Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,877
5,156
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule performs a retrospective sweep for indicators of compromise (IOCs) associated with the 'CSuite' phishing and RMM (Remote Monitoring and Management) campaign. It monitors network, DNS, proxy, email, URL click, and file creation telemetry over the past 24 hours to identify interactions with known-malicious IP addresses, domains, URLs, and file hashes related to the campaign.
This rule performs a retrospective sweep for indicators of compromise (IOCs) associated with the 'CSuite' phishing and RMM (Remote Monitoring and Management) campaign. It monitors network, DNS, proxy, email, URL click, and file creation telemetry over the past 24 hours to identify interactions with known-malicious IP addresses, domains, URLs, and file hashes related to the campaign.
This rule performs a point-in-time sweep for known Indicators of Compromise (IOCs) associated with the NeedyMantis threat actor group. The detection logic searches for specific file, process, and image-load SHA256 hashes, communication with a known C2 domain (tripswithengine.com), and the use of a hard-coded user-agent string (Firefox/21.0) across various telemetry sources within the last 30 days.
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects exploitation attempts against CVE-2026-55040 on Microsoft SharePoint Server. This vulnerability allows an attacker to bypass authentication by sending a malformed JSON Web Token (JWT) with an 'alg: none' header or an empty signature. The SharePoint server incorrectly trusts the provided token, enabling unauthorized access to sensitive API and SOAP endpoints.
This rule detects attempts to exploit CVE-2026-5027 in Langflow by identifying path traversal sequences (such as '../', '..\', or absolute paths) within the query parameters of requests directed to the '/api/v2/files' endpoint.
Detects high-frequency, sequential outbound GET requests to short URL patterns, potentially indicating a sandbox escape attempt or automated command-and-control activity where shortened links are used to download multi-stage payloads.
Detects incoming HTTP requests to an Artifactory deployment that utilize 'X-Forwarded-Host' and 'X-Forwarded-Scheme' headers in a manner consistent with HTTP cache poisoning attacks (CVE-2026-66384), specifically identifying when the 'X-Forwarded-Host' header contains unexpected or non-internal network values.
Detects high-frequency requests to Hugging Face dataset repository commit and discussion endpoints, which may indicate the use of the platform as a dead drop resolver or for C2 polling.
This rule detects repeated access to the RubyGems legacy API key endpoint within a short timeframe from a single source. This behavior is indicative of automated credential harvesting, where an adversary attempts to brute force or cycle through various API keys to gain unauthorized access to RubyGems accounts.
Detects outbound HTTP POST requests containing an aggregated 'LOOT' variable in the body. The rule looks for markers indicating the exfiltration of Kubernetes-related credentials, such as service account tokens, bearer tokens, or configuration secrets, as well as common environment variable dumps like API keys.
Detects anomalous POST requests to the RubyGems API endpoint '/api/v1/gems' that include an 'Authorization' header and a 'Content-Type' of 'application/octet-stream'. This pattern suggests the automated upload of binary files, potentially indicating exfiltration of data disguised as Ruby gems.
Detects automated HTTP GET requests directed at government or council calendar endpoints (specifically targeting mgCalendarMonthView or GetMeetings parameters) using a common generic User-Agent. This behavior is indicative of an automated scripted client potentially using public infrastructure as a Command and Control (C2) relay.
Detects an abnormally high volume of POST requests to the RubyGems API endpoint used for publishing packages. A sudden burst of these requests from a single source may indicate a mass upload campaign, commonly associated with software supply chain poisoning attempts.
This rule detects network activity associated with the GemStuffer malware, specifically monitoring for DNS queries to known OAST callback domains, HTTP requests to specific C2 paths, and unauthorized data exfiltration attempts to the webhook.site service.
Detects a multi-stage communication pattern involving an initial request to a URL-mirroring or shortening service with a long base64-encoded path, followed by a request to a screenshot/rendering API, and culminating in the reception of an image file. This chain is indicative of command and control (C2) communication where command output or exfiltrated data is encoded into images rendered by external web services to bypass traditional network security filters.
Detects outbound network traffic to domains and infrastructure known to be associated with the UAT-11587 Antino delivery chain. This includes specific Cloudflare Pages/R2 project URLs and CloudFront staging infrastructure often used for malicious payload hosting or staging.
Page 20 of 202