Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects outbound HTTP connections to Cloudflare Workers URLs that match the dynamic, date-derived campaign folder parameters used by the GammaDrop malware. Specifically, it looks for URLs ending with a pattern like '/[A-Za-z0-9-]+/[a-z]+/[0-9]{2}.[0-9]{2}.[0-9]{3}/[0-9]+.(tif|bmp)'. This pattern is indicative of GammaDrop's command and control (C2) communication.
Searches for outbound GET requests containing specific parameter structures used to label harvested metadata sources, indicative of data exfiltration via the Stitch-SDK.
Detects web requests attempting to exploit CWE-78 in AutoGen MCP via base64 encoded parameters in the URL. Specifically looks for '/api/mcp/ws/' and 'server_params=' within syslog messages.
Identifies HTTP connections exhibiting Kazuar's distinct long, deeply nested URL path structures mimicking legitimate API endpoints. The rule specifically looks for URLs matching the pattern /api/v[1-3]/[a-z]+/[a-z]+/[a-f0-9]{32}/, which indicates a versioned API path followed by two alphabetical segments and a 32-character hexadecimal string, characteristic of Kazuar C2 beaconing.
Detects a click originating from a legitimate email or marketing redirection service and ending on a page that requests enterprise credentials. This behavior is indicative of a phishing attempt where an adversary leverages trusted email services to redirect users to a credential harvesting site.
Detects attempts to exploit a path traversal vulnerability in SharePoint's Upload.aspx page by looking for requests to 'Upload.aspx' that include both 'List=' and 'RootFolder=' parameters, specifically targeting sensitive catalogs like '_catalogs'. This indicates an attempt to upload files to unauthorized locations.
Detects requests to ErrTraffic's /api/index.php endpoint, which is known to be used for delivering dynamic payloads. This rule specifically looks for the query parameter '?a=ctx'.
Detects interaction with specific web shell or remote code execution parameters ('developer_api1_fm', 'developer_api1_eval') associated with the self-hiding backdoor plugin dropped during the OptinMonster supply chain attack. This rule identifies HTTP requests containing these parameters, which are highly specific to the threat actor involved in the OptinMonster supply chain compromise.
Detects HTTP POST requests directed to /V1/Update/GetUpdate, indicative of the OceanLotus downloader retrieving the next-stage payload (SPECTRALVIPER).
This rule detects unauthenticated POST requests to Serv-U that utilize 'deflate' content encoding, as described in a vendor advisory. It aims to identify exploitation attempts related to CVE-2026-28318 by filtering network events for specific HTTP POST request patterns. The XQL view retains actor and causality fields to aid in investigation.
Detects modern systems generating HTTP traffic using a hardcoded, outdated Internet Explorer 8 User-Agent string, which is indicative of malware beaconing.
Identifies HTTP POST requests indicative of rogue administrator account creation patterns ('dev_xxxxxx' or 'developer_api1') used in the OptinMonster, TrustPulse, and PushEngage supply chain attack. This rule specifically looks for POST requests to WordPress user creation endpoints containing attacker-controlled account names in the URI query.
This rule detects network connections to Azure infrastructure (azurewebsites.net) that utilize specific API paths associated with the MiniJunk C2 framework. The paths include '/api/app/check', '/api/app/update', and '/api/app/comment', which are indicative of command and control beaconing activity.
Detects unauthenticated SQL injection attempts targeting the Ghost CMS Content API by looking for suspicious slug filter ordering syntax (`slug:[` or its URL-encoded equivalent) in the query string. This rule specifically targets a known vulnerability, CVE-2026-26980.
Detects external HTTP POST requests to the Oracle PeopleSoft Environment Management Hub or Integration Broker listening connector. This activity could indicate an attempt to exploit public-facing Oracle PeopleSoft applications.
Detects external HTTP POST requests to vulnerable Oracle PeopleSoft Environment Management Hub (PSEMHUB) and Integration Broker endpoints. This behavior is associated with UNC6240 (ShinyHunters) zero-day exploitation of CVE-2026-35273.
Analyzes HTTP request headers to detect GammaLoad's unique User-Agent beacon containing the computer name and date format string.
This rule detects network connections to AzureWebsites (specifically '.azurewebsites.net') where the URI path matches patterns used by the Nimbus Manticore implant for command and control polling or initialization. The patterns include '/agent/poll?token=' or '/agent/init' or '/agent/result'. This indicates potential communication with a Manticore implant hosted on an Azure web app.
Detects modern systems generating HTTP traffic using a hardcoded, outdated Internet Explorer 8 User-Agent string, a static artifact of the loader's C2 channel. This specific User-Agent string is 'MSIE 8.0; Windows NT 6.0; WOW64; Trident/4.0'.
This rule detects potential credential exposure by identifying HTTP requests to IIS servers (W3CIISLog) that contain keywords like 'password' or 'token' in the URI query string, with a successful status code (200). This could indicate sensitive information being passed insecurely.
Identifies HTTP requests containing the custom 'X-Antibot-Token' header used by the EvilTokens phishing kit to validate interactions and evade automated scanners. This header is highly specific to the EvilTokens PhaaS and its presence indicates malicious activity.
Page 137 of 202