Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,443
11,831
5,875
5,151
4,864
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects HTTP requests targeting the Oracle Identity Manager REST API that contain known authentication bypass suffixes, such as `?WSDL` or `;.wadl`. This indicates an attempt to exploit the initial authentication bypass stage of the CVE-2025-61757 exploit chain.
This rule detects HTTP GET requests containing specific URL patterns associated with Calisto phishing campaigns. The patterns include '/vendor/plugx/', '/wp-content/plugins/(bungs|areada|leykos)/', '/prueba/phantomrise/', or '/plugins/unite/', combined with the 'utm_refferer=' parameter in the URI. This indicates an attempt to redirect users to malicious content, likely as part of a phishing attack.
Detects network traffic consistent with RomCom's Mythic C2 framework. This includes connections to known C2 domains or requests for specific URI paths that return a 403 Forbidden status with an Nginx server header, a known fingerprint of this infrastructure.
This detection rule identifies hosts where data archiving using 7-Zip is closely followed by network traffic to the temp.sh file-sharing service. This correlation suggests a potential data staging and exfiltration sequence, a TTP observed in the Lynx Ransomware campaign.
Detects the ToolShell exploit chain used against SharePoint servers. This exploit involves a POST request to ToolPane.aspx with a spoofed Referer header pointing to SignOut.aspx, which is a key indicator of this specific attack.
Detects potential Command and Control (C2) communication from the AK47C2 backdoor over HTTP. The backdoor sends a hex-encoded JSON payload via HTTP POST requests. This rule specifically looks for HTTP POST requests with a request body longer than 100 characters that consists entirely of hexadecimal characters, indicative of the AK47C2 communication pattern.
This rule detects web requests targeting SharePoint endpoints associated with the ToolShell exploit chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771). This activity is linked to the threat actor CL-CRI-1040 (also known as Storm-2603). The rule specifically looks for requests to "/_layouts/15/ToolPane.aspx" or "/_layouts/15/SignOut.aspx" that also contain suspicious strings indicative of command execution or file manipulation attempts, such as "cmd.exe", "powershell", "whoami", "ipconfig", "systeminfo", "&cmd=", or "&file=".
This query identifies an anomalous pattern associated with behavior performed using the PhaaS platform with adversary-in-the-middle (AiTM) capabilities, Tycoon2FA.
This query identifies an anomalous pattern associated with behavior performed using the PhaaS platform with adversary-in-the-middle (AiTM) capabilities, DadSec.
This rule detects outbound HTTP traffic where the User-Agent header contains the string 'Internet Explorer'. This has been seen used by malware, and the legitimate Internet Explorer browser uses the User-Agent string "MSIE". The MSIE browser was end-of-lifed in 2022. The rule specifically looks for this pattern in established, to_server HTTP flows.
This rule detects command and control (C2) communication associated with the Lazarus Group's ScoringMathTea Remote Access Trojan (RAT). It specifically looks for HTTP traffic where the User-Agent header matches a known string used by this malware: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.42'. This User-Agent string attempts to masquerade as a legitimate Microsoft Edge browser.
Detects potential command injection attempts against Citrix NetScaler ADC and Gateway devices. This detection is based on the patterns described in a hypothetical proof-of-concept for CVE-2025-7775, which involves injecting shell commands and referencing sensitive system paths in HTTP requests.
Detects exploitation attempts targeting a code injection vulnerability in XWiki's SolrSearch macro (CVE-2025-24893). Attackers can inject malicious Groovy code through specially crafted requests to the SolrSearch endpoint, leading to unauthenticated remote code execution.
This rule detects Command and Control (C2) beaconing activity associated with the UNC1549 threat group and the LIGHTRAIL malware. It specifically looks for HTTP traffic with a URI containing '/news', an 'Upgrade: websocket' header, and a distinct User-Agent string 'Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10136'. This combination of indicators suggests an attempt to tunnel C2 communications over HTTP, potentially masquerading as legitimate WebSocket traffic.
Detects when multiple distinct domains, where at least one is known malicious, share the same HTTP body SHA1 hash or favicon MD5 hash. This pattern is indicative of threat actor infrastructure reuse and templating, as described in analysis of campaigns like LaundryBear and FreeDrain.
Detects the RedTail cryptominer targeting exposed Docker APIs by looking for specific HTTP request patterns, including the 'libredtail-http' user agent and 'docker.selfrep' parameter in the request body.
Detects outbound HTTP GET requests consistent with Lumma Stealer's browser fingerprinting activity. This activity involves contacting a C2 endpoint at '/api/set_agent' with specific URL parameters ('id', 'token', 'description') to register the victim and gather system information.
This rule detects inbound HTTP requests containing the User-Agent string 'Salesforce-Multi-Org-Fetcher/1.0'. This specific User-Agent has been associated with data theft from Salesforce instances, as detailed in a Google Cloud blog post. The detection aims to identify potential malicious activity targeting web server applications, specifically Salesforce environments, where an attacker might be attempting to exfiltrate data.
This rule detects inbound HTTP requests containing the User-Agent string 'Salesforce-CLI/1.0'. This activity is considered suspicious as it may indicate reconnaissance or data theft attempts targeting Salesforce instances, potentially leveraging compromised credentials or systems. The presence of this specific User-Agent inbound to a network could be an indicator of malicious activity, as Salesforce CLI is typically used by developers and administrators for managing Salesforce organizations and is not expected to be seen in inbound traffic from external networks to internal systems.
Detects attempts to exploit the Triofox authentication bypass vulnerability (CVE-2025-12480) by sending a request with a 'localhost' Host header from an external IP address to access administrative pages. This allows an attacker to create a new administrative account.
This detection identifies network traffic to domains explicitly listed as associated with recent phishing campaigns. It specifically looks for these domains within the RequestURL field of logs from Palo Alto Networks or Cato Networks firewalls/proxies.
Page 178 of 202