Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects attempts to exploit Microsoft Exchange vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), collectively known as ProxyShell. The rule monitors inbound HTTP requests targeting the /autodiscover/ endpoint with specific path traversal patterns and malicious components used to stage web shells or execute arbitrary commands.
Detects potential data exfiltration (CVE-2026-42824) where an attacker leverages an SSRF vulnerability in Bing's search-by-image functionality to relay sensitive M365 Copilot data. The rule identifies outbound network requests to the image search endpoint containing a suspicious 'imgurl' parameter pointing to non-Microsoft infrastructure, initiated by common web browser processes.
This rule detects attempts to exploit Microsoft 365 Copilot through prompt injection, where attackers inject HTML/script elements into search queries. It specifically identifies when these queries attempt to force Copilot to interact with external URLs via Bing image search (SSRF), potentially exfiltrating sensitive data such as MFA codes, email content, or meeting details to an attacker-controlled external domain.
Detects network connections to Bunny CDN infrastructure that contain common URL path indicators associated with phishing, a technique observed in activity attributed to UNC1151 (Ghostwriter).
Detects malicious activities targeting Cisco Catalyst SD-WAN infrastructure, including connections from known malicious IP addresses (UAT-8616), unauthenticated vManage API access attempts indicative of exploitation (CVE-2026-20182), and anomalous control-plane signaling (OMP/DTLS/NETCONF) from unauthorized external sources.
This rule detects potential brute force attacks against Microsoft Exchange Outlook Web App (OWA) by monitoring for a high volume of 401 Unauthorized status codes from non-internal IP addresses. It also correlates these authentication events with subsequent post-authentication actions, specifically identifying mailbox logins followed by mailbox searching or export requests, which may indicate account compromise and unauthorized data collection or exfiltration.
Detects incoming HTTP POST requests to the /PSEMHUB/hub endpoint on Oracle PeopleSoft servers, which is indicative of exploitation attempts related to the Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2026-35273.
Detects HTTP POST requests sent to Large Language Model (LLM) chat completion API endpoints where the URI query parameters contain keywords strongly associated with the creation of phishing kits, credential harvesting forms, or malware scaffolding. This rule aims to identify the use of AI tools to accelerate malicious development workflows.
Detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by identifying JNDI lookup strings (e.g., ${jndi:ldap://, ${jndi:rmi://, ${jndi:dns://) within HTTP request headers, a technique used to trigger remote code execution in vulnerable Java applications using the Log4j library.
Detects HTTP POST requests directed at a specific suspicious endpoint (/service/save.php) on a known malicious host (83.138.53.110), consistent with the exfiltration behavior of the FortiBleed EKZ stealer malware. The rule identifies potential credential theft and exfiltration over standard web protocols.
This rule detects potential unauthorized access and environment variable disclosure attempts against the Flowise API, specifically targeting the MCP (Model Context Protocol) endpoints. It monitors for path traversal-like patterns using case variants (e.g., /api/v1/env), unauthorized access to configuration endpoints, and the exposure of sensitive data like API keys, database URLs, and passwords in API responses or request headers.
This rule detects Socket.IO WebSocket handshake attempts or Engine.IO connection openings targeting TCP port 1313. This pattern is commonly associated with administrative tools, backdoors, or command-and-control frameworks that utilize WebSocket communication over non-standard ports to bypass security controls.
Detects potential data exfiltration activity to the file sharing service 'easyupload.io' by monitoring DNS queries, HTTP POST requests, and general network connections to the domain.
This rule detects attempts to exploit a Server-Side Request Forgery (SSRF) vulnerability in Oracle PeopleSoft by targeting the '/PSIGW/HttpListeningConnector' endpoint. The detection looks for malicious URI patterns and request bodies containing internal-only network indicators such as loopback addresses (127.0.0.1, localhost), link-local addresses (169.254.169.254), or local file access attempts (file://), which are indicative of SSRF exploitation attempts.
This rule detects attempts to perform Large Language Model (LLM) prompt injection via HTTP requests. It monitors proxy traffic for common jailbreaking or adversarial instruction patterns such as 'ignore previous instructions', 'bypass restrictions', or 'fictional environment' within URI parameters or request bodies. Such patterns are indicative of an attacker attempting to manipulate the behavior of an AI/LLM application.
This rule detects internal network traffic communicating with the Telegram Bot API endpoint 'api.telegram.org' using the 'getUpdates' method. This pattern is commonly used by malware for C2 polling to retrieve commands from an adversary-controlled Telegram bot.
Detects Microsoft Exchange EWS (Exchange.asmx) requests containing a ReferenceAttachment call where the ProviderEndpointUrl parameter points to a non-Microsoft/external domain. This is consistent with SSRF exploitation techniques, such as those observed in CVE-2026-45504, where an attacker-controlled endpoint is provided to Exchange for fetching WOPI properties.
This rule detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by monitoring HTTP headers for malicious JNDI lookup strings. Attackers use this injection to trigger the JNDI mechanism to connect to a remote server (LDAP, RMI, DNS) and download malicious Java classes, leading to remote code execution.
Detects attempts to exploit the ProxyShell vulnerability (CVE-2021-34473) in Microsoft Exchange servers. The rule identifies malicious path traversal sequences, specifically utilizing encoding techniques like double URL encoding (%25) or dot-dot-slash characters within requests to the Autodiscover service, aimed at bypassing security controls.
Detects anomalous outbound network traffic from Firefox processes indicative of CVE-2025-15661 exploitation. The rule monitors for communication with a specific non-standard port (8765) associated with a SmartWindow PoC server, or requests containing suspicious URI query parameters ('u0', 'u1', 'u2', 'source=history') frequently used for exfiltrating private browsing tabs and history via the '/leak' endpoint.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Page 106 of 202