Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects a multi-stage attack pattern against publicly exposed AI service endpoints. The detection correlates: (1) Enumeration of sensitive AI/MCP-related API endpoints (minimum 3 distinct hits) in a 10-minute window; (2) Subsequent POST requests to AI service endpoints within 15 minutes of the enumeration; and (3) A spike of 5 or more server errors (HTTP 5xx) within 10 minutes following the POST activity. This pattern suggests automated reconnaissance followed by attempted exploitation of exposed AI model interfaces or orchestration services. Covers T1595.002, T1190
Detects exfiltration of sensitive information, including Dahua camera credentials and internal identifiers, to the Telegram Bot API over HTTPS. These rules monitor for specific API endpoints (/sendPhoto) and common credential patterns (Login:, Password:, Model:) or indicators (Shodan links, VKontakte references) within HTTP POST requests directed toward api.telegram.org.
Detects attempts to exploit CVE-2021-33044, an authentication bypass vulnerability in Dahua NetKeyboard hardware. The rule triggers when a POST request containing 'global.login', 'clientType: NetKeyboard', and 'loginType: Direct' is observed, which allows unauthorized access by manipulating authentication parameters.
Detects malicious HTTP POST requests targeting SharePoint servers that attempt to inject 'Register' directives into pages or manipulate WebPartPage ToolPane markup, indicative of attempts to bypass SafeControls or exploit vulnerable SharePoint features for code execution.
Detects network traffic associated with the Exvicy malware delivery chain. The rule identifies two behaviors: first, HTTP GET requests to a '/embed/' endpoint with specific 'embed=1' and 'host=cloudflare-check.net' parameters, and second, established TCP connections to a known command and control (C2) IP address related to the ClickFix social engineering delivery method.
Detects DNS queries, HTTP requests, and TLS SNI traffic directed towards the domain 'cloudflare-check.net', which is associated with 'ClickFix' social engineering campaigns used to deceive users into executing malicious code.
Detects outbound HTTP POST requests associated with the Telepuz modular loader. The rule monitors for specific URI patterns, request body parameters, and suspicious User-Agent strings indicative of PowerShell or MSHTA command-and-control communication.
Detects outbound HTTP POST requests associated with Cicada3301 ransomware affiliate check-in behavior. The rule monitors for a specific 'X-Session-Id' HTTP header and a corresponding 'affiliate_id' parameter within the request body, which are indicative of malicious C2 communication.
Detects anomalous large-scale data transfers to external endpoints that exhibit patterns characteristic of the ShinyHunters group's SaaS bulk export and data exfiltration methods. The rule identifies suspicious HTTP requests to Salesforce API endpoints (e.g., batch jobs, bulk queries) accompanied by unusually large content payloads, followed by subsequent encrypted communication to non-whitelisted external destinations.
Detects HTTP traffic related to the Macfinger/ClickFix campaign, where malicious injected scripts or dns-prefetch entries point to known attacker-controlled infrastructure (velvet-otter-glagceis.life) or assets utilized for social engineering and malicious copy-paste exploitation.
Detects outbound HTTP POST requests directed at the '/api/credentials' URI, a pattern associated with AMOS Stealer credential exfiltration. The rule includes a threshold to reduce noise by alerting only when multiple requests occur from a single source within a short timeframe.
This rule detects network activity associated with the Sauron Loader malware. It monitors for TLS connections to known hardcoded C2 domains and identifies HTTP requests following a specific pattern of randomized command and control (C2) paths combined with suspicious User-Agent headers (Windows NT with Edge/Edg).
This rule detects potential command and control (C2) activity related to the AMOS (Atomic macOS) information stealer. It identifies a specific sequence of network requests where an initial registration beacon (POST /api/t) is followed by a shell agent request (GET /api/shell/agent) within 120 seconds, originating from the same destination IP and port.
This rule detects HTTP GET requests to a specific GitHub repository path (raw.githubusercontent.com/omskiwdcvoiuyfd0998/) identified as staging infrastructure associated with Konni/VelvetCake malware operations. This activity is indicative of a compromised host attempting to download malicious payloads or stage tools from actor-controlled infrastructure.
Detects DNS lookup queries and HTTP POST beaconing attempts directed at known Sauron Loader C2 fallback infrastructure. The rule tracks specific domains associated with the malware's encrypted registration and command-and-control behavior.
This rule detects outbound HTTP GET requests initiated by a process using a 'WebClient' user-agent to retrieve a file named 'shell.ps1'. This behavior is characteristic of adversaries downloading second-stage PowerShell payloads to a compromised host.
Detects suspicious HTTP POST requests to a URI path '/collect' containing specific telemetry parameters ('visitorId', 'timeOnPage', 'stage') characteristic of the 'ClickFix' social engineering campaign. This behavior is used by threat actors to simulate fake bot-protection challenges to trick users into executing malicious code.
Detects suspicious/unexpected usernames appearing in Cisco ISE access.log,
consistent with exploitation of CVE-2026-76460, an unauthenticated REST API
auth-bypass in Cisco ISE / ISE-PIC (CVSS 10.0, actively exploited, CISA KEV).
Cisco's own guidance is to hunt access.log for usernames not present in the
legitimate identity store; "dummyuser" is their published example artifact.
consistent with exploitation of CVE-2026-76460, an unauthenticated REST API
auth-bypass in Cisco ISE / ISE-PIC (CVSS 10.0, actively exploited, CISA KEV).
Cisco's own guidance is to hunt access.log for usernames not present in the
legitimate identity store; "dummyuser" is their published example artifact.
Detects high-frequency requests directed at common model-serving API endpoints, which may indicate an attacker attempting to perform model extraction or model inversion attacks by repeatedly querying the model to infer its parameters or training data.
Detects malicious shell commands or scripts (e.g., bash, powershell, curl, wget) embedded within HTTP POST request bodies that appear to be AI agent tool-call payloads. This activity is indicative of prompt injection or AI tool-use exploitation attempts designed to execute arbitrary code on the underlying host or container.
This rule detects high-frequency HTTP 401 Unauthorized responses directed at API endpoints (specifically matching '/v1/') within a short window, which is indicative of an adversary attempting to brute-force or credential-stuff API keys.
Page 32 of 202