Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,266 detections
Filters
Last updated
All Time
Detection languages
3,338
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,028
2,539
1,076
1,048
928
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
1,331
1,107
991
658
494
MITRE Techniques
2,270
1,335
1,318
902
884
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects the installation of specific malicious npm packages associated with the North Korean "Contagious Interview" campaign. These packages are known to deliver the XORIndex malware loader.
This rule detects the execution of common command-line utilities (wget, curl, nc, bash, python, perl, php, sh) within web server directories. This activity is highly suspicious as it could indicate an attacker attempting to download malicious files, execute web shells, or perform other post-exploitation activities on a compromised web server.
Detects unauthorized or suspicious USB device connections based on manufacturer, product, and device ID indicators.
Primary focus is on known identifiers associated with IP-KVM devices. The search utilizes the CrowdStrike event feed, specifically focuses on the following event types:
- DcUsbDeviceConnected
- DcUsbDeviceDisconnected
- DcUsbDeviceBlocked
The device identifiers are sourced from publicly available sources (primarily GitHub).
Primary focus is on known identifiers associated with IP-KVM devices. The search utilizes the CrowdStrike event feed, specifically focuses on the following event types:
- DcUsbDeviceConnected
- DcUsbDeviceDisconnected
- DcUsbDeviceBlocked
The device identifiers are sourced from publicly available sources (primarily GitHub).
KQL Query from file: Hunting Exposed JDWP
This analytic processes and enriches alerts from CrowdStrike Falcon Event Stream, specifically `DetectionSummaryEvent` and `IdpDetectionSummaryEvent`. It normalizes fields such as user, destination, severity, and MITRE ATT&CK information. The rule dynamically generates drilldown links and constructs a descriptive title and message for each alert. It is designed to provide a standardized view of various CrowdStrike detections, including NGAV, Intel Detection, and Identity Protection alerts, ensuring proper risk scoring and analyst queue population.
Detects suspicious script download attempts initiated by a Java process, indicative of potential JDWP exploitation leading to Remote Code Execution (RCE). Attackers often leverage exposed JDWP interfaces to execute commands like downloading and running malicious scripts.
Detects the execution of the `sudo` command with the `chroot` option (`-C` or `--chroot`). This could be an indicator of an attempt to exploit privilege escalation vulnerabilities like CVE-2025-32463.
KQL Query from file: Suspicious CLI Obfuscation
KQL Query from file: Remote code execution exploit chain in OpenVPN
KQL Query
KQL Query
KQL Query
KQL Query
KQL Query from file: CVE-2024-7971 Patch Prioritization
KQL Query from file: DefenderXDR Exposure Management for CVE-2024-3094
KQL Query
KQL Query from file: CVE-2024-3094 with CVSS Score 10
KQL Query from file: Discord Invite Hijacking Detection
KQL Query
KQL Query from file: Detect CVE-2025-27607 (CVSS 8.8)
KQL Query
Page 319 of 346