Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,982 detections
Filters
Last updated
All Time
Detection languages
1,486
513
403
239
167
Contributors
986
658
304
198
109
Categories
916
822
673
590
452
Platforms
39,936
7,266
6,537
3,866
3,647
2,982
Products / Services
1,229
703
443
309
200
MITRE Techniques
1,053
824
459
384
348
CVEs
17
16
16
10
10
IDS Classtypes
24
7
7
4
3
IDS Protocols
49
1
Detects successful (HTTP 200) requests to ServiceNow API endpoints (/api/now/) that lack proper authentication, such as requests by the 'guest' user or requests missing authorization headers or session tokens.
Detects unauthenticated access attempts to the ServiceNow Scripted REST Resource endpoint '/api/now/related_list_edit/create'. This endpoint has been associated with exploitation activity targeting ServiceNow instances, particularly when accessed by the 'Guest' account or with missing session tokens.
Detects potential exploitation of unauthenticated ServiceNow Scripted REST Resources by identifying a pattern where external IP addresses first receive 4xx (authentication required) responses when querying /api/ paths, followed by 200 OK responses for the same paths, indicating a successful authentication bypass.
This rule detects potential mass emailing or spam activity by identifying instances where a single email account sends more than 100 emails within a one-minute window. This behavior is often characteristic of compromised accounts performing phishing campaigns or bulk unauthorized communication.
Detects rapid succession of MFA authentication requests originating from multiple distinct countries within a 10-minute window, a common pattern indicating an MFA fatigue (push bombing) attack targeting a specific user.
Detects bulk reconnaissance against multiple Microsoft Graph API endpoints (users, groups, roles, etc.) by scripting clients, correlated with a recent device registration event by the same user principal. This behavior is indicative of a Storm-2372 conditional access bypass strategy followed by rapid directory environment enumeration.
Detects instances of npm package publication events initiated by known-compromised maintainer accounts (czirker, llxlr). These accounts have been identified as being used to distribute malicious packages, such as leo-aws versions, representing a software supply chain compromise.
Detects malicious npm package propagation indicative of the Miasma/Mini Shai-Hulud worm. The rule identifies suspicious patterns in AuditLogs, specifically burst npm publishes by known malicious actors or involving known malicious package names, as well as the use of weaponized GitHub Actions workflows or unauthorized snapshot branches.
Detects inbound emails relayed through GoDaddy secureserver.net infrastructure where SPF and DMARC authentication pass but DKIM is absent, and the X-SECURESERVER-ACCT header is present. This pattern is consistent with the Scotiabank TOAD callback phishing campaign using compromised legitimate domains to bypass email authentication controls.
Detects network requests to Microsoft 365 Copilot Enterprise Search containing suspicious HTML tags or prompt injection keywords in the query parameter, indicating a potential Parameter-to-Prompt (P2P) injection attempt (CVE-2026-42824).
Detects suspected Browser-in-the-Middle (AiTM) activity by identifying successful multi-factor authentication followed by session activity from a different source IP address or with a different user-agent string within a 10-minute window, suggesting token theft or session hijacking.
Detects the Miasma worm propagating through CI/CD pipelines by identifying unauthorized updates to GitHub Actions workflow files. Specifically monitors for modifications to workflows under the LeoPlatform or LeoInsights projects by the compromised user 'czirker', with signs of weaponization such as the addition of OIDC id-token write permissions and npm-publish capabilities.
Detects malicious GitHub Actions workflow activity characteristic of the Miasma worm. The rule monitors for the creation or update of workflows named 'Dependabot Updates' (masquerading), which utilize OIDC token write permissions and execute scripts using 'bun run _index.js', often on suspicious snapshot branches.
Detects phishing emails associated with the TONResolver RAT campaign that impersonate Booking.com partner support. The emails use Japanese-language lures concerning guest complaints, include 'invite.ics' calendar attachments, and contain URLs pointing to suspicious top-level domains (.cfd, .bond, .sbs, .shop) or specific 'photo-' URL patterns. The rule differentiates between malicious impersonation and legitimate booking.com domain traffic.
Detects a rapid burst of file upload activity to cloud storage applications from a single account, including unusual proxy or device context. This rule identifies scenarios where an account performs 20 or more upload events or uploads 20 or more distinct objects within a 15-minute time window to common cloud storage services like Google Drive, Dropbox, Box, MEGA, OneDrive, or ShareFile. It also highlights if any of these uploads originate from an anonymous proxy.
This rule detects email spoofing attempts where the sender's display name is set to 'Monitoring', but the sender's email address does not contain 'monitoring', specifically targeting activity associated with the 'gasparinutrition.com' domain. This behavior is indicative of an impersonation attempt, commonly used in phishing campaigns to establish trust.
This rule monitors for incoming emails that pass DKIM authentication but fail DMARC verification, specifically where the signing domain is associated with Google Apps (gappssmtp.com). This pattern is often indicative of email spoofing, where an attacker sends mail from a legitimate provider's infrastructure but fails the domain alignment requirements of DMARC.
Detects suspicious patterns within the search query parameters of Microsoft Copilot and M365 search requests, indicative of potential prompt injection, data exfiltration, or exploitation attempts through malicious URL parameters.
Detects phishing emails where the sender domain (gasparinutrition.com) is spoofed or compromised. The emails are routed through Google Workspace infrastructure (gappssmtp.com) which results in a DMARC alignment failure under strict policies (adkim=s; aspf=s). The rule specifically flags emails containing PDF attachments with subject lines related to distribution, settlement, or agreements.
Detects the modification of sensitive banking or payment election records (e.g., direct deposit details) in Workday or similar HR SaaS platforms shortly after a user login event from the same source IP. This behavior is consistent with 'Payroll Pirate' style attacks where adversaries use stolen session tokens (via AiTM phishing) to redirect employee salary payments.
Detects automated Microsoft Graph API requests indicative of the 'Payroll Pirate' campaign, specifically targeting payroll and HR personnel after initial access via AiTM session token theft. The rule identifies two malicious patterns: bulk user directory harvesting using '?$top=999' and keyword-targeted enumeration (payroll, human, compensation) using OR-chained search queries and pagination markers ($skiptoken).
Page 113 of 142