Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects suspicious patterns within the search query parameters of Microsoft Copilot and M365 search requests, indicative of potential prompt injection, data exfiltration, or exploitation attempts through malicious URL parameters.
Detects Python interpreter activity associated with the LegionLoader malware, specifically monitoring for Python execution from within the 'AppData\Roaming\Traiolx' directory, or outbound network connections from Python processes to known malicious infrastructure such as 'birdeemusic.com' or other suspicious outbound HTTP/HTTPS communication.
This rule monitors network, proxy, and DNS traffic for connections to the domain 'perplexity-ai.online'. It identifies potentially suspicious activity by aggregating requests and distinguishing between general outbound traffic and traffic to specific endpoints, such as search queries that may indicate data exfiltration or reconnaissance.
Detects outbound network traffic associated with Djinn Stealer malware beaconing to a hardcoded C2 IP address (96.126.130.126) on port 58942. The detection specifically monitors for HTTP POST requests containing the malicious User-Agent 'telemetry-client/1.0' and 'application/octet-stream' content-type, which are characteristic of this stealer's exfiltration activity.
This rule detects the updated GammaLoad malware's User-Agent variant. This variant is characterized by replacing double colons with double semicolons in the User-Agent string and appending '/.wsntimidate/.' to it. The detection logic specifically looks for HTTP connection events where the User-Agent matches a regex pattern indicative of this GammaLoad variant.
Detects browser processes invoking internal extension schemes and subsequently generating high volumes of network requests to e-commerce or advertising-related domains/URLs, indicating potentially malicious browser extension behavior such as affiliate tag substitution or ad-injection.
Detects HTTP requests that include an 'Upgrade' header (specifically for websocket or h2c) in conjunction with a 'Content-Length' header. This combination can be used to perform HTTP Request Smuggling or protocol-specific request queue poisoning attacks, particularly against load balancers or proxy servers like nghttpx.
Detects deployment of phishing landing pages on attacker infrastructure
This rule detects suspicious activity involving interaction with the 'perplexity-ai.online' domain and the creation of specific browser extension files, which may indicate browser-based data exfiltration or credential theft. The rule correlates file creation events, DNS queries, and network connections, assigning a higher risk score when multiple indicators are present, particularly when evidence suggests exfiltration of keystroke or search data via web requests.
Detects access to robots.txt and sitemap files for web structure reconnaissance
Detects automated scraping of company location and headquarters pages
Detects HTTP/1.1 Upgrade requests directed at an nghttpx proxy that contain a non-zero Content-Length header. This combination is the core primitive for the nghttp2-nghttpx-upgrade-queue-poison-poc attack, where the proxy incorrectly forwards request body bytes to the next backend connection user.
This rule detects attempts to exploit MyBB administrative controls. It monitors for two primary patterns: unauthorized privilege escalation where a limited ACP account creates a new Administrator (usergroup=4) user by bypassing access controls, and unauthorized access by limited ACP accounts to restricted administrative modules such as template and plugin management.
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
Detects potential HTTP Request Smuggling attempts targeting the nghttpx reverse proxy by monitoring for HTTP/1.1 'Upgrade: h2c' requests that include a 'Content-Length' header, or traffic containing known PoC-specific payloads, poisoned paths, or specific nghttp2 version strings that indicate exploitation activity.
Detects outbound HTTP requests exhibiting a User-Agent string hardcoded to mimic Firefox 20.0 (Mozilla/5.0 (Windows NT 6.2; rv:20.0) Gecko/20121202 Firefox/20.0), which is characteristic of the Adaptix C2 framework. This pattern is commonly used by adversaries for command-and-control communication.
Correlates the successful DNS resolution of a legit domain to a malicious IP, followed by an HTTP POST submitting stolen credentials. Specifically looks for POST requests to 'login.microsoftonline.com' where the remote IP address is not a known Microsoft IP range (13.x.x.x or 20.x.x.x).
This rule detects a POST request to the MyBB administrative interface (specifically the user-users module) that contains parameters indicating an attempt to escalate a limited administrative user to a full administrator by assigning the 'usergroup=4' or 'gid=4' identifier, which corresponds to the default Administrator group in MyBB.
Detects potential HTTP Request Smuggling attempts targeting nghttpx proxies. The rule monitors for malicious request patterns involving HTTP/1.1 Upgrade headers combined with a body (Content-Length) designed to poison the request queue, as well as specific path patterns (e.g., /upgrade, /poisoned) or server-agent identification of the nghttp2/nghttpx service.
Detects potential privilege escalation within the MyBB Administrative Control Panel (ACP). The rule identifies POST requests to user management modules that set a user's group ID (gid) or usergroup to 4, which typically corresponds to the administrator group in MyBB. It verifies the escalation by correlating it with a prior session that lacked administrator privileges and identifying a subsequent login event.
Detects unauthorized attempts to escalate privileges within the MyBB Admin Control Panel (ACP) by creating a new account or modifying an existing one to belong to the administrator group (gid=4). This is indicative of an attacker attempting to gain full administrative control by bypassing module-level access restrictions.
Page 133 of 202