Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,443
11,831
5,875
5,151
4,864
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects network traffic potentially associated with a scraper botnet variant that uses the "Hello-World/1.0" user-agent string and performs GET requests. This activity is indicative of reconnaissance or data scraping.
Detects attempts to bypass authentication in Fortra GoAnywhere MFT by exploiting a vulnerability (CVE-2025-10035). This is achieved by sending a crafted GET request to the Unlicensed.xhtml endpoint to trigger an exception and obtain a valid license request token, which is a prerequisite for further exploitation.
Detects potential LINE VIPER tasking activity via Cisco ASA WebVPN authentication requests. This involves looking for specific XML elements (<client-cert> or <client-cert-auth-signature>) containing large Base64-encoded data, which is indicative of embedded shellcode.
This detection rule identifies potential SEO poisoning activity associated with the Operation Rewrite campaign. It looks for a high volume of web requests from a single source IP where the HTTP referrer indicates the traffic originated from a search engine. This pattern can indicate a compromised host being used for malicious purposes or a user interacting with multiple poisoned search results.
Detects potential Cloudflare Under Attack Mode (UAM) bypass activity, characteristic of the ShadowV2 botnet. This involves the execution of a headless browser followed by network requests using a Cloudflare clearance cookie.
This rule detects attempts to exploit CVE-2025-49706 in SharePoint by observing POST requests to a vulnerable aspx path, which could result in code execution or server compromise.
This rule correlates Microsoft Defender for Endpoint (MDE) SmartScreen and Network Protection blocks with network activity logs. It specifically looks for instances where SmartScreenUrlWarning or ExploitGuardNetworkProtectionBlocked events occur due to 'CustomBlockList' or 'CustomPolicy' settings. The rule then joins these events with DeviceNetworkEvents to identify the associated URLs, remote IP addresses, and ports involved in the blocked network communication. The primary goal is to identify and provide context for network access attempts that are blocked by custom security policies, indicating potential malicious or unwanted website access.
The following analytic identifies attempts to access the Remote ShellServlet on a web server, specifically targeting Confluence servers vulnerable to CVE-2023-22518 and CVE-2023-22515. It leverages web data to detect URLs containing "*plugins/servlet/com.jsos.shell/*" with a status code of 200. This activity is significant as it is commonly associated with web shells and other malicious behaviors, potentially leading to unauthorized command execution. If confirmed malicious, attackers could gain remote code execution capabilities, compromising the server and potentially the entire network.
The analytic detects long URLs containing multiple SQL commands, indicating a potential SQL injection attack. This detection leverages web traffic data, specifically targeting web server destinations with URLs longer than 1024 characters or HTTP user agents longer than 200 characters. SQL injection is significant as it allows attackers to manipulate a web application's database, potentially leading to unauthorized data access or modification. If confirmed malicious, this activity could result in data breaches, unauthorized access, and complete system compromise. Immediate investigation and validation of alerts are crucial to mitigate these risks.
Detects network traffic consistent with XWorm malware using the Telegram API for Command and Control (C2) or data exfiltration. This rule specifically looks for HTTP requests to 'api.telegram.org' with URL patterns indicative of sending messages or files via the Telegram Bot API (e.g., /bot<token>/sendMessage, /bot<token>/sendDocument, /bot<token>/sendPhoto).
The analytic detects the presence of the Supernova webshell, used in the SUNBURST attack, by identifying specific patterns in web URLs. The detection leverages Splunk to search for URLs containing "*logoimagehandler.ashx*codes*", "*logoimagehandler.ashx*clazz*", "*logoimagehandler.ashx*method*", and "*logoimagehandler.ashx*args*". This activity is significant as it indicates potential unauthorized access and arbitrary code execution on a compromised system. If confirmed malicious, this could lead to data theft, ransomware deployment, or other severe outcomes. Immediate steps include reviewing the web URLs, inspecting on-disk artifacts, and analyzing concurrent processes and network connections.
This power query is to detect NPM package is downloaded by the user, using the SentinelOne Singularity Power query.
Detects potential Adversary-in-the-Middle (AiTM) phishing activity, commonly associated with frameworks like Evilginx. The rule identifies suspicious domain patterns where legitimate identity provider (IdP) domains are used as subdomains of another domain, or where IdP-related keywords are used in hyphenated subdomains.
The following query is oriented to extend information about the potential threats associated with distinct HTTP status code. This allows me to quickly work with other KQL queries to identify potential threats. Consider this KQL query as a "Pivot Table" for multiple queries that can be triggered based on your criteria.
This rule detects the creation of Scalable Vector Graphics (SVG) files on a system, particularly those initiated by common applications like Outlook, web browsers, or archive utilities. It then correlates this file creation with subsequent network activity from a browser process within a 5-minute window. The network activity is further scrutinized for suspicious URLs, specifically those using Cloudflare Workers domains with a specific pattern or URLs containing an '@' symbol, which can indicate obfuscation or malicious redirection attempts. This behavior is indicative of SVG smuggling techniques used to deliver malicious payloads or redirect users to phishing sites.
Base64 Website Access
YARA-L
Detects a user accessing multiple websites commonly used for Base64 encoding and decoding within a short time frame. This activity could be a precursor to data exfiltration or an attempt to obfuscate malicious commands.
Detects an exploit attempt against Sitecore vulnerability CVE-2025-53690. This rule correlates an HTTP POST request to '/sitecore/blocked.aspx' with a subsequent 'ViewState verification failed' Windows Event Log (EID 1316) from the same source IP and target host.
Detects attempts to exploit the Sitecore Experience Platform HTML cache poisoning vulnerability (CVE-2025-53693). Attackers can send a crafted HTTP request to a specific XAML handler to poison the HTML cache, leading to website defacement or client-side code execution.
Detects attempts to exploit the Citrix NetScaler RCE vulnerability (CVE-2025-7775) by identifying a specific POST request to a vulnerable endpoint, followed by a GET request to verify code execution.
Detects the use of known malicious or suspicious User-Agent strings associated with the UNC6395 data theft campaign targeting Salesforce instances.
Detects network requests to common IP geolocation services, such as 'ip-api.com/json'. This is a known anti-analysis technique used by malware, including a loader associated with the Silver Fox APT group, to determine if it is running in a research or sandbox environment by checking the public IP address, ISP, and organization.
Page 188 of 202