Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects network traffic directed at known command and control (C2) domains associated with the Koktevrat malware, specifically targeting the domain 'fb-market-play.cc'. This pattern is indicative of compromised hosts attempting to communicate with attacker infrastructure, often following an initial infection phase initiated via malicious links.
Detects attempts to exploit the GitLab commits API via path traversal or direct file path manipulation to access sensitive configuration files or system secrets, such as gitlab-secrets.json, database.yml, or system files like /etc/passwd.
This rule detects network activity associated with known command-and-control (C2) infrastructure. It monitors for connections to specific malicious domains, IP addresses, or URI paths combined with unique HTTP headers or request body markers indicative of C2 beacons or data exfiltration.
This rule detects malicious activity by monitoring for specific known indicators, including hashes of malicious files (ProcessRollup2), network connections to known C2 infrastructure (NetworkConnectIP4), and URL clicks (UrlClick) associated with malicious domains or paths. It acts as a multi-stage indicator correlation rule to identify execution or communication with known threats.
This rule detects potential malicious activity by monitoring for known indicators of compromise, including specific SHA256 file hashes, a known malicious IP address, and URLs associated with identified threats. The detection spans file creation/execution, network connections, and URL visits to block or alert on interactions with suspicious infrastructure.
Detects HTTP connections between internal hosts and suspected C2 infrastructure associated with the Operation SilkParasite campaign. The rule specifically monitors for connections to known malicious IPs and identifies the retrieval of a cloned RTX Corporation homepage content, which acts as a decoy for the SpiceRAT malware.
Detects HTTP POST requests to the Telegram Bot API (/sendPhoto) containing patterns indicative of data exfiltration. The rule identifies suspicious message content, such as URLs leading to VK.com or reconnaissance data like Shodan host links and IP location query templates, suggesting the use of Telegram as a Command and Control (C2) channel for exfiltrating sensitive information.
Detects potential cross-family Command and Control (C2) activity by correlating multiple network infrastructure indicators associated with the SilkParasite threat actor. The rule identifies source hosts that interact with at least two distinct indicator sets (specific malicious domains, shared TLS certificates, or cloned homepage content hashes) within a one-hour timeframe.
Detects outbound HTTP requests to the Telegram Bot API that indicate the exfiltration of sensitive camera credentials or snapshots. The rules identify specific API endpoints such as '/sendPhoto' and the presence of Markdown-formatted text containing 'Login:', 'Password:', and 'Model:' fields within the request body.
Detects exploit attempts targeting the authentication bypass vulnerability in Dahua NetKeyboard devices (CVE-2021-33044) by monitoring HTTP requests containing malicious 'global.login' RPC parameters.
This rule monitors network HTTP traffic containing specific strings related to gym-membership APIs and client IDs, alongside process or file activity referencing 'getFitnessProfile'. This combination is a behavioral fingerprint associated with a specific Golang-based remote access trojan (RAT) attempting to exfiltrate or interact with fitness profile data.
Detects unauthenticated HTTP POST requests targeting the FortiGate administrative API (/api/v2/), which may indicate exploitation attempts related to CVE-2025-25249. The rule specifically looks for requests lacking authentication headers (Cookie or Authorization).
Detects an attempt to exploit CVE-2026-24858 in FortiCloud SSO by sending a crafted SAML authentication request that lacks a signature. This vulnerability allows an attacker to bypass authentication by providing an unsigned SAML response.
Detects DNS, TLS SNI, and HTTP Host header requests to known phishing domains mimicking Passkey or Single Sign-On (SSO) authentication services. These domains attempt to deceive users into providing credentials or performing unauthorized authentication actions.
Detects DNS queries and HTTP Host header traffic to known SilverFox malware impersonation domains. These domains utilize .com.cn TLDs and typosquatting techniques to masquerade as legitimate software or service providers.
This rule detects network activity associated with the SilverFox malware, specifically targeting communication patterns between the compromised host and identified relay infrastructure. The detection focuses on unique URL query patterns for relay discovery and dispatcher requests, as well as the identification of staging/download links within server responses.
Detects HTTP requests that use URL-encoded backslash traversal sequences
("..%5C") to walk out of a Next.js dynamic route and request the
"server-reference-manifest" file, which discloses the Server Action
encryption key. This is the reconnaissance/priming stage of CVE-2026-75604
RCE exploitation, observed against both the App Router and the Pages
Router ("/_next/data/<buildId>/.../server-reference-manifest.json").
("..%5C") to walk out of a Next.js dynamic route and request the
"server-reference-manifest" file, which discloses the Server Action
encryption key. This is the reconnaissance/priming stage of CVE-2026-75604
RCE exploitation, observed against both the App Router and the Pages
Router ("/_next/data/<buildId>/.../server-reference-manifest.json").
Detects potential web shell installation via WordPress administrative panels. The rule identifies a WordPress administrator session executing a theme installation request triggered by an external (off-site) referer, followed shortly thereafter by the creation of new PHP files within the WordPress themes directory. This pattern is often indicative of an attacker leveraging a compromised admin session to upload a backdoor.
Detects potential web shell installation via WordPress administrative panels. The rule identifies a WordPress administrator session executing a theme installation request triggered by an external (off-site) referer, followed shortly thereafter by the creation of new PHP files within the WordPress themes directory. This pattern is often indicative of an attacker leveraging a compromised admin session to upload a backdoor.
Detects potential zero-click administrator session hijacking by correlating a logged-in administrator accessing a page containing user-generated content (e.g., comments) followed immediately by a sensitive administrative action (e.g., plugin installation, user creation) within a 5-second window, suggesting automated script execution via an autofocus/onfocus handler triggered by the admin's browser.
Detects potential zero-click administrator session hijacking by correlating a logged-in administrator accessing a page containing user-generated content (e.g., comments) followed immediately by a sensitive administrative action (e.g., plugin installation, user creation) within a 5-second window, suggesting automated script execution via an autofocus/onfocus handler triggered by the admin's browser.
Page 53 of 202