Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,877
5,156
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects unauthorized HTTP requests to sensitive Cisco Identity Services Engine (ISE) API and administrative paths (/ers/, /admin/, /api/). The rule specifically looks for incoming requests that lack both an Authorization header and a Cookie header, which is indicative of potential exploitation attempts against vulnerabilities such as CVE-2026-76460, where authentication mechanisms might be bypassed or ignored.
Detects endpoint-based retrieval of potential malicious payloads or configurations from blockchain-hosted infrastructure (e.g., Infura, Alchemy, public RPC nodes) using web-based RPC calls, followed by the execution of a script interpreter (e.g., PowerShell, WScript, MSHTA). This pattern is characteristic of 'EtherHiding' campaigns where smart contracts are used as decentralized and takedown-resistant storage for second-stage delivery.
This rule monitors for indicators of compromise (IOCs) associated with the TrustSink rogue MFA provider, specifically tracking the domain 'trident-sip-filter.ngrok-free.dev' and its associated OIDC discovery path. It aggregates signals from sign-in logs, audit logs, DNS queries, and network proxy traffic to identify attempts to interact with this malicious infrastructure.
This rule detects potentially malicious POST requests to SharePoint endpoints (such as AddGallery.aspx) that include indicators of WebPartMarkup or ToolPane payloads. This activity attempts to bypass the SPUtility.EnsureAuthentication() check that is typically enforced on the ToolPane.aspx page, potentially allowing unauthorized code execution or configuration manipulation.
Detects network exploitation attempts targeting Fortinet FortiOS and FortiProxy vulnerabilities (CVE-2024-55591, CVE-2025-24472) involving authentication bypass via HTTP header manipulation (Forwarded, X-Forwarded-For) and unauthorized access to the /jsconsole endpoint.
Detects network exploitation attempts targeting Fortinet FortiOS and FortiProxy vulnerabilities (CVE-2024-55591, CVE-2025-24472) involving authentication bypass via HTTP header manipulation (Forwarded, X-Forwarded-For) and unauthorized access to the /jsconsole endpoint.
This rule correlates web clicks on Google Sites URLs containing keywords related to GlobalProtect with the subsequent creation or renaming of an unsigned or improperly signed GlobalProtect.msi file on the same endpoint within a 30-minute window. This behavior is indicative of a spearphishing attempt using a masqueraded landing page to deliver malicious or unauthorized software.
Detects HTTP beaconing activity associated with the MacSync stealer malware on macOS platforms. The rule monitors for specific URI patterns ('curl', 'dynamic', 'gate') combined with macOS-specific User-Agent strings and potential credential exfiltration headers, indicating established communication with a Command and Control (C2) server.
Detects HTTP POST requests directed at Grav CMS endpoints where the __unique_form_id__ parameter contains directory traversal sequences (e.g., ../). This behavior is indicative of attempted exploitation of CVE-2026-42608, aimed at bypassing file system restrictions to write files to unauthorized locations outside the application's expected form data directory.
Detects clicks on sponsored search engine ads that redirect users to Google Cloud Storage (GCS) buckets with names or paths designed to impersonate the 'Ledger' brand. These artifacts are indicative of a malvertising campaign using typosquatted storage paths to deliver malicious payloads or credential harvesting pages.
Hunts network, HTTP, and email-URL telemetry for known ARToken infrastructure (operator backend IPs and phishing/panel domains). Bounded to a 30-day lookback and tiers matches by confidence: domain hits are high-confidence (attacker-registered infrastructure), while IP hits are medium-confidence since the IPs sit on shared DigitalOcean hosting that can be reassigned to unrelated tenants once ARToken's infrastructure is taken down. Empty/unparsed indicator fields are excluded to avoid spurious matches in the HTTP event parsing branch. No known file hashes are associated with this intel.
Detects activity from known Storm-3168 (JADEPUFFER) campaign IP addresses across Azure control-plane, sign-in, and App Service logs. The rule monitors for malicious indicators in Azure Activity logs, Azure Sign-in logs, and Service Principal sign-ins, as well as specific sensitive URI paths (e.g., shells, admin login paths) within App Service HTTP logs.
Detects endpoint, process, and network activity associated with the 'TaskStomp' threat actor, specifically targeting known malicious file hashes, command-and-control domains, and specific URLs used in their campaigns.
This rule detects potential exploitation of the Oracle PeopleSoft PSEMHUB component vulnerability (CVE-2026-35273). It identifies suspicious POST requests to the PSEMHUB HttpListeningConnector servlet, including obfuscated URL paths, followed by the creation of suspiciously named .jsp or .jspx files in the PSEMHUB.war application directory, which is indicative of a web shell deployment.
Detects network activity associated with the AgtaBackup RAT, specifically identifying custom HTTP headers for agent authentication, beaconing patterns to check-in endpoints, and establishment of WebSocket-based command and control channels.
Detects outbound HTTP GET requests for common AI model file formats (.pkl, .pt, .bin) from non-authorized or untrusted external domains. This activity is indicative of downloading potentially malicious pre-trained AI models, which can execute arbitrary code during the unpickling process (Supply Chain Compromise).
Detects high-volume web crawling or reconnaissance activities originating from autonomous AI agent frameworks, such as AutoGPT, BabyAGI, LangChain, or CrewAI. These activities are identified by analyzing User-Agent strings and applying threshold-based rate limiting to identify potential automated reconnaissance patterns.
Detects HTTP requests where the User-Agent header matches known strings associated with AI-powered penetration testing or reconnaissance agents, such as PentestGPT, AutoGPT, or AI-Recon tools.
Detects high-frequency POST requests to API endpoints, potentially indicative of automated fuzzing or brute-force parameter mutation attacks, by identifying 50 requests from a single source within a 10-second window.
Detects unauthenticated HTTP requests directed at management or schema APIs for common vector databases (Milvus, Weaviate, Qdrant). These requests lack the required Authorization header, potentially indicating unauthorized reconnaissance or attempts to exploit public-facing database management interfaces.
This rule detects attempts to exploit a command injection vulnerability (CVE-2026-49869) in the Kestra workflow automation platform. The rule monitors HTTP POST requests to the '/api/v1/flows' endpoint, identifying payloads that define flow types involving shell or execution plugins and contain suspicious command sequences (e.g., shell operators combined with common system utilities like nc, bash, or curl).
Page 17 of 202