Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects HTTP requests where the referrer is a major LLM service (e.g., ChatGPT, Claude) but the destination host uses keywords indicative of phantom squatting (e.g., parcel, delivery, login) suggesting an attempt to use LLM-generated content or platforms to facilitate malicious redirects or phishing.
Detects HTTP POST requests to known phishing kit endpoints 'panel_track.php' or 'verify_api.php', which are associated with the Montana Empire credential harvesting campaign.
This rule detects outbound HTTP traffic generated by the WinHTTP library, specifically when the User-Agent identifies as WinHttp.WinHttpRequest. This pattern is indicative of potential post-exploitation activity, such as command-and-control communication or data exfiltration, originating from a process associated with an exploited Excel document (CVE-2025-60727).
Detects inbound HTTP requests containing JNDI lookup strings commonly used to exploit the Log4Shell vulnerability (CVE-2021-44228). The rule specifically monitors for JNDI lookups over ldap, rmi, or dns protocols within HTTP traffic, which can lead to remote code execution.
This rule detects potentially malicious activity leveraging the Windows Remote Management (WinRM) protocol over HTTP (ports 5985/5986). It specifically monitors for POST requests to the '/wsman' URI that contain the string 'powershell' in the request body, which is indicative of remote command execution via WinRM using PowerShell.
Detects attempts to perform Local File Inclusion (LFI) via path traversal sequences (../) in HTTP URIs, specifically targeting sensitive files like /etc/passwd or windows/win.ini.
This rule detects HTTP requests attempting to perform Local File Inclusion (LFI) or path traversal attacks by searching for patterns such as '/../' sequences and common sensitive file paths like /etc/passwd, /etc/shadow, or /proc/self/environ in the URI.
Detects outbound HTTP POST requests to suspicious URIs and subsequent inbound responses containing executable binary (PE) signatures, characteristic of Emotet malware command-and-control (C2) activity.
Detects HTTP traffic patterns characteristic of Emotet malware command and control (C2) beaconing, specifically looking for POST requests with random alphanumeric URIs (4-16 characters) and a specific Accept-Encoding header (gzip, deflate).
This rule detects potential Cobalt Strike Beacon check-in activity over HTTP. It identifies incoming GET requests where the URI is abnormally short and the HTTP Referer header is missing, which are common indicators of default Cobalt Strike malleable C2 profiles.
Detects suspicious patterns of LLM API usage by monitoring outbound traffic to major LLM providers (OpenAI, Anthropic, Google, DeepSeek, Mistral, Cohere). The rule identifies potential API key theft ('LLMjacking') by flagging high request volumes from single keys, usage of the same key across multiple distinct source IP addresses, and direct outbound traffic bypassing established proxy/gateway configurations.
This rule detects outgoing HTTP POST requests containing patterns commonly associated with Emotet command-and-control (C2) communication, specifically identifying the use of an application/octet-stream content type combined with a specific, randomized URI path structure consisting of alphanumeric segments.
Detects outbound network traffic from internal hosts exhibiting characteristics of PowerShell-based download cradles, such as specific User-Agent strings or URL patterns associated with IEX DownloadString or Invoke-WebRequest.
Detects HTTP traffic patterns consistent with data exfiltration to major cloud storage providers (AWS S3, Azure Blob Storage, Google Cloud Storage) using common command-line interface tools like rclone, aws-cli, and AzCopy.
This rule monitors web server access logs for suspicious activity targeting sensitive Flowise API endpoints (credentials, variables, secretvariable, apikey). It flags two types of threats: 1) Case-bypass evasion attempts, where canonical endpoints are bypassed via non-standard casing while requesting sensitive data (e.g., matching a status 200 on non-canonical casing for sensitive paths), and 2) High-frequency requests indicative of bulk enumeration or directory/wordlist scanning.
Detects browser-based network connections to URLs containing Google or Gmail branding where the resolved IP address does not match the expected Google IP address prefixes. This behavior is indicative of an Adversary-in-the-Middle (AiTM) phishing attack, where a user is being redirected to a malicious proxy server that mimics the legitimate Google login service to intercept credentials and MFA tokens.
Detects exploitation attempts against CVE-2026-33017, an unauthenticated remote code execution vulnerability in Langflow. The rule identifies suspicious HTTP POST requests directed at specific vulnerable API endpoints, looking for common Python code injection payloads (e.g., 'os.system', '__import__', 'subprocess') or the presence of a known dropper payload ('isp.sh') within the URI query. It also flags requests originating from common automation user agents like 'python-requests'.
Detects AzureHound or roadtx bulk enumeration of Microsoft Graph API endpoints using tokens obtained via CVE-2025-0309 CA policy bypass, characterized by high-frequency GET requests to /v1.0/users, /v1.0/groups, /v1.0/devices, /v1.0/servicePrincipals from Edge client IDs (f44b1140-bc5e-48c6-8dc0-5cf5a53c0e34 or 22098786-6e16-43cc-a27d-191a01a1e3b5) with password-only amr claim and no MFA.
Detects the TONResolver RAT attempting to resolve its Command and Control (C2) server address by querying TON blockchain API endpoints. The rule monitors network connections and DNS queries made by non-standard processes to known TON API infrastructure, specifically tracking potential dead-drop resolver behavior where smart contract data is used to obtain malicious infrastructure addresses.
This rule detects network activity indicating a potential modification or interaction with Microsoft Entra ID (Azure AD) multifactor authentication (MFA) settings. Specifically, it looks for POST requests to the Microsoft Graph API targeting authentication methods (e.g., phoneAuthenticationMethod), which may be indicative of an attacker modifying MFA settings to bypass security controls or register rogue authentication devices.
This rule detects attempts to exploit CVE-2024-36401, a critical remote code execution vulnerability in GeoServer. The rule monitors inbound HTTP requests to GeoServer OWS or WFS endpoints for malicious patterns consistent with OGC filter expression injection, such as attempts to invoke Java Runtime process execution via crafted property names or OGC expressions.
Page 111 of 202