Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,459
11,842
5,879
5,158
4,866
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects HTTP proxy traffic containing specific header or cookie patterns associated with the Evilginx2 or BigBear adversary-in-the-middle (AiTM) phishing frameworks. These frameworks use these artifacts to proxy connections and facilitate the theft of session tokens for MFA bypass.
Detects outbound HTTP GET requests to specific GitHub repository paths hosted on raw.githubusercontent.com, which are associated with the Kimsuky threat actor's 'Operation GitPower'. These paths indicate the retrieval of malicious payloads or scripts from adversary-controlled repositories.
Detects anomalous web request patterns against Citrix NetScaler ADC or Gateway devices, characterized by excessively long URLs or request contexts combined with high-frequency parameter variation from a single source. This behavior is indicative of potential fuzzing or exploit attempts targeting web application vulnerabilities, specifically input validation flaws in edge infrastructure.
Detects indicators associated with the ChatGPT Custom GPT ClickFix campaign across process, network connection, DNS, and HTTP telemetry: known malicious file hashes, C2 IP addresses, the chattypetty.com domain, and known payload-hosting URLs.
Detects web server requests for .aspx files where the User-Agent string identifies as Windows PowerShell and includes the zh-CN locale setting. This behavior is often characteristic of automated exploitation tools or web shells (like China Chopper) interacting with compromised web servers.
Detects outbound HTTP requests to 'letsdiskuss.com' with a URI pattern of '/user/', which is characteristic of the 'STAC4924' loader utilizing a dead-drop resolver for command-and-control communication.
Detects network traffic associated with Wazza phishkit anti-bot gates, including beacon communications, TLS SNI patterns, fingerprint iframe URIs, and challenge-platform requests.
Detects network traffic (DNS, TLS SNI, and HTTP) associated with Wazza phishkit infrastructure, specifically looking for malicious domains like boegl-krysl.eu and coppietersrecherche.eu, as well as Cloudflare workers.dev domains used for beaconing and lures.
Detects a multi-stage Wazza phishkit communication chain over HTTP, involving initial configuration retrieval, token minting, token firing, and subsequent redirection with signed tokens.
Detects unauthorized attempts to access the Ray Dashboard Job Submission API, which is vulnerable to remote code execution (CVE-2023-48022). Attackers can leverage this API endpoint to execute arbitrary commands on the Ray cluster.
This rule detects HTTP POST requests targeting Adobe Commerce or Magento checkout, customer, or admin endpoints that contain suspicious syntax patterns indicative of Server-Side Template Injection (SSTI). These patterns ({{...}}, {%...%}, ${...}) are common in various template engines and, when injected into application inputs, can lead to Remote Code Execution (RCE) via CVE-2026-75650.
This rule detects network beaconing behavior consistent with Cobalt Strike's default malleable C2 profiles. It monitors HTTP GET and POST requests for specific URI patterns commonly used by default Cobalt Strike configurations and triggers when multiple such requests are observed from a single host over a 15-minute window.
Detects unauthorized POST requests to SharePoint WebPart gallery pages that lack valid authentication cookies, which may indicate exploitation of CVE-2026-65660. The rule monitors for POST methods to specific SharePoint pages while excluding requests that already contain standard SharePoint authentication cookies (FedAuth, rtFa).
Detects unauthorized or external access attempts to the Ollama LLM API service (TCP port 11434). The rule specifically flags POST requests targeting the /api/generate or /api/chat endpoints, which are commonly exposed via misconfiguration or lack of authentication, potentially allowing remote command execution or model exploitation.
Broad triage/hunting rule to surface all requests to the j_security_check authentication endpoint on Cisco Catalyst SD-WAN Manager, in support of investigating CVE-2026-76504 (unauthenticated admin auth-bypass zero-day). Cisco advises reviewing serviceproxy-access.log and vmanage-server.log for requests to this endpoint from unknown or unauthorized source IPs. This rule matches ANY request to the endpoint and is NOT itself evidence of compromise -- every match requires manual review of source IP legitimacy against known/authorized administrative addresses.
This rule monitors network traffic, DNS queries, and user web clicks to detect interactions with known malicious domains associated with credential harvesting and phishing campaigns, specifically those impersonating security or SSO portals.
Detects potential exploitation attempts targeting unpatched Citrix NetScaler ADC or Gateway devices, specifically looking for unauthenticated requests to management or sensitive endpoints that contain command execution indicators. This rule is designed to identify activity associated with vulnerabilities similar to CVE-2026-88771.
Detects potential exploitation attempts targeting unpatched Citrix NetScaler ADC or Gateway devices, specifically looking for unauthenticated requests to management or sensitive endpoints that contain command execution indicators. This rule is designed to identify activity associated with vulnerabilities similar to CVE-2026-88771.
This rule detects anomalous, high-frequency unauthenticated POST requests targeting NetScaler ADC and Gateway management or service endpoints (/vpn/, /logon/, /nitro/). Such patterns are characteristic of automated reconnaissance and exploitation attempts, specifically targeting vulnerabilities like CVE-2026-88771 and CVE-2026-88772.
This rule performs a point-in-time IOC hunt within CommonSecurityLog data to detect indicators associated with NeedyMantis. It monitors for specific C2 infrastructure domains ('tripswithengine.com') and a hardcoded user-agent string ('Firefox/21.0') in proxy, firewall, or network logs, which are characteristic of this threat actor's activity.
Detects SQL injection exploitation attempts against MOVEit Transfer targeting the CVE-2023-34362 vulnerability, followed by the deployment and subsequent interaction with the 'human2.aspx' webshell associated with Cl0p ransomware mass-exploitation campaigns.
Page 10 of 202