) within a short window (10 minutes) originating from the same parent process. This pattern is characteristic of automated reconnaissance collection, often performed during the initial phases of an attack or as part of a C2 workflow. The rule includes exclusions for common administrative, monitoring, and RMM tools to reduce false positives.
This rule detects anomalous, high-volume activity from a single user account interacting with known public generative AI platforms (e.g., ChatGPT, Copilot, Claude). It uses a threshold-based approach on CloudAppEvents logs to identify potential reconnaissance or bulk information gathering activities which could signify unauthorized use or automated data scraping via AI interfaces.
Detects instances where a single user account exhibits an anomalously high frequency of requests to public generative-AI platforms within a one-hour window, potentially indicating automated reconnaissance or data staging activities using AI tools.
This rule detects potential automated subdomain enumeration by monitoring for a high volume of DNS queries (200 or more within 60 seconds) originating from a single host. Such behavior is characteristic of reconnaissance activities used to discover subdomains and map out network infrastructure.
Detects web-proxy or webserver log activity associated with domains registered within the last 30 days that mimic branding or structure of major identity providers (Microsoft, Okta, Google, Duo). This behavior is characteristic of adversary-in-the-middle (AiTM) phishing infrastructure staging.
This rule monitors cloud application events for high-frequency, automated API calls directed at AI/ML inference endpoints. A high volume of queries (over 1000) accessing a diverse range of objects (over 50) within a short window (60 minutes) by a single identity or IP address is flagged. Such behavior is characteristic of model extraction or distillation attacks, where an adversary probes an AI model to replicate its capabilities or internal parameters.
Detects high-volume account existence checks targeting the Microsoft Teams API. The rule identifies anomalous authentication attempts characterized by the use of outdated Electron/Chrome user-agent strings associated with the TeamFiltration tool, specifically targeting the Microsoft Teams API AppId (1fec8e78-bce4-4aaf-ab1b-5451cc387264).
Detects the presence of a specific Russian-language error string ("Не удалось сгенерировать HWID") within binary files, which is characteristic of the HWID generation mechanism used by Vidar Stealer malware.
Detects a network activity pattern from a single host characterized by a high volume of connections to a wide range of remote hosts and ports, combined with an exceptionally low coefficient of variation in inter-request timing. This pattern is indicative of an automated, scriptable agent or AI-driven reconnaissance tool rather than a human-operated scanner, likely performing automated asset discovery or network enumeration.
Detects web reconnaissance activity characterized by the use of User-Agent strings associated with automated AI agent frameworks and headless browser libraries (e.g., LangChain, AutoGPT, Playwright, Selenium, python-requests). These tools are frequently utilized in autonomous exploitation scenarios to scan multiple URI paths on a web server in a short timeframe.
Detects web proxy requests that resemble phishing attempts targeting Apple Activation Lock. The rule identifies URLs containing specific Apple-related keywords in combination with common phishing URL paths, while filtering out legitimate Apple support documentation pages.
This rule detects interaction between an internal host and the Vapi.ai API, typically used for automating AI-based voice phishing (vishing) calls. It identifies the initiation of a call via POST requests to the Vapi.ai API and subsequent callbacks from Vapi.ai to an attacker-controlled webhook endpoint used for tracking call status.
Page 7 of 63