Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,877
5,156
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule identifies DNS queries or web requests directed toward a known list of domain names associated with the 'ShipmentsFree' family of shipping-rebate scams. These scams are typically designed to lure consumers into unknowingly signing up for recurring, undisclosed subscription services.
This rule identifies DNS queries or web requests directed toward a known list of domain names associated with the 'ShipmentsFree' family of shipping-rebate scams. These scams are typically designed to lure consumers into unknowingly signing up for recurring, undisclosed subscription services.
Detects HTTP GET requests to external services 'trycloudflare.com' or 'workers.dev' that return a file content starting with the 'MZ' and 'PE' header signatures within the first 256 bytes, indicating a Windows executable payload download often associated with AvisLoader activity.
This rule monitors for known malicious indicators, including a specific file hash, a C2 IP address, a remote URL associated with potential malicious activity (anydesk.exe), and a domain associated with C3Pool crypto-mining activity, across device processes, network events, and file operations.
Detects outbound HTTP requests to identified scam infrastructure (e.g., herokuapp domains) containing platform-specific query parameters (win or mac). This behavior is indicative of a user interacting with a malicious site that is delivering an OS-tailored locker or malware payload.
Detects outbound HTTP requests to identified scam infrastructure (e.g., herokuapp domains) containing platform-specific query parameters (win or mac). This behavior is indicative of a user interacting with a malicious site that is delivering an OS-tailored locker or malware payload.
Detects high-frequency anonymous comment submissions to 'wp-comments-post.php' from a single IP address within a 10-minute window, characterized by minimal variations in User-Agent. This behavior is indicative of an automated script attempting to bypass comment moderation settings, potentially exploiting known vulnerabilities (e.g., CVE-2026-93485) to inject content without administrative approval.
This rule detects potential prompt injection attacks against internal AI-powered assistants, agents, or LLM gateways. It monitors network HTTP requests for common patterns used to override system instructions, bypass safety filters, or force the model to adopt a privileged, unauthorized persona (e.g., administrator or debug mode). These techniques are often used in social engineering to manipulate the AI's output or security posture.
Detects HTTP requests to popular LLM API services (OpenAI, Anthropic, Google, Cohere) containing common jailbreak or role-play patterns. These patterns attempt to bypass safety guardrails by using techniques such as persona-switching (e.g., 'DAN'), hypothetical scenario framing, or unauthorized security testing pretexts.
The following analytic detects Log4Shell JNDI payload injections via outbound connections. It identifies suspicious LDAP lookup functions in web logs, such as `${jndi:ldap://PAYLOAD_INJECTED}`, and correlates them with network traffic to known malicious IP addresses. This detection leverages the Web and Network_Traffic data models in Splunk. Monitoring this activity is crucial as it targets vulnerabilities in Java web applications using log4j, potentially leading to remote code execution. If confirmed malicious, attackers could gain unauthorized access, execute arbitrary code, and compromise sensitive data within the affected environment.
Detects clicks on sponsored search engine ads that redirect users to Google Cloud Storage (GCS) buckets with names or paths designed to impersonate the 'Ledger' brand. These artifacts are indicative of a malvertising campaign using typosquatted storage paths to deliver malicious payloads or credential harvesting pages.
This rule detects HTTP POST requests to Vercel-hosted domains containing suspected phishing telemetry (such as device fingerprinting, keystrokes, and user agent collection) originated from a Google Sites frame. This is a common pattern for phishing kits masquerading as legitimate Ledger service pages to harvest credentials and hardware information.
This rule detects reconnaissance activity targeting Azure App Service instances, specifically looking for attempts to access web-shell-like files, WordPress administration paths, PHP-CGI endpoints, or LangFlow code validation paths. It identifies potential Storm-3168 actor infrastructure through known IOCs or through patterns of high-volume, path-diverse HTTP requests that deviate from typical noise, helping to distinguish targeted probing from common internet background scanning.
Detects HTTP POST requests containing potential credential exfiltration indicators, specifically targeting the '/google.php' endpoint with 'do=login&', 'user=', and 'pass=' parameters. This pattern is associated with FlowerStorm (Storm-1167) AiTM phishing kits.
Detects outbound HTTP POST requests to a URI path '/google.php' containing suspicious parameters 'do=login&user=' and '&pass='. This pattern is indicative of credential exfiltration activities commonly associated with the FlowerStorm campaign.
Detects network activity associated with the FlowerStorm/Storm-1167 phishing campaign. The rule monitors for credential exfiltration to a specific malicious URI (e.g., /google.php) containing login parameters, as well as the delivery of spoofed Microsoft sign-in pages from the associated phishing infrastructure.
Detects HTTP GET requests to '/api.php?t=' containing a 13-digit timestamp identifier, followed by a response body containing 'download_link'. This pattern is indicative of the SilverFox malware relaying instructions or stage-two payload delivery.
Detects network activity (TCP, DNS, TLS, HTTP) associated with the UNC6240 threat actor's infrastructure, specifically targeting communications with known malicious IP addresses and domains used in a campaign leveraging PeopleSoft-related lures.
This rule monitors network, DNS, and HTTP activity to identify connections to known infrastructure associated with the ClickFix social engineering campaign and Vidar infostealer malware. The rule correlates device network events, HTTP request events, and DNS queries against a list of known malicious domains, IP addresses, and URL patterns used for C2, staging, and lures.
This rule monitors network, DNS, and HTTP activity to identify connections to known infrastructure associated with the ClickFix social engineering campaign and Vidar infostealer malware. The rule correlates device network events, HTTP request events, and DNS queries against a list of known malicious domains, IP addresses, and URL patterns used for C2, staging, and lures.
This rule monitors network, DNS, and HTTP activity to identify connections to known infrastructure associated with the ClickFix social engineering campaign and Vidar infostealer malware. The rule correlates device network events, HTTP request events, and DNS queries against a list of known malicious domains, IP addresses, and URL patterns used for C2, staging, and lures.
Page 31 of 202