Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
260 detections
Filters
Last updated
All Time
Detection languages
141
60
21
18
11
Contributors
80
44
20
19
11
Categories
77
69
67
49
37
Platforms
203
56
30
13
11
Products / Services
10,683
9,759
6,695
4,421
3,750
260
MITRE Techniques
75
73
53
41
40
CVEs
8
4
4
3
3
IDS Classtypes
4
1
1
1
IDS Protocols
4
1
Detects outbound network requests from endpoints to known 'uncensored' or jailbroken LLM-as-a-Service domains (e.g., WormGPT, FraudGPT). These platforms are specifically marketed to threat actors for illicit purposes like generating malware, phishing kits, or exploit code, and identifying access to them serves as a leading indicator of adversarial activity.
This rule detects network connections or DNS queries to known typosquatted and malicious domains associated with the SilverFox campaign. These domains impersonate legitimate software (e.g., SteelSeries GG, Bcut, DeepSeek) to lure users into downloading malware via SEO poisoning and deceptive downloads.
Detects potential AI-targeted cloaking, a technique where a web server serves different content to AI crawlers versus human users, identified by comparing HTTP response sizes or hashes across session logs. The rule uses Microsoft Sentinel's ASIM Web Session schema to correlate web requests, identifying discrepancies that suggest malicious or evasive intent. Covers T1036 & T1027
Detects potential AI-targeted cloaking, a technique where a web server serves different content to AI crawlers versus human users, identified by comparing HTTP response sizes or hashes across session logs. The rule uses Microsoft Sentinel's ASIM Web Session schema to correlate web requests, identifying discrepancies that suggest malicious or evasive intent. Covers T1036 & T1027
Detects potential AI-targeted cloaking, a technique where a web server serves different content to AI crawlers versus human users, identified by comparing HTTP response sizes or hashes across session logs. The rule uses Microsoft Sentinel's ASIM Web Session schema to correlate web requests, identifying discrepancies that suggest malicious or evasive intent. Covers T1036 & T1027
This rule detects a sequence of authentication activity on VPN gateways (Palo Alto, Fortinet, Cisco) where a source IP experiences multiple failed login attempts followed by at least one successful login within a 60-minute window, potentially indicating a successful brute force or password spraying attack.
This rule detects a sequence of authentication activity on VPN gateways (Palo Alto, Fortinet, Cisco) where a source IP experiences multiple failed login attempts followed by at least one successful login within a 60-minute window, potentially indicating a successful brute force or password spraying attack.
Detects HTTP POST requests directed at 'relay.php' that contain a hardcoded Authorization Bearer token ('crpx0_c2_2026') used by the CRPx0 ransomware. This activity indicates a compromised host is actively beaconing to C2 infrastructure for command execution, key exchange, or data exfiltration.
The following analytic identifies potential exploitation attempts against Citrix ADC related to CVE-2023-3519. It detects POST requests to specific web endpoints associated with this vulnerability by leveraging the Web datamodel.
This activity is significant as CVE-2023-3519 involves a SAML processing overflow issue that can lead to memory corruption, posing a high risk.
If confirmed malicious, attackers could exploit this to execute arbitrary code, escalate privileges, or disrupt services, making it crucial for SOC analysts to monitor and investigate these alerts promptly.
This activity is significant as CVE-2023-3519 involves a SAML processing overflow issue that can lead to memory corruption, posing a high risk.
If confirmed malicious, attackers could exploit this to execute arbitrary code, escalate privileges, or disrupt services, making it crucial for SOC analysts to monitor and investigate these alerts promptly.
Detects command-and-control network traffic associated with the DEV#POPPER (Void Dokkaebi/Contagious Interview) RAT. The rule monitors for characteristic WebSocket heartbeat and notification calls to '/verify-human/' endpoints, data exfiltration requests to '/u/f', and outbound connections to known malicious C2 IP addresses.
Pycodevx Rat C2 Beacon
YARA-L
Detects outbound HTTP(S) requests carrying the 'pyCodeVx', 'pyCodeV3', 'pyCodeV4', or 'NEWW' string marker in the URI, User-Agent, headers, or body, indicating beaconing by the pyCodeVx Python-based RAT (and its variants) to its command-and-control infrastructure
Detects network connections, DNS resolutions, or TLS SNI values matching known TWINLOOT command-and-control infrastructure, including the attacker-registered domains sharepointx.th2ch.com and lpi-web.com and the failover IP 193.24.211.221. TWINLOOT is a modular Python implant that hides its C2 inside trusted Microsoft cloud services (Graph API, SharePoint Online, Teams TURN relay) while also relying on dedicated attacker-controlled infrastructure for direct TLS/WebSocket tunneling and failover.
This rule monitors firewall traffic logs to identify connections directed at managed internal endpoints originating from devices not tracked by the endpoint management system. It flags potential rogue or unauthorized devices performing multi-target reconnaissance or communication across the internal network.
Detects outbound HTTP traffic indicative of pyCodeVx RAT check-in behavior. The rule identifies communication with ddnsfree.com C2 domains or requests containing the 'pyCodeVx' marker in the URL or User-Agent, coupled with a base64-encoded, fixed-format victim/session ID.
Detects completed administrative actions within the Cortex management console that result in a pause of endpoint protection. This action reduces security coverage on the targeted host and requires validation to ensure it aligns with authorized maintenance, troubleshooting, or incident response activities.
Detects edits to existing Windows, Linux, or macOS endpoint prevention policy rules within Cortex management audit telemetry. These modifications can impact endpoint security posture, necessitating audit and verification to ensure changes were authorized and do not reduce security coverage.
This rule detects successful connection events to Palo Alto GlobalProtect gateways originating from known malicious source IP addresses associated with the exploitation of CVE-2026-0257, or connections initiated by hosts using suspicious or default placeholder device names/host IDs. It effectively identifies potential exploitation attempts or unauthorized access to corporate VPN gateways.
This rule detects successful connection events to Palo Alto GlobalProtect gateways originating from known malicious source IP addresses associated with the exploitation of CVE-2026-0257, or connections initiated by hosts using suspicious or default placeholder device names/host IDs. It effectively identifies potential exploitation attempts or unauthorized access to corporate VPN gateways.
This rule monitors for successful GlobalProtect gateway connections from users who have not successfully connected in the preceding 30 days, specifically identifying users connecting with a client fingerprint of 'Microsoft Windows 10 Pro 64-bit'. This behavior is indicative of potential initial access using compromised or new credentials, or specifically flagging suspicious activity patterns associated with specific exploit proof-of-concept client fingerprints.
This rule monitors for successful GlobalProtect gateway connections from users who have not successfully connected in the preceding 30 days, specifically identifying users connecting with a client fingerprint of 'Microsoft Windows 10 Pro 64-bit'. This behavior is indicative of potential initial access using compromised or new credentials, or specifically flagging suspicious activity patterns associated with specific exploit proof-of-concept client fingerprints.
PKINIT DC Impersonation from Non-DC Host
Cortex XDR
This rule detects potential Kerberos PKINIT (Pre-Authentication Type 16) authentication requests where a Domain Controller account (identified via User Account Control bit 8192) is targeted by an authentication attempt originating from a non-DC client address. This behavior may indicate an attempt to impersonate or misuse a high-privilege account for lateral movement or persistence.
Page 2 of 13