Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects the RondoDox campaign's use of obfuscated JNDI payloads targeting the Log4Shell (CVE-2021-44228) vulnerability. The rule identifies attempts to spray malicious JNDI lookup strings like ${env:NaN:-j}ndi across multiple HTTP headers including Authorization, Bearer, Cookie, and others, specifically designed to bypass web application firewall (WAF) filters.
Detects Tycoon 2FA AitM using unique, high-entropy URL paths with low request counts
This rule detects HTTP POST requests containing common credential field names directed at files ending in .php (such as login.php, result.php, or index.php), which is highly characteristic of phishing kits used to harvest credentials.
Detects interaction with the WordPress Theme Editor utility immediately followed by a file modification to functions.php, indicative of the ErrTraffic deployment phase. This activity is often used by adversaries to establish persistence on compromised WordPress sites by injecting malicious code.
This rule detects when a user clicks on a URL that contains a domain identified as malicious. The rule specifically looks for `UrlClickEvents` where the extracted domain from the URL matches any of the domains listed in the `malicious_domains` array. This can indicate a successful phishing attempt or an accidental click on a known malicious link.
Detects HTTP GET requests to known malicious infrastructure used in SEO poisoning campaigns to distribute the Bumblebee malware loader. The rule monitors for specific URL paths and hostnames associated with lookalike domains delivering trojanized MSI files.
Detects exploitation attempts against CVE-2026-33017 in Langflow by monitoring for unauthenticated POST requests to the /api/v1/build_public_tmp/ endpoint, specifically using the identified exploit User-Agent, followed by outbound connections from the victim host to known attacker-controlled infrastructure.
Detects unauthenticated HTTP POST requests targeting Oracle PeopleSoft PSEMHUB and PSIGW endpoints that are characteristic of the CVE-2026-35273 remote code execution exploit gadget chain.
Detects outbound network traffic to api.telegram.org. This pattern is commonly observed in malware such as Sauron ransomware to establish command and control (C2) channels and perform data exfiltration by abusing the legitimate Telegram Bot API.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects network requests from the Firefox browser process containing URI patterns and parameters often associated with data exfiltration or browser-based reconnaissance, including suspicious leakage parameters and local proxy/loopback communication attempts on non-standard ports.
This rule monitors web traffic logs for requests targeting administrative URI paths or containing the username 'admin' in the 'X-WEBAUTH-USER' header. It specifically filters out requests originating from trusted reverse proxies, identifying potential attempts to bypass authentication by manually injecting administrative headers.
This rule uses regular expressions to identify distinct URL structures associated with the Tycoon2FA AiTM (Adversary-in-the-Middle) phishing kit. Specifically, it looks for URIs containing patterns like "?auth=" followed by a base64-encoded string or "/login?email=" followed by a base64-encoded string, which are indicative of the kit's operation to capture credentials or session tokens.
This rule monitors the creation of new Azure Function Apps and identifies those that receive external, non-private network requests within 48 hours of their creation. This pattern may indicate the deployment of malicious or unauthorized serverless infrastructure for command-and-control, proxying, or automated tasks.
Detects potential exploitation of CVE-2026-0300 targeting PAN-OS and matches anomalous User-Agent string associated with CL-STA-1132 threat actor.
This rule detects network connections to phishing pages hosted on the workers.dev domain that are attempting to interact with EvilTokens device code API endpoints. These pages are known to implement developer hotkey prevention (F12 blocked, context menu disabled) to hinder in-browser analysis, indicating malicious intent.
Detects C2 traffic obfuscated within HTTP request bodies
Detects HTTP flood application layer DDoS attacks
This rule detects mass scanning activity targeting FortiGate SSL VPN login endpoints on non-standard HTTPS ports (4433, 4443, 8443, 9443, 10443, 541). It specifically looks for HTTP requests containing '/login' in the URI, indicating an attempt to find or interact with the VPN login page. The rule uses a threshold to identify mass scanning, triggering an alert if a source IP makes 10 or more such requests within 60 seconds.
Detects periodic beaconing behavior associated with a Lambsys Go-based implant communicating with a specific C2 IP address (83.142.209.214) over HTTP. The rule identifies POST requests to specific paths ('/status.php' or '/setup_status.php') using the 'Go-http-client/1.1' User-Agent, with evidence of repeated connection attempts.
Malvertising loader delivering CastleStealer via malicious Google Ads
Page 119 of 202