Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,445
11,833
5,875
5,151
4,864
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects network connections or web requests to the specific malicious GitHub repository paths used to host the 5th and 6th stage payloads of the Miasma malware (a Shai-Hulud variant).
Detects network connections to the Cobalt Strike C2 URI path '/statistics/discover.txt', indicating active communication from a FrostyNeighbor Cobalt Strike beacon. Identifying this beacon is critical for finding fully compromised hosts under active remote control.
Detects network connections to the URI path '/employment/documents-and-resources', which is used by FrostyNeighbor's PicassoLoader to exfiltrate host fingerprinting data and assess compromised hosts for further payload delivery.
Tycoon2FA Kit URL Parameters
Cortex XDR
Identifies network traffic containing the distinct 'bltpg' and 'sid' parameters used by the Tycoon2FA credential harvesting platform. This rule specifically looks for HTTP network data containing both 'bltpg=' and 'sid=' within the action_network_http field, which are indicative of the Tycoon2FA phishing kit's communication patterns. The rule then deduplicates alerts based on agent hostname and remote IP to reduce alert volume.
FDMTP C2 Registration Request
Cortex XDR
Detects network HTTP requests to the '/GetCluster' endpoint containing the 'DotNet-TcpDmtp' protocol parameter, a specific C2 registration pattern used by the updated FDMTP backdoor.
Detects network connections, DNS queries, or web requests to domains associated with the Mini Shai-Hulud supply-chain attack.
This attack compromised multiple npm and PyPI packages (such as TanStack, Mistral AI, and UiPath) with a payload that exfiltrates harvested credentials to the Session messaging protocol's file server and downloads additional stages from attacker-controlled domains.
This attack compromised multiple npm and PyPI packages (such as TanStack, Mistral AI, and UiPath) with a payload that exfiltrates harvested credentials to the Session messaging protocol's file server and downloads additional stages from attacker-controlled domains.
POW Proxy-over-Web Custom HTTP Headers
Cortex XDR
Detects HTTP traffic containing the custom POST headers used by the SHADOW-AETHER-064 'POW' (Proxy over Web) tool to encapsulate SOCKS5 traffic inside HTTP requests forwarded through JSP webshells. The full header set per Trend Micro's analysis is X-Act, X-Sid, X-Host, X-Port, and X-Status. The X-Act header carries one of five specific command values (CONNECT, SEND, RECV, DISCONNECT, PING) which provides an additional fidelity boost. The combination of two or more of these headers in a single HTTP transaction is exclusive to the POW tool.
Detects multiple threat behaviors associated with the Mini Shai-Hulud supply chain worm campaign. This includes memory scraping for secrets, execution of malicious Node/Bun payloads, connection to known C2 domains, and file operations related to persistence.
This rule detects exploitation attempts targeting CVE-2026-0300 in Palo Alto Networks PAN-OS. It identifies suspicious network connections to User-ID Authentication Portal ports (6081, 6082) from external IP addresses, excluding RFC1918 and loopback ranges. Additionally, it looks for a specific anomalous User-Agent string associated with the CL-STA-1132 threat actor, which has been observed during exploitation of this vulnerability.
Detects truncated 'whostmgrsession' cookies missing the comma delimiter, which is a necessary step for attackers to inject cleartext CRLF payloads into cPanel session files and bypass authentication. This rule specifically looks for the 'whostmgrsession' cookie in web or proxy logs where the cookie value matches a regex pattern indicating the absence of the expected comma delimiter, a characteristic of the CVE-2026-41940 exploitation.
Detects the generation of pre-authentication session cookies via intentionally failed login attempts to the `login_only` endpoint. This detects the initial staging phase of the CVE-2026-41940 exploit chain.
CL-STA-1132 Specific User-Agent
Cortex XDR
Detects network traffic utilizing the highly specific and anomalous User-Agent string used by CL-STA-1132 during the exploitation and post-exploitation of CVE-2026-0300.
Detects HTTP network connections to the specific exfiltration endpoint (mozbra.php) used by PhantomRaven to exfiltrate stolen CI/CD tokens and developer credentials.
Suspicious PAN-OS Captive Portal Access
Cortex XDR
Detects anomalous or repetitive access to PAN-OS Captive Portal HTTP endpoints which may indicate active scanning for CVE-2026-0300 vulnerability exposure.
CVE-2026-0300 Scanner Tool User-Agent
Cortex XDR
Detects the use of the CVE-2026-0300 scanner tool by its distinct User-Agent string attempting to identify vulnerable PAN-OS Captive Portals.
Detects the initial staging phase of the CVE-2026-41940 exploit chain, where an attacker intentionally generates a pre-authentication session file on the target server via failed POST requests to the login_only endpoint.
For network requests to the GitHub API containing specific staging and fallback markers (LongLiveTheResistanceAgainstMachines or beautifulcastle) used by TeamPCP in the Bitwarden CLI campaign to retrieve C2 instructions.
Detects a specific combination of HTTP GET, POST, and PUT requests to the GitHub API (api.github.com) within a short timeframe. This sequence matches the behavior of the AdaptixC2 custom listener used by Tropic Trooper, which uses GitHub issues for beaconing/task polling and the contents API for data exfiltration. The detection has been refined to look for specific AdaptixC2 operational keywords ('beat', 'upload', 'download') to reduce noise.
Detects HTTP requests containing the custom 'X-Hacked-By' header with the value 'Nexus Team . Exploited By Erratic', which is associated with the Nexus Team's exploitation of CVE-2024-3721 against TBK DVR devices. This rule specifically looks for the unique header pattern used by this threat actor.
Detects network connections, DNS requests, and HTTP traffic to known Tropic Trooper C2 infrastructure, indicating potential AdaptixC2 or Cobalt Strike beaconing from compromised endpoints.
Detects HTTP POST requests destined for specific PHP endpoints (/res.php, /tele.php) frequently used by the BlobPhish campaign to exfiltrate stolen credentials from memory-resident phishing pages.
Page 169 of 202