Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,443
11,831
5,875
5,151
4,864
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects HTTP requests containing the specific parameter 'k0f53cf964d387' in the query string or POST body. This parameter is the unique trigger used to activate the dormant 'base.Info' in-memory loader on vulnerable Ivanti EPMM instances.
Let's create a detection rule for "XONER dropper (multi-key download/execution)" based on xoner.sh. The key IOCs are as follows:
- C2/Hosting: 165.232.165.152:8080
- Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips, xoner_x86_64, etc.)
- Drop file name: xoner
- Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner xoner & execute → Delete file
Reported by Team_D4rkn3ttz
Detected by @bishop0218
- C2/Hosting: 165.232.165.152:8080
- Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips, xoner_x86_64, etc.)
- Drop file name: xoner
- Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner xoner & execute → Delete file
Reported by Team_D4rkn3ttz
Detected by @bishop0218
Detects attempts to deliver a Base64-encoded Java class to an Ivanti EPMM
server. This is characteristic of the "Sleeper Shell" campaign where attackers
plant a dormant in-memory backdoor. The rule looks for the Base64 string
'yv66vg', which corresponds to the 'CAFEBABE' Java magic bytes, in requests
targeting the known vulnerable path.
server. This is characteristic of the "Sleeper Shell" campaign where attackers
plant a dormant in-memory backdoor. The rule looks for the Base64 string
'yv66vg', which corresponds to the 'CAFEBABE' Java magic bytes, in requests
targeting the known vulnerable path.
This detection monitors for web requests to the specific URI path "/mifs/403.jsp". This path is known to be used by attackers to deploy a dormant Java-based webshell ("sleeper shell") on vulnerable Ivanti Endpoint Manager Mobile (EPMM) instances as part of an initial access campaign.
Detects network traffic matching patterns associated with ModeloRAT C2 communication, such as connections to known C2 IPs or the use of a specific beaconing URI.
The rule detects attempts to exploit Ivanti EPMM vulnerabilities CVE-2025-4427 and CVE-2025-4428. Specifically, it looks for unauthenticated or suspicious requests to the `/api/v2/featureusage` endpoint that contain parameters indicative of exploitation, such as `format` parameters with values like `${`, `Runtime`, `exec`, or `getRuntime`.
Detects potential exploitation of CVE-2026-25253, a 1-click RCE in OpenClaw, by identifying the 'gatewayUrl' query parameter in HTTP traffic. This parameter is used to hijack authentication tokens.
Detects HTTP POST requests to n8n webhook endpoints containing patterns associated with CVE-2026-25049, a type confusion vulnerability leading to Remote Code Execution. The detection looks for specific JavaScript destructuring or property access patterns used to bypass sanitization.
This rule detects network connections and DNS resolutions to a predefined list of known malicious IP addresses and domains. It also identifies HTTP requests containing specific URL paths ('update/update.exe', '/users/admin', '/api/') when made to these malicious IPs. This behavior is indicative of potential command and control (C2) communication or malware attempting to download updates or exfiltrate data.
Detects the download of a file with a double extension (e.g., invoice.pdf.exe). This is a common technique used to disguise malicious files and trick users into executing them.
Detects the DKnife gateway-monitoring framework, a toolset used by China-nexus actors for adversary-in-the-middle (AitM) attacks, based on specific file, network, and persistence artifacts.
Detects HTTP requests where the User-Agent string contains a full URL pointing to 'temp.sh'. This technique was observed in the Notepad++ supply chain attack where attackers passed the URL of exfiltrated data back to their C2 server within the User-Agent header.
This detection identifies common web attack patterns including SQL Injection (SQLi), Cross-Site Scripting (XSS), and Local File Inclusion (LFI) by inspecting URL and POST data for specific malicious patterns. It looks for indicators such as script tags, onerror/onload attributes, javascript: URIs, alert() functions for XSS; SQL keywords like UNION SELECT, xp_cmdshell, sp_configure, and common SQLi bypass patterns for SQLi; and directory traversal sequences (../../, ..%2f..%2f), and sensitive file paths like /etc/passwd, /windows/win.ini, php://filter for LFI.
Detects DKnife attempting to discover network information by sending a POST request with a specific password hash to a router management interface. This activity is associated with the DKnife framework, a China-nexus gateway-monitoring tool.
This query detects network traffic patterns associated with the DKnife Adversary-in-the-Middle (AitM) framework. Specifically, it looks for triggers used by the DarkNimbus backdoor to request C2 information from a compromised gateway. This includes HTTP requests to a specific Baidu URL used by the Android variant and UDP traffic to port 8005 used by the Windows variant.
This query identifies URL access attempts that were blocked by CATO Networks security policies, based on logs in CommonSecurityLog. It allows for filtering by specific devices or target URLs.
This rule identifies and aggregates blocked requests from Imperva WAF logs, grouping them by source IP address and then by the owning organization (ASN). It helps to detect and analyze potential attack campaigns or coordinated malicious activity originating from specific organizations or IP ranges. The rule focuses on security, session, and visitor blocks, providing details on attack names, query strings, referrers, and URLs.
Detects HTTP POST requests containing a JSON-RPC payload with the 'eth_call' method. This is often used by web-based crypto wallets or dApps to interact with the Ethereum blockchain, but can also be used by malicious JavaScript for activities like cryptojacking or wallet draining.
Detects instances where an AI agent process (e.g., Moltbot, ClawdBot) performs a web search or HTTP request containing suspicious internal identifiers (like API keys or project names) as URL parameters. This behavior is a hallmark of 'search-and-leak' exfiltration tactics, often triggered by indirect prompt injection.
Detects exploitation attempts and worm-like scanning behavior targeting Next.js applications, characteristic of the EtherRAT malware. The rule identifies web requests with the 'x-middleware-subrequest' header (CVE-2025-29927) or scanning of sensitive paths like '/_next/data/' from internal sources.
Detects attempts to exploit the Apache bRPC heap profiler command injection vulnerability, CVE-2025-60021. This is done by monitoring for HTTP GET requests to the `/pprof/heap` endpoint where the `extra_options` parameter contains shell metacharacters indicative of an RCE attempt.
Page 175 of 202