Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects potential SQL Injection attempts by monitoring IIS web server logs (W3CIISLog) for URI queries containing common SQL keywords such as 'union', 'select', or 'drop'. It aggregates these attempts by client IP address over one-hour intervals and flags any IP address with 5 or more such attempts within that hour.
This rule detects attempts to obfuscate PowerShell commands by looking for the 'IEX' (Invoke-Expression) command combined with '(New-Object' within the HTTP URI. This combination is often used by attackers to execute malicious PowerShell scripts downloaded from a remote source, while attempting to evade detection through obfuscation.
Detects an unusually high volume (100 or more within an hour) of API calls (POST, DELETE, PUT methods to URIs containing 'api') originating from a single IP address. This activity could indicate various malicious behaviors such as brute-force attacks, credential stuffing, web application attacks, or a denial-of-service attempt against the API endpoint.
This rule detects HTTP traffic where the client body contains a long string of hexadecimal characters, which could indicate the use of non-standard encoding for Command and Control (C2) communication. The rule specifically looks for a hexadecimal string of at least 200 characters in the HTTP client body.
This rule detects HTTP traffic where the host is 'gist.github.com' and the URI contains '/raw/', indicating a potential Dead Drop Resolver using GitHub Gist for Command and Control (C2) activities. It triggers an alert if five such connections are observed from the same source IP within 300 seconds.
This rule detects attempts to deploy a malicious pod via the Kubernetes API. It specifically looks for HTTP POST requests to the '/api/v1/namespaces/' endpoint followed by '/pods', indicating an attempt to create a new pod within a Kubernetes namespace.
FOFA Internet Asset Search Query
Suricata
This rule detects HTTP requests where the host header contains 'fofa.info'. FOFA is an internet asset search engine, similar to Shodan. This detection indicates that a system within the HOME_NET is making queries to FOFA, which could be part of reconnaissance activities to gather information about internet-facing assets.
This rule detects a potential HTTP POST flood Distributed Denial of Service (DDoS) attack. It triggers an alert when a single source IP address sends 100 or more HTTP POST requests to the server within a 10-second window. This behavior is indicative of an attempt to overwhelm the server with requests, consuming resources and potentially leading to service disruption.
This rule detects HTTP POST requests where the client body contains a large string (over 200 characters) that appears to be Base64 encoded. The `pcre` (Perl Compatible Regular Expression) `/^[A-Za-z0-9+\/]{200,}={0,2}$/` specifically looks for strings composed of Base64 characters (alphanumeric, '+', '/', and optional '==') with a minimum length of 200 characters. This pattern is often used by malware for command and control (C2) communication to obfuscate data within HTTP traffic.
This rule detects attempts to inject OLE (Object Linking and Embedding) objects into web requests, specifically looking for the keywords 'CLSID' and 'ProgID' within the HTTP client body. This technique can be used for inter-process communication and potentially lead to arbitrary code execution or other forms of attack.
This rule detects HTTP traffic where the URI contains both "pcalua" and "-a" (case-insensitive). This pattern is indicative of indirect execution via pcalua.exe, a legitimate Windows utility that can be abused by attackers to proxy execution of other programs, often for defense evasion. The rule specifically looks for this behavior in HTTP requests, suggesting an attempt to download or execute a payload indirectly.
This rule detects HTTP requests originating from Microsoft Office Word that are attempting to fetch remote templates with specific file extensions (.dotx, .dotm, .dot). This behavior can be indicative of malicious documents attempting to retrieve external content, often used in phishing or malware delivery campaigns to bypass security controls or fetch additional stages of an attack.
This rule detects the delivery of an Electron application ASAR (Atom Shell Archive) package over HTTP. The detection is based on the presence of '.asar' in the HTTP URI, indicating a potential malicious Electron application being downloaded to a client within the home network. Electron applications are often used for desktop applications and can be exploited if malicious code is embedded within their ASAR packages.
This rule detects potential account takeover attempts by identifying the replay of stolen session cookies. It specifically looks for HTTP traffic from the home network to any destination, where the HTTP cookie header contains the case-insensitive string "session". A threshold of 5 occurrences within 3 seconds, tracked by destination, is used to trigger an alert, indicating a rapid succession of session cookie replays.
This rule detects attempts to access a known vulnerable endpoint in Ivanti Sentry appliances, specifically '/mics/api/v2/sentry/mics-config/handleMessage', via an HTTP POST request. This activity is indicative of exploitation attempts related to CVE-2026-10520, which is a pre-authentication OS command injection vulnerability.
Detects scraping of job listings to identify employee roles and technology stack
Detects web-based access to log files indicating log tampering attempts
Detects high-rate GET requests to contact pages for email harvesting
Detects symmetric encryption patterns in C2 communications for encrypted channel detection
Detects malware using spoofed browser user-agent strings for traffic masquerading
Detects bulk harvesting of Teams messages for credentials or sensitive data
Page 140 of 202