Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects keylogger captured data being exfiltrated via HTTP POST requests
Detects screen capture image data being exfiltrated via HTTP POST
Detects keylogger-captured data exfiltration via HTTP POST requests
Detects base64 encoded payloads in HTTP request bodies indicating obfuscation
This rule detects HTTP POST requests to pastebin.com's API for pasting content, specifically targeting the '/api/api_paste.php' endpoint. It triggers if the size of the data being uploaded is greater than 1000 bytes, indicating a potential data exfiltration attempt to a public text storage site.
This rule detects potential data exfiltration to OneDrive cloud storage. It specifically looks for HTTP PUT requests to onedrive.live.com or graph.microsoft.com with a URI containing '/content' and a data size greater than 10000 bytes. This combination suggests a large file upload to OneDrive.
This rule detects attempts to exfiltrate data to Google Drive cloud storage. It specifically looks for HTTP POST requests to 'www.googleapis.com' with the URI containing '/upload/drive/' and a data size greater than 10000 bytes. This pattern is indicative of a file upload operation to Google Drive.
This rule detects potential data exfiltration attempts via Discord webhooks. It specifically looks for HTTP POST requests to discord.com/api/webhooks/ with a data size greater than 500 bytes. This could indicate an attacker sending sensitive information out of the network using Discord's API.
This rule detects direct SSH connections to cloud virtual machines (VMs) via a serial console interface. It specifically looks for HTTP traffic where the host header contains 'compute.googleapis.com' or 'cloudshell.googleapis.com' and the URI contains 'serialPort'. This indicates an attempt to establish an SSH session through the cloud provider's serial console service, which can be used for administrative access or lateral movement within a cloud environment.
This rule detects when a client makes repeated HTTP requests to the SharePoint download.aspx page, specifically looking for the URI pattern "/_layouts/download.aspx". This behavior, when occurring frequently from a single source, could indicate an attempt to enumerate and potentially exfiltrate content from a SharePoint site. The rule uses a threshold of 20 requests within 60 seconds from the same source IP to trigger an alert, suggesting a bulk download or enumeration activity.
This rule detects attempts to exfiltrate wireless network lists (SSIDs) over HTTP POST requests. It specifically looks for HTTP POST requests with a body size greater than 200 bytes that contain the string "SSID" (case-insensitive). This activity is indicative of a trojan attempting to steal network information.
Docker Image Enumeration via API
Suricata
This rule detects attempts to enumerate Docker images via the Docker API. Specifically, it looks for HTTP requests to the '/images/json' endpoint on TCP port 2375, which is commonly used for unauthenticated Docker API access. This activity can indicate an adversary performing reconnaissance on a system to understand its Docker environment.
This rule detects the exfiltration of peripheral device information over HTTP POST requests. It specifically looks for HTTP POST requests with a body size greater than 200 bytes that contain the string "DeviceID" (case-insensitive). This pattern is indicative of malware or malicious scripts attempting to send device identifiers or other system information to a remote server.
This rule detects potential data exfiltration over HTTP POST requests. It specifically looks for HTTP POST requests with a client body size greater than 500 bytes and containing the case-insensitive string "ESTABLISHED". This combination suggests that network connection data might be embedded and sent out via HTTP POST, which is a common technique for command and control or data exfiltration.
This rule detects attempts to query Docker version and virtual machine information via the Docker API. It specifically looks for HTTP requests to port 2375 (commonly used for Docker API) with a URI containing "/version". This activity could indicate reconnaissance by an attacker trying to gather information about the Docker environment.
This rule detects attempts to enumerate Azure Blob Storage containers. It specifically looks for HTTP requests targeting Azure Blob storage hosts (ending with '.blob.core.windows.net') and containing the query parameter '?comp=list', which is used to list containers within a storage account. This activity is indicative of reconnaissance or discovery against Azure cloud resources.
This rule detects internal HTTP file transfers using the PUT method, specifically looking for executable files (identified by the 'MZ' header) being transferred. This behavior is indicative of a possible tool drop within a network, aligning with the MITRE ATT&CK technique T1570 (Lateral Movement - Internal HTTP File Transfer). The rule focuses on traffic within the home network, suggesting an internal adversary or compromised host attempting to move malicious tools.
This rule detects HTTP requests where the URI contains the string "%comspec%" (case-insensitive). This pattern is often used by attackers to obfuscate command execution, specifically by referencing the command interpreter (cmd.exe) via an environment variable, as part of defense evasion tactics. The rule is specifically looking for this string within the URI of an HTTP request flowing from the internal network to an external server.
Detects HTTP requests attempting to access known vulnerable endpoints or submit potentially malicious serialized data payloads to specific vulnerable WordPress plugins identified in recent CVEs (CVE-2025-7697, CVE-2025-7384, CVE-2025-6464, CVE-2025-6742). This rule specifically looks for common PHP serialized object ('O:') or array ('a:') syntax indicators within the URI query string when targeting known vulnerable plugin paths.
This rule detects the delivery of an executable file over HTTP where the filename in the URI contains a space character immediately before the file extension '.exe'. This technique is often used by attackers to obfuscate the true file type or to bypass basic file type checks, making the file appear as a non-executable or a different file type to a casual observer or some automated systems. The rule specifically looks for the pattern '.exe ' (dot, exe, space) in the HTTP URI, case-insensitive.
This rule detects HTTP traffic where the URI contains the string "FromBase64String" (case-insensitive). This string is often associated with PowerShell or .NET code that decodes a Base64 encoded string, which can then be executed. This technique is commonly used by attackers for defense evasion to obfuscate malicious payloads.
Page 143 of 202