Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,443
11,831
5,875
5,151
4,864
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects attempts to inject path traversal or SQL-like syntax into the 'kid' (Key ID) parameter of a JSON Web Token (JWT) header. This may indicate an attempt to manipulate the server's key retrieval process to force signature validation with an improper key, potentially leading to an authentication bypass.
This rule detects activity related to the EmEditor watering hole attack, specifically looking for PowerShell execution making requests to known malicious lookalike domains and network connections to the associated infrastructure. A match suggests a potential download of malicious code during what appeared to be a legitimate install or update. Investigation should focus on identifying the host, user, source of activity, and legitimacy of the install source, followed by evidence preservation, credential reset, and a search for follow-up malicious activity.
Detects potential JSON Web Token (JWT) algorithm confusion attacks. This occurs when an attacker sends a token signed with a symmetric algorithm (e.g., HS256) to a server expecting an asymmetric one (e.g., RS256). If the server is misconfigured, it may use its public key as the HMAC secret, allowing the attacker to forge valid tokens. The rule specifically looks for JWTs with symmetric HMAC-based algorithms (HS256, HS384, HS512) being sent to applications configured to exclusively use asymmetric key algorithms.
This rule detects activity associated with UNC6201 exploiting Dell RecoverPoint VM (CVE-2026-22769), which involves the SLAYSTYLE/BRICKSTORM/GRIMBOLT malware. It identifies attempts to deploy WAR files via Tomcat Manager, suspicious WAR file uploads or modifications in Tomcat directories on Linux appliances, modifications to a persistence script named 'convert_hosts.sh', network communication with a GRIMBOLT C2 endpoint (149.248.11.71), and specific file hashes linked to the threat actor.
Detects HTTP requests to the 'compcheckresult.cgi' script containing the unique parameter 'vXm8DtMJG'. This pattern is a strong indicator of the RESURGE webshell, which is injected into the CGI script on compromised Ivanti Connect Secure devices to allow for remote command execution.
This rule detects various indicators associated with the Booking.com phishing campaign targeting hotels and customers. It identifies suspicious web requests to non-Booking.com domains containing 'op_token' and 'complaint' or 'reservation' keywords, especially when combined with punycode, 'booklng' typos, or management-related subdomains. It also looks for partner kit patterns involving 'sign-in/?tpo_token=' and 'booklng' in URLs. Additionally, it identifies suspicious emails from newly generated Gmail accounts with specific subjects ('Automatic reply', 'Availability', 'Reservation') containing 'op_token' in the subject or body.
This rule detects potential exploitation attempts against Grandstream GXP1600 series IP phones related to CVE-2026-2329. It specifically looks for HTTP requests to the '/cgi-bin/api.values.get' endpoint where the 'request' parameter in the URI query string has a length greater than or equal to 65 characters, which could indicate an attempt to trigger a buffer overflow or similar vulnerability.
This rule detects potential exploitation attempts against Grandstream GXP1600 series IP phones targeting CVE-2026-2329. It specifically looks for HTTP requests to the `/cgi-bin/api.values.get` endpoint where the `request` parameter in the URI query string has a length greater than or equal to 65 characters, which is indicative of an oversized request parameter often used in buffer overflow or similar vulnerabilities.
This rule detects activities associated with UNC6201 exploitation of Dell RecoverPoint VM, specifically looking for three distinct phases: Tomcat Manager WAR file deployment, modification of a persistence script on Linux, and communication with a GRIMBOLT C2 endpoint. The first part identifies WAR file deployments via Tomcat Manager. The second part looks for modifications to a specific persistence script file. The third part identifies network connections to a known GRIMBOLT C2 IP address or URL pattern.
This rule detects attempts to exploit CVE-2026-2329, a critical unauthenticated stack buffer overflow vulnerability in Grandstream GXP1600 VoIP phones. The detection is based on requests to the '/cgi-bin/api.values.get' URI path, which is associated with the vulnerability.
This rule detects HTTPS requests that should have been blocked but are not, for example:
Query Strings with malicious traits like 1=1, attempt to enter <script> in the URL,
URL containing ../ indicating Directory Traversal attempt, and so on.
Query Strings with malicious traits like 1=1, attempt to enter <script> in the URL,
URL containing ../ indicating Directory Traversal attempt, and so on.
This rule detects HTTP requests targeting the '/cgi-bin/api.values.get' endpoint with a 'request' parameter, which is indicative of exploitation attempts for CVE-2026-2329 in Grandstream GXP1600 series IP phones. This vulnerability allows for information disclosure.
Detects likely exploitation attempts for CVE-2026-2329 by matching requests to /cgi-bin/api.values.get where the first identifier in the request= parameter exceeds the 64-byte stack buffer described by Rapid7.
This rule detects attempts to exploit CVE-2026-2329, a critical unauthenticated stack buffer overflow vulnerability in Grandstream GXP1600 series VoIP phones. The detection logic specifically looks for HTTP requests to the '/cgi-bin/api.values.get' endpoint, with a particular focus on the 'request' parameter within the query string. A request parameter with a length greater than or equal to 65 characters is indicative of a potential exploit attempt, as this length is likely to trigger the buffer overflow.
This rule detects network connections or DNS queries to a list of domains identified as phishing campaign infrastructure. These domains are associated with a 'Signal Phishing Campaign' and are likely used for malicious purposes such as credential harvesting or malware distribution. The rule checks for these domains in `RemoteUrl` or `DestinationHost` fields across various network-related logs.
This rule detects attempts to exploit CVE-2026-2329, a critical unauthenticated stack buffer overflow vulnerability in Grandstream GXP1600 VoIP phones. The detection logic looks for HTTP requests to the vulnerable endpoint '/cgi-bin/api.values.get' and specifically for an oversized 'request' parameter where the first identifier before a colon is 65 characters or longer, indicating a likely buffer overflow attempt.
Detects outbound HTTPS traffic to specific URI paths and User-Agent strings hardcoded in MIMICRAT's malleable C2 profiles. These profiles impersonate legitimate web analytics traffic.
Detects network traffic to local proxy on port 7152 associated with malicious NuGet package C2 behavior.
This rule set detects various stages of the OysterLoader malware activity, including its registration and login attempts to a command and control (C2) server, specific C2 communication patterns via HTTP URIs, and connections to known OysterLoader C2 domains and IP addresses. The rules look for specific HTTP URI paths like "/reg" and "/login" combined with distinct User-Agent strings ("WordPressAgent" and "FingerPrint"), as well as specific API paths under "/api/" and hardcoded C2 domains and IP addresses.
Detects HTTP requests to vulnerable Ivanti EPMM endpoints containing URI patterns associated with active exploitation of CVE-2026-1281 and CVE-2026-1340. The rule looks for specific URI paths and the presence of a 'gPath' parameter, which is indicative of an exploitation attempt.
Page 173 of 202