Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects potential browser fingerprinting activity or unauthorized WebRTC STUN requests, often associated with malicious landing pages, phishing, or automated detection evasion. It identifies the presence of specific browser API calls (RTCPeerConnection, navigator.deviceMemory, navigator.hardwareConcurrency) or suspicious use of STUN server ports (3478, 19302) on non-authorized domains.
Detects outbound network connections to a known malicious IP (83.142.209.214) associated with Lambsys cryptominer activity. The rule specifically monitors for HTTP POST requests to '/status.php' or '/setup_status.php' using the default 'Go-http-client/1.1' User-Agent, indicating a C2 beaconing pattern.
Detects high-volume credential stuffing attacks targeting the WordPress 'wp-login.php' endpoint. The rule monitors for multiple geographically distinct source IP addresses submitting HTTP POST requests to the login page within a 2-minute window. It specifically identifies traffic patterns associated with common infostealer-harvested credential campaigns (such as Vidar, Stealc, or DanaBot) by matching a specific User-Agent string associated with the campaign.
Detects anomalous automated enumeration of Microsoft Graph API user objects followed by keyword-based searches for sensitive HR, finance, and payroll-related information. This pattern is characteristic of post-compromise reconnaissance activities where an attacker leverages an existing session token to identify targets for further data exfiltration.
Detects a potential privilege escalation attempt in MyBB where a user with limited Administrator Control Panel (ACP) permissions modifies a user account to join the 'Administrator' group (ID 4) by POSTing to the 'user-users' module.
This rule detects network activity associated with a known malicious domain 'facture-in.pages.dev' or suspicious HTTP response patterns often observed in phishing kits or web-based redirection, such as 'BOT BLOCKED', 'no_mouse', 'wrong_timezone', or specific language-localized error messages.
This rule detects outgoing HTTP POST requests that contain a payload matching the signature of Ousaban malware's custom XOR-encoded command-and-control (C2) traffic, characterized by a specific hexadecimal structure.
Detects attempts to generate SQL injection payloads by abusing Ollama servers, specifically targeting unauthenticated HTTP POST requests to /api/generate or /api/chat on port 11434. The rule looks for SQL injection indicators and VAPT framework specific strings within the request context, URI, or user agent.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects signs of HTTP request smuggling attempts targeting nghttpx or similar proxies. The rule monitors for a specific poisoning precondition where an HTTP/1.1 Upgrade request contains both an 'Upgrade' header and a 'Content-Length' header, which can be leveraged to desynchronize the connection and smuggle subsequent requests (e.g., GET /poisoned).
Detects HTTP traffic involving redirect chains from known Gmail URL shorteners (goo.gl, g.co, short.gy) that terminate at the identified credential-harvesting domain chongdaotang.net. This behavior is indicative of a phishing campaign designed to harvest user credentials through a multi-stage redirect.
Detects network connections to known malicious domains or IP addresses associated with Fortinet or Ivanti VPN phishing campaigns or command and control infrastructure. This rule identifies attempts to connect to fake VPN portals or communicate with adversary-controlled servers.
Detects web access logs matching the specific 'wp_debug_session' parameter used by the ErrTraffic webshell to communicate with compromised servers. This rule identifies HTTP requests containing both 'wp_debug_session=' and 'mode=php' in the URI query, which are indicators of the ErrTraffic webshell activity.
Correlates a user passing a CAPTCHA gate (Cloudflare Turnstile, reCAPTCHA) with an immediate subsequent connection to an unknown, low-prevalence domain hosting the actual phishing landing page.
Detects HTTP POST requests directed to /V1/Update/GetUpdate, indicative of the OceanLotus downloader retrieving the next-stage payload (SPECTRALVIPER).
This rule detects a specific typosquatting pattern used by the EvilTokens phishing kit. It looks for HTTP traffic where the host contains 'workers.dev' and matches a regular expression for 'viewdoc[a-z0-9\-]+\.workers\.dev'. This indicates an attempt to mimic legitimate Cloudflare Workers domains for phishing purposes, specifically targeting the 'viewdoc' pattern often seen in document-sharing lures.
This rule detects network traffic indicative of the 'EvilTokens' phishing kit, specifically targeting Microsoft OAuth Device Code flow. It looks for HTTP POST requests to the '/api/device/start' URI on domains hosted on Cloudflare Workers ('.workers.dev'). This pattern suggests an attempt to initiate a device code phishing attack, where adversaries trick users into entering credentials or codes to grant access to malicious applications.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
Detects EvilTokens phishing kit gate check requests to /api/device/gate/ used to identify and burn phishing pages for security researchers
Detects anomalous web session traffic that proxies enterprise authorization endpoints (e.g., oauth, saml, login) while simultaneously interacting with session-related cookies. This behavior is indicative of an Adversary-in-the-Middle (AiTM) proxy setup used to capture session tokens and bypass authentication.
Page 125 of 202