Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,209 detections
Filters
Last updated
All Time
Detection languages
709
203
154
38
26
Contributors
191
190
181
159
113
Categories
416
393
386
332
166
Platforms
830
343
197
84
56
Products / Services
10,678
9,759
6,693
4,421
3,749
1,209
MITRE Techniques
422
359
351
273
256
CVEs
16
12
11
10
8
IDS Classtypes
18
2
2
1
1
IDS Protocols
25
This rule detects an unusually high number of downloads of files identified as 'octet-stream' or 'executable' from a single IP address within a one-hour window, based on W3CIISLog data. This behavior could indicate various malicious activities, including the distribution of malware, data exfiltration, or the use of a compromised web server for command and control.
This rule correlates successful VPN authentication events with the subsequent execution of tools commonly associated with ransomware staging activities within a 6-hour window. It aims to detect initial access via VPN followed by preparatory actions for ransomware deployment. The rule specifically looks for VPN logins from 'Check Point' devices and process executions of 'rclone.exe', '7z.exe', 'powershell.exe', 'wevtutil.exe', 'vssadmin.exe', or 'nltest.exe'.
Detects the host-level command execution artifact left behind by the published ITScape (CVE-2026-46316) exploit proof-of-concept. The PoC specifically executes a payload containing '/bin/touch /ITScape' after achieving host kernel privilege from a KVM/arm64 guest. This rule looks for processes executing this specific command string.
This rule tracks the process tree where the execution of 'setup.cjs' leads directly to the creation of a '.pkg_history' file. This behavior is indicative of the Mastra NPM supply chain compromise, where malicious packages use 'setup.cjs' to drop marker files for persistence or further stages of the attack.
Detects DNS lookups to Pastebin used for dead drop C2 configuration retrieval
Detects when non-Node.js scripts, specifically Python or Bash/Shell, modify or create a 'package.json' file. This activity can indicate an attempt to silently inject malicious dependencies into clean repositories, a technique observed with malware like Miasma.
Detects modifications to user profile scripts (.profile, .bash_profile) that inject 'gh-token-monitor' or 'spectralviper' to establish persistence upon user login.
This rule detects multiple attempts (10 or more within an hour) from a single IP address to access administrative interfaces on a web server. It specifically looks for URI queries containing keywords like 'admin', 'wp-admin', or 'administrator' in W3CIISLog data. Such activity often indicates a brute-force attack or scanning for administrative login pages.
This rule identifies potential data exfiltration or unusual data transfer activity by detecting a high volume of large data transfers (over 1MB per transfer) from or to an IIS web server. It aggregates these transfers hourly by client IP and alerts if 10 or more such transfers occur within that hour from a single IP.
This rule detects potential SQL Injection attempts by monitoring IIS web server logs (W3CIISLog) for URI queries containing common SQL keywords such as 'union', 'select', or 'drop'. It aggregates these attempts by client IP address over one-hour intervals and flags any IP address with 5 or more such attempts within that hour.
Detects an unusually high volume (100 or more within an hour) of API calls (POST, DELETE, PUT methods to URIs containing 'api') originating from a single IP address. This activity could indicate various malicious behaviors such as brute-force attacks, credential stuffing, web application attacks, or a denial-of-service attempt against the API endpoint.
This rule detects the creation of web shell files (ASPX, PHP, JSP) in common web server directories such as 'wwwroot', 'inetpub', or 'var\\www'. This activity is indicative of an adversary establishing persistent access to a web server.
Detects the China Chopper web shell spawning CMD from IIS (w3wp.exe) with suspicious command line patterns.
This rule detects potential reconnaissance activity by identifying IP addresses that generate a high volume of HTTP requests with user agents indicating bots, crawlers, or scanners. It counts requests per IP address within one-hour bins and flags those with 50 or more such requests.
This rule detects potential Cross-Site Scripting (XSS) attempts by identifying multiple URI queries containing common XSS payloads such as '<script>', 'javascript:', or 'onerror=' within a one-hour window from the same client IP address. A count of 3 or more attempts triggers the alert.
This rule detects a high volume of server errors (HTTP status codes 500, 502, or 503) from IIS web servers within a 5-minute window. A count of 20 or more server errors in this timeframe triggers the alert, indicating potential issues with the web application, backend services, or a denial-of-service attempt.
Detects an unusually high volume of web requests (1000 or more per minute) originating from a single IP address to an IIS web server. This pattern can indicate various malicious activities such as brute-force attacks, denial-of-service (DoS) attempts, or aggressive web scanning.
This rule detects attempts to access sensitive configuration or backup files on an IIS web server. It looks for requests where the URI stem contains keywords like '.env', 'config', or 'backup', which are commonly associated with files that may contain sensitive information.
This rule detects potential information disclosure attempts by monitoring W3C IIS logs for repeated queries containing keywords like 'version', 'build', or 'debug'. A high frequency (5 or more attempts within an hour) from a single IP address suggests an adversary is trying to enumerate software versions or debug information, which can be used for further reconnaissance or exploit development.
This rule detects attempts to fingerprint web server software versions by looking for common server headers in HTTP responses. Specifically, it triggers if a client receives an HTTP response containing 'Apache/', 'nginx/', 'IIS/', or 'PHP/' followed by a digit, indicating a version number. The rule is thresholded to trigger only after 10 such events from the same destination within 30 seconds, aiming to reduce alerts from legitimate browsing.
This rule detects a high volume of POST requests to login, authentication, or password-related URI stems within a 5-minute window from unique IP addresses. This behavior is indicative of brute-force attacks or credential stuffing attempts against web applications.
Page 31 of 58