Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,226 detections
Filters
Last updated
All Time
Detection languages
1,119
30
19
17
15
Contributors
391
236
131
85
62
Categories
313
252
228
185
167
Platforms
651
438
269
228
200
Products / Services
10,683
9,759
6,695
4,421
3,750
1,226
MITRE Techniques
264
259
234
217
209
CVEs
8
8
6
6
6
IDS Classtypes
2
2
1
1
1
IDS Protocols
2
1
This rule detects email activity involving DocuSign-themed messages that contain attachments and also coincide with URL click events that redirect users to Microsoft-related login portals (e.g., login.microsoftonline.com or teams.microsoft.com) containing 'redirect' or 'redirect_uri' parameters. This behavior is indicative of a phishing attempt designed to capture credentials or perform OAuth consent phishing by mimicking legitimate document-signing workflows.
This rule monitors DNS queries and network connection events for interactions with a list of domains associated with the Kali365 infrastructure. It flags activity by identifying both direct matches and subdomains associated with 'ssengineers.com' and 'clientengagenow.de', often used in phishing or C2 communications.
This rule detects potential command and control (C2) activity associated with the CurlRAT malware. It monitors for both the execution of 'curl' or 'curl.exe' processes with command lines containing known C2 domains, and network traffic originating from internal devices directed toward those same domains.
This rule detects unauthorized or suspicious access to sensitive configuration and credential files (e.g., .aws, .azure, .ssh) by specific DLP (Data Loss Prevention) or automation scripts, and identifies subsequent attempts to expose environment variables or sensitive tokens within process command lines.
Detects network activity from infrastructure provisioner tools (Terraform, Coder) or shell processes attempting to connect to suspicious domains (e.g., coder-infra.com) that resemble legitimate infrastructure domains. This activity is indicative of credential theft, specifically targeting OIDC tokens, SSH keys, or authentication tokens during automated provisioning processes.
This rule correlates Microsoft Entra ID (formerly Azure AD) identity risk events with sign-in activity and behavioral analytics for a specific user to facilitate forensic investigation of potential identity compromise. It aggregates risk events, anomalous sign-in attempts (including failures or failed conditional access), and suspicious behavioral telemetry from the same source IP addresses associated with identified user risk.
This rule detects unauthorized or suspicious access to sensitive configuration and credential files (e.g., .aws, .azure, .ssh) by specific DLP (Data Loss Prevention) or automation scripts, and identifies subsequent attempts to expose environment variables or sensitive tokens within process command lines.
Detects network activity from infrastructure provisioner tools (Terraform, Coder) or shell processes attempting to connect to suspicious domains (e.g., coder-infra.com) that resemble legitimate infrastructure domains. This activity is indicative of credential theft, specifically targeting OIDC tokens, SSH keys, or authentication tokens during automated provisioning processes.
Detects network activity from infrastructure provisioner tools (Terraform, Coder) or shell processes attempting to connect to suspicious domains (e.g., coder-infra.com) that resemble legitimate infrastructure domains. This activity is indicative of credential theft, specifically targeting OIDC tokens, SSH keys, or authentication tokens during automated provisioning processes.
This rule monitors for the execution of Node.js processes involving a file named 'parser.js' and a component or argument referred to as 'ldata'. This behavior is characteristic of specific application workflows, but when observed as a standalone or unusual process, it may indicate unauthorized script execution or the activity of a malicious node-based tool.
Detects unauthorized attempts to dump the process memory of the Local Security Authority Subsystem Service (LSASS), a common technique used by attackers to harvest credentials from memory. This includes the use of legitimate diagnostic tools like procdump and comsvcs.dll, as well as the identification of resulting dump files in directory paths associated with LSASS.
This rule correlates Microsoft Entra ID (formerly Azure AD) risk events identified as 'passwordSpray' with subsequent sign-in logs from the same source IP address within a 60-minute window. This helps identify successful or suspicious authentication activity originating from an IP address previously flagged for password spraying attempts against a specific user account.
This rule detects potential command and control (C2) activity associated with the CurlRAT malware. It monitors for both the execution of 'curl' or 'curl.exe' processes with command lines containing known C2 domains, and network traffic originating from internal devices directed toward those same domains.
This rule detects potential command and control (C2) activity associated with the CurlRAT malware. It monitors for both the execution of 'curl' or 'curl.exe' processes with command lines containing known C2 domains, and network traffic originating from internal devices directed toward those same domains.
This rule detects the presence of specific file hashes known to be associated with backdoored software builds, specifically related to recent supply chain compromises affecting South Korean software vendors (e.g., HAProxy builds). It monitors device file events, process initiation, and identity logon events to identify systems that have deployed, executed, or been accessed by these malicious binaries.
This rule detects the use of package managers like 'pip' or 'npm' to install specific suspicious software packages or tools often associated with supply chain compromise or malicious library installation (e.g., 'huggingface-cli', 'unused-imports', 'react-codeshift').
This rule detects the use of package managers like 'pip' or 'npm' to install specific suspicious software packages or tools often associated with supply chain compromise or malicious library installation (e.g., 'huggingface-cli', 'unused-imports', 'react-codeshift').
This rule detects the presence of specific file artifacts and directory paths associated with the 'Mini Shai-Hulud' malicious campaign, which involves the compromise of the 'openapi-react-query-codegen' npm package. It monitors for indicators of compromise (IOCs) such as specific malicious JavaScript and shell script filenames, as well as persistence artifacts like plist and service files.
This rule detects network connections or DNS queries to known phishing domains (typosquatted Microsoft login domains), DeadDrop Resolver domains, and suspicious HTML payloads served from common CDN/package hosting sites (e.g., unpkg.com, npmmirror.com, cdn.jsdelivr.net, yarnpkg.com). These patterns are indicative of initial access attempts via phishing or the secondary stage of malware C2 communication.
Detects unauthorized attempts to dump the process memory of the Local Security Authority Subsystem Service (LSASS), a common technique used by attackers to harvest credentials from memory. This includes the use of legitimate diagnostic tools like procdump and comsvcs.dll, as well as the identification of resulting dump files in directory paths associated with LSASS.
Detects instances where a user account performs a device configuration change (such as updating compliance policies) followed by a potentially destructive operation (Wipe, Retire, or Delete) on the same device or entity within a 6-hour window. This behavior often suggests unauthorized administrative activity or a malicious insider attempting to disable security controls before removing access or destroying data.
Page 31 of 59