Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects outbound network traffic and HTTP requests originating from the internal network destined for a known malicious infrastructure associated with 'Corp MDM'. The traffic includes C2 communication patterns, specific API URI paths, and potential login interactions on non-standard ports, consistent with phishing, malware delivery, or unauthorized administrative access.
Detects HTTP requests to domains masquerading as Google Play ('playgoogle.') that are attempting to serve Android application packages (.apk). This is a common indicator of malicious sideloading campaigns using typosquatting to deceive users into downloading fake applications.
Detects HTTP requests to domains masquerading as Google Play ('playgoogle.') that are attempting to serve Android application packages (.apk). This is a common indicator of malicious sideloading campaigns using typosquatting to deceive users into downloading fake applications.
Detects HTTP requests to domains masquerading as Google Play ('playgoogle.') that are attempting to serve Android application packages (.apk). This is a common indicator of malicious sideloading campaigns using typosquatting to deceive users into downloading fake applications.
Detects HTTP requests to domains masquerading as Google Play ('playgoogle.') that are attempting to serve Android application packages (.apk). This is a common indicator of malicious sideloading campaigns using typosquatting to deceive users into downloading fake applications.
Detects anomalous C2 traffic associated with SectopRAT that leverages JSON-RPC 'eth_call' methods on 'binance.org'. The detection monitors for a specific POST request pattern followed by a response containing 'START' and 'FINISH' markers within the result field, indicating command-and-control communication disguised as blockchain interactions.
This rule detects potentially malicious HTTP requests targeting Alibaba Nacos services. It specifically identifies requests that include 'accesstoken' parameters when accessing sensitive endpoints such as user management, login, or configuration modification paths. This pattern is commonly associated with unauthorized attempts to leverage known Nacos vulnerabilities for credential access or configuration manipulation.
Detects attempts to exploit an unauthenticated Remote Code Execution (RCE) vulnerability in Langflow via the /api/v1/validate/code endpoint. The rule monitors for POST requests containing Base64 encoded payloads or direct Python command-line execution patterns, which indicate an attempt to achieve arbitrary code execution.
Detects rapid rotation of Herokuapp subdomains associated with Google Ads identifiers. This behavior is characteristic of malvertising kits attempting to evade domain-based blocking by dynamically shifting infrastructure and campaign IDs in a short rolling window.
Detects rapid rotation of Herokuapp subdomains associated with Google Ads identifiers. This behavior is characteristic of malvertising kits attempting to evade domain-based blocking by dynamically shifting infrastructure and campaign IDs in a short rolling window.
Detects rapid rotation of Herokuapp subdomains associated with Google Ads identifiers. This behavior is characteristic of malvertising kits attempting to evade domain-based blocking by dynamically shifting infrastructure and campaign IDs in a short rolling window.
Detects high-frequency authentication attempts originating from user agents associated with automation frameworks (Selenium, Playwright, Puppeteer, etc.). This pattern is often indicative of automated credential stuffing, brute force attacks, or CAPTCHA/2FA bypass attempts orchestrated by headless browsers.
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
Detects high-volume POST requests containing HEIF, HEIC, or AVIF image content types, indicative of automated fuzzing or exploitation attempts against an image-processing endpoint targeting CVE-2026-32882.
Detects HTTP POST requests containing JSON-RPC 'eth_call' methods, indicative of malware leveraging blockchain-based infrastructure for Command and Control (C2) resolution.
Detects outbound network traffic from internal hosts to Telegram shortened URLs (t.me). The detection looks for TLS SNI strings or HTTP requests targeting t.me domains, specifically focusing on non-browser user-agent strings which are indicative of Vidar-style malware using Telegram as a dead-drop resolver for C2 operations.
Detects outbound HTTP POST requests characterized by a specific 'Accept' header configuration commonly associated with Vidar Stealer command and control (C2) communication. This signature relies on the consistency of HTTP header patterns often observed in Vidar infections.
This rule detects potential exfiltration of sensitive files, specifically 'cert.pem' and 'private.key', via HTTP POST requests to the '/api/adbk/upload' endpoint. This pattern is characteristic of the RatHat malware attempting to exfiltrate device credentials to a Command and Control (C2) server.
This rule detects HTTP GET requests to a specific GitHub repository path (raw.githubusercontent.com/omskiwdcvoiuyfd0998/) identified as staging infrastructure associated with Konni/VelvetCake malware operations. This activity is indicative of a compromised host attempting to download malicious payloads or stage tools from actor-controlled infrastructure.
This rule detects HTTP GET requests to a specific GitHub repository path (raw.githubusercontent.com/omskiwdcvoiuyfd0998/) identified as staging infrastructure associated with Konni/VelvetCake malware operations. This activity is indicative of a compromised host attempting to download malicious payloads or stage tools from actor-controlled infrastructure.
Detection of network traffic associated with VelvetCake (Konni) malware, identifying communication with known hardcoded C2 infrastructure, domain lookups, and exfiltration attempts via HTTP/TLS and raw TCP protocols.
Page 52 of 202