Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,459
11,842
5,879
5,158
4,866
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
The following analytic detects local file inclusion (LFI) attacks targeting Kubernetes Nginx ingress controllers. It leverages Kubernetes logs, parsing fields such as `request` and `status` to identify suspicious patterns indicative of LFI attempts. This activity is significant because LFI attacks can allow attackers to read sensitive files from the server, potentially exposing critical information. If confirmed malicious, this could lead to unauthorized access to sensitive data, further exploitation, and potential compromise of the Kubernetes environment.
This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of Remote Monitoring and Mangement applications. This activity can signify possible compromised hosts on the network.
Detects HTTP GET requests for files with a .hta extension, utilizing a legacy Internet Explorer User-Agent string. This pattern is commonly associated with SideCopy threat group activities where mshta.exe is used to proxy the execution of remotely hosted malicious HTA files, often as part of an initial infection chain.
Detects HTTP beacon traffic patterns indicative of Cobalt Strike malleable C2 profiles using default URI paths and User-Agent strings. This rule identifies common default configurations often left unchanged during adversarial deployment, allowing for the detection of beacon communication over HTTP.
Detects unauthenticated path traversal attempts targeting Grav CMS web servers. The rule identifies HTTP requests containing directory traversal sequences (e.g., ../, %2e%2e%2f) directed at sensitive configuration files (.yaml) or directories (/user/config, /system/config), consistent with exploitation patterns such as CVE-2026-42608.
This rule detects potential exploitation attempts targeting the Splunk REST API (CVE-2026-20253) by monitoring for unauthenticated inbound requests to the /services/ path. It specifically looks for requests that lack the required Authorization or Cookie headers.
Detects network traffic matching the default HTTP check-in pattern of Mythic C2 agents. This rule monitors for POST requests using a specific hardcoded User-Agent string and Content-Type header commonly used in default Mythic agent configurations, indicating a potential active command-and-control session.
This rule monitors network appliance logs (Fortinet, Cisco, Meraki, WatchGuard, Sophos) for patterns associated with known vulnerabilities, including authentication bypass (CVE-2022-40684), SQL injection, path traversal, and command injection attempts within URL parameters. It also flags high-severity IPS/IDS alerts generated by these devices.
This rule monitors network device logs for patterns indicative of reconnaissance or vulnerability scanning against management and VPN interfaces of common firewall and network appliances (FortiGate, Meraki, WatchGuard, Sophos). It flags sources that either request multiple sensitive paths related to system status and configuration or employ known scanning tools (Nmap, masscan, Nuclei, zgrab, curl) in the user-agent string.
This rule monitors network device logs for patterns indicative of reconnaissance or vulnerability scanning against management and VPN interfaces of common firewall and network appliances (FortiGate, Meraki, WatchGuard, Sophos). It flags sources that either request multiple sensitive paths related to system status and configuration or employ known scanning tools (Nmap, masscan, Nuclei, zgrab, curl) in the user-agent string.
This rule monitors network appliance logs (Fortinet, Cisco, Meraki, WatchGuard, Sophos) for patterns associated with known vulnerabilities, including authentication bypass (CVE-2022-40684), SQL injection, path traversal, and command injection attempts within URL parameters. It also flags high-severity IPS/IDS alerts generated by these devices.
This rule detects potential exploitation of the Oracle PeopleSoft PSEMHUB component vulnerability (CVE-2026-35273). It identifies suspicious POST requests to the PSEMHUB HttpListeningConnector servlet, including obfuscated URL paths, followed by the creation of suspiciously named .jsp or .jspx files in the PSEMHUB.war application directory, which is indicative of a web shell deployment.
Detects an exploitation attempt against PaperCut MF software leveraging SQL injection to deliver a Java bytecode loader (identified by the 'cafebabe' magic bytes) via a POST request.
Detects repeated attempts to perform IIS 8.3 tilde short-filename enumeration. This reconnaissance technique exploits the legacy DOS 8.3 file naming convention to identify the existence and naming of files or directories on a Microsoft IIS web server.
Detects browser-side malicious activity involving communication with Cloudflare Workers (workers.dev) endpoints typically associated with C2 beaconing (relays, ICE, socket) or the retrieval of trojanized JavaScript dependencies like 'jquery.mousewheel' which often precede second-stage agent execution.
Detects network activity related to the 'Blinder Tunnel' C2 infrastructure. The rules identify a Chisel tunnel client initiating a WebSocket handshake (identifiable by the 'chisel-v3-channel' header) to external infrastructure and a DNS lookup for a specific domain (soroshpasargad.com) identified as a relay nameserver used by the threat actor CL-STA-1178.
Detects network activity related to the 'Blinder Tunnel' C2 infrastructure. The rules identify a Chisel tunnel client initiating a WebSocket handshake (identifiable by the 'chisel-v3-channel' header) to external infrastructure and a DNS lookup for a specific domain (soroshpasargad.com) identified as a relay nameserver used by the threat actor CL-STA-1178.
Detects network activity related to the 'Blinder Tunnel' C2 infrastructure. The rules identify a Chisel tunnel client initiating a WebSocket handshake (identifiable by the 'chisel-v3-channel' header) to external infrastructure and a DNS lookup for a specific domain (soroshpasargad.com) identified as a relay nameserver used by the threat actor CL-STA-1178.
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
Detects network activity (DNS queries, HTTP Host headers, and TLS SNI) directed towards the known Blinder Tunnel staging domain 'asdfafadafg.online'. This behavior is indicative of command-and-control (C2) communication or initial staging of malicious payloads.
Page 11 of 202