Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,877
5,156
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects two-stage communication pattern used by the Lorem Ipsum Loader. The first stage involves a GET request to a specific host acting as a dead-drop resolver to retrieve configuration. The second stage involves a POST request to an external destination containing a JPEG file header, characteristic of image-based C2 traffic.
This rule detects DNS queries, TLS SNI, and HTTP requests to a list of known malicious domains associated with the STAC4924 threat activity, specifically linked to the TerminalFix or Lorem Ipsum Loader malware.
Detects a sequence of network events where a host downloads a portable Python embeddable package from python.org, followed by a subsequent attempt to establish a WebSocket connection. This pattern is indicative of potential command and control (C2) activity using a Python-based tunnel.
This rule performs a point-in-time IOC hunt within CommonSecurityLog data to detect indicators associated with NeedyMantis. It monitors for specific C2 infrastructure domains ('tripswithengine.com') and a hardcoded user-agent string ('Firefox/21.0') in proxy, firewall, or network logs, which are characteristic of this threat actor's activity.
Detects outbound HTTP requests from endpoints to a known C2 infrastructure associated with mobile device spyware. The rule identifies two specific stages: polling for new commands using a GET request and posting command execution results using a POST request, both targeting an MDM-mimicking API structure.
This rule monitors for outbound TCP and HTTP traffic to a known malicious infrastructure hosting a fake or compromised 'Corp MDM' (Mobile Device Management) admin panel, which serves as a Command and Control (C2) channel for spyware.
Detects an Android device registration attempt to a known malicious C2 IP address using parameters characteristic of a mobile device management (MDM) implant. The rule looks for a POST request to a specific registration endpoint containing device identifiers like deviceId, manufacturer, model, and osVersion.
Detects specific C2 communication patterns associated with SCKIT, including HTTPS beaconing to the skyleen.fr domain and structured URI patterns used for configuration and status requests.
Detects HTTP GET requests to external services 'trycloudflare.com' or 'workers.dev' that return a file content starting with the 'MZ' and 'PE' header signatures within the first 256 bytes, indicating a Windows executable payload download often associated with AvisLoader activity.
This rule monitors for known malicious indicators, including a specific file hash, a C2 IP address, a remote URL associated with potential malicious activity (anydesk.exe), and a domain associated with C3Pool crypto-mining activity, across device processes, network events, and file operations.
This rule monitors for known malicious indicators, including a specific file hash, a C2 IP address, a remote URL associated with potential malicious activity (anydesk.exe), and a domain associated with C3Pool crypto-mining activity, across device processes, network events, and file operations.
Detects HTTP GET requests targeting the Vite Dev Server that include directory traversal sequences ('../') within the '/@fs/' endpoint. This pattern is indicative of an attempt to bypass root directory restrictions to access sensitive files on the server.
Detects unauthenticated or unauthorized access attempts to critical Oracle PeopleSoft PeopleTools endpoints (such as PSIGW, PSC, or PORTAL). These detections trigger when suspicious requests are made to these sensitive paths without expected authentication headers or session tokens, potentially indicating an exploitation attempt as described in CVE-2026-35273.
Detects repeated attempts to enumerate available model endpoints on a LiteLLM server, a behavior often associated with reconnaissance targeting AI gateway services to identify exposed models.
Detects anomalous POST requests to Citrix NetScaler SAML authentication endpoints (/saml/login or /cgi/samlauth) that result in an HTTP 500 error, which may indicate a heap overflow exploitation attempt associated with CVE-2026-8452.
Detects HTTP POST requests directed at common LLM API endpoints (chat completions, model beta) that contain patterns indicative of LLM prompt injection or malicious code generation requests, such as commands for code obfuscation or payload regeneration, specifically where the User-Agent does not match standard browser strings and the request body contains base64 encoded instructions.
This rule detects HTTP POST requests from mobile user agents (Android, Dalvik, okhttp) that contain keywords indicative of contactless payment card data exfiltration, specifically looking for fields such as 'track2', 'pan', 'atc', and 'cryptogram'. This behavior is consistent with malicious mobile applications attempting to transmit skimmed NFC credit card data to an external server.
This rule detects inbound HTTP requests targeting Oracle PeopleSoft applications that contain malicious patterns indicative of Server-Side Request Forgery (SSRF) attempts. The rule inspects the URI for specific PeopleSoft application paths and suspicious redirection or internal IP address patterns (including internal cloud metadata addresses like 169.254.169.254) which are commonly used in SSRF attacks to probe or access internal resources.
Detects outbound HTTP PUT requests characteristic of data exfiltration associated with Qilin ransomware. The rule monitors for the use of command-line tools like s5cmd or rclone for uploading data, often used during the double extortion phase where stolen data is uploaded to leak sites.
Detects HTTP PUT/POST requests targeting external domains with URI patterns and filename structures characteristic of TheGentlemen ransomware group's data exfiltration activities. The rule monitors for large HTTP request payloads (>50KB) and suspicious TLS subject fields (e.g., presence of CN without an O field) associated with potential C2 communication.
Detects repetitive network traffic to the Slack API endpoint '/api/conversations.history' using the 'Go-http-client' User-Agent. This behavior is indicative of the Graphalgo RAT polling Slack for command-and-control (C2) instructions.
Page 26 of 202