Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects Node.js process querying Ethereum blockchain for C2 address.
This rule monitors Microsoft IIS access logs for unauthenticated POST requests targeting the '/accessv2' endpoint from non-private, external IP addresses. This activity may indicate an attempt to exploit a public-facing application, potential web shell interaction, or unauthorized access attempts.
Detects potential exploitation of the ToolShell remote code execution vulnerability (CVE-2025-53770) in on-premises Microsoft SharePoint servers. Attackers have been observed sending POST requests to the 'ToolPane.aspx' endpoint and subsequently dropping webshells with specific names in the SharePoint LAYOUTS directory.
This rule detects the uninstallation or removal of the ModSecurity module from an IIS server, followed by suspicious POST requests to .aspx files within a 30-minute window. This behavioral pattern is indicative of an attacker disabling web application firewall (WAF) protections before attempting to exploit vulnerabilities or upload web shells.
This rule detects network connections or DNS queries related to the TON blockchain ecosystem, specifically targeting domains and API endpoints associated with TON network infrastructure. These communication patterns may indicate interaction with cryptocurrency-related services or potential malware utilizing TON-based infrastructure for command and control or data exfiltration.
This rule detects potentially malicious search queries within Microsoft 365 network traffic. It monitors HTTP headers and request bodies for search parameters that contain common web injection markers, such as script, img, or svg tags, and other suspicious keywords indicative of attempted Cross-Site Scripting (XSS) or search-based exploitation.
Detects potential exfiltration of sensitive M365 data via an SSRF vulnerability (CVE-2026-42824). The rule identifies suspicious outbound network requests to Bing's image search service where the 'imgurl' parameter contains external, non-Microsoft URLs, suggesting the service is being used as a proxy to exfiltrate data.
This rule detects potential Log4Shell (CVE-2021-44228) exploitation attempts by identifying JNDI injection patterns in web request headers, process command lines, and syslog messages. It further identifies suspicious outbound network callbacks to known malicious infrastructure associated with these exploitation attempts.
This rule detects exploitation attempts targeting CVE-2026-0300 in Palo Alto Networks PAN-OS. It identifies suspicious network connections to User-ID Authentication Portal ports (6081, 6082) from external IP addresses, excluding RFC1918 and loopback ranges. Additionally, it looks for a specific anomalous User-Agent string associated with the CL-STA-1132 threat actor, which has been observed during exploitation of this vulnerability.
Detects a potential exploitation attempt of CVE-2026-42824, involving a parameter-to-prompt injection in M365 Copilot to extract sensitive data identifiers, followed by an exfiltration attempt via a Bing Search-by-Image SSRF request.
This rule detects exploitation attempts targeting CVE-2026-0300 in Palo Alto Networks PAN-OS. It identifies suspicious network connections to User-ID Authentication Portal ports (6081, 6082) from external IP addresses, excluding RFC1918 and loopback ranges. Additionally, it looks for a specific anomalous User-Agent string associated with the CL-STA-1132 threat actor, which has been observed during exploitation of this vulnerability.
This rule detects outbound network connections to a specific typosquatted domain 'perplexity-ai.online'. This domain is associated with a malicious browser extension designed to intercept and exfiltrate search queries before forwarding them to legitimate search providers.
Detects network activity associated with the Djinn Stealer malware, including connections to a known C2 IP address/port, the use of a specific 'telemetry-client/1.0' user agent, or HTTP POST requests to 'application/octet-stream' endpoints originating from suspicious parent processes such as SimpleHelp or TaskWeaver.
This rule monitors network traffic for the presence of the 'X-WebAuth-User' HTTP header, which is often used in authentication bypass scenarios. The rule specifically alerts when this header is present, especially if the username injected is 'admin', potentially indicating an attempt to impersonate a user or bypass authentication controls on exposed web services or proxy configurations.
Detects potential privilege escalation attempts against a MyBB forum by monitoring POST requests to administrative endpoints. Specifically, it flags session activity that includes creating new users with admin group assignments (usergroup=4) or accessing sensitive administrative modules (config, tools, style, user) from within the admin control panel.
Detects remote code execution (RCE) attempts targeting Flowise/floci API Gateway services through Velocity Template Language (VTL) server-side template injection. The rule monitors for malicious payload patterns involving Java class reflection (e.g., ProcessBuilder) and unauthorized access attempts through API Gateway endpoints, including potential IAM scope bypass signatures.
Detects HTTP GET requests to the /api/device/gate/ path, a specific behavior associated with EvilTokens phishing kits. Attackers use this gate check endpoint to identify and potentially burn active phishing sessions for security researchers or automated scanners.
Detects web traffic containing HTTP 301/302 redirects to known cloud hosting platforms (Azure, AWS, Cloudflare) that exhibit suspicious URL patterns or originate from identified malicious referrers associated with phishing or credential harvesting campaigns.
This rule detects potentially malicious inbound HTTP POST requests directed at an API endpoint associated with public build directories. The detection logic monitors for suspicious user agents (e.g., Python requests), specific known malicious flow identifiers, known attacker IP addresses, and payload indicators such as OS command injection or execution patterns (e.g., __import__, os.system).
Detects unauthorized privilege escalation attempts within the MyBB Admin Control Panel (ACP). The rule identifies HTTP POST requests, likely generated by a limited-privilege account, that attempt to create a new user with Administrator permissions (gid=4) or modify an existing user's group assignment to the Administrator group, bypassing standard ACP permission controls.
Detects HTTP and DNS requests directed towards the .workers.dev domain, which are commonly leveraged by threat actors for command and control (C2) redirection and domain fronting. This activity is frequently associated with the Gamaredon (Shuckworm/ACTINIUM) threat group's infrastructure.
Page 118 of 202