Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects outbound HTTP POST requests to known public Ethereum RPC gateways (Alchemy and Infura) containing embedded, hardcoded API keys or references to specific contract addresses associated with the 'indexed-btree' malware campaign. This pattern indicates a compromised host leveraging legitimate Web3 infrastructure for Command and Control (C2) communication.
This rule detects potential exploitation attempts against SonicWall SMA1000 appliances, specifically targeting the /wsproxy endpoint using a custom 'SMA Connect Agent' user agent string. This behavior is associated with SSRF vulnerabilities (CVE-2026-15409 and CVE-2026-15410) identified as being utilized by the threat actor group UTA0533 in campaigns involving INC Ransomware.
Detects anomalous cloud authentication events occurring within a 3-hour window after suspected unauthorized access to sensitive configuration or credential files on a Vite development server. The rule flags sign-ins with high risk, anomalous location, or missing device compliance information, excluding trusted corporate locations and devices, serving as an indicator of potential post-exfiltration account takeover.
Detects network requests to the Microsoft authentication service specifically targeting the /common/oauth2/deviceauth endpoint, which is used in the OAuth 2.0 Device Authorization Grant flow. While legitimate for device authentication (e.g., CLI tools, smart devices), this flow can be abused by adversaries for phishing attacks to bypass traditional credential-based MFA, allowing them to gain persistent access to a user account once the target authorizes the code.
This rule detects potential API abuse by identifying high-frequency API calls using the 'python-requests' user agent that occur within a short time window (120 seconds) immediately following a successful device code authentication event. This behavior is indicative of automated token theft or session hijacking where an adversary attempts to perform unauthorized actions quickly using tokens obtained via device code phishing.
Detects network activity and HTTP request headers associated with the GhostCode phishing kit. The rule identifies specific URI patterns, custom site keys, malicious User-Agent strings, and session cookie artifacts indicative of interaction with a phishing server.
Detects high-volume HTTP GET requests containing the 'SetupCompleted' URI pattern directed at PaperCut servers, which is indicative of automated exploitation attempts targeting authentication bypass vulnerabilities.
Detects network traffic consistent with automated penetration testing frameworks such as Nuclei, ffuf, or sqlmap. This rule monitors HTTP user-agent strings and triggers an alert if high-frequency scanning activity from a single source is observed within a 60-second window, which is indicative of automated reconnaissance or vulnerability scanning.
Detects outbound network connections to 'acrobat-updater.com' involving suspicious API paths that mimic the Adobe Acrobat updater. This may indicate an attempt by an adversary to masquerade malicious command and control or data exfiltration as legitimate update traffic.
Detects attempts to exploit the Langflow 'validate/code' endpoint, which is associated with CVE-2025-3248. The rule monitors HTTP POST requests to this endpoint for specific character patterns within the request body, indicative of malicious payloads attempting to achieve code execution.
Detects repeated HTTP POST requests containing 'ScreenConnect' in the URI, originating from external networks. This pattern is indicative of automated scanning activity attempting to exploit potential authentication bypass or session hijacking vulnerabilities (such as CVE-2026-84869) in ConnectWise ScreenConnect instances.
Detects potential exploitation attempts against Microsoft Exchange Server, specifically targeting the ECP (Exchange Control Panel) through VIEWSTATE parameter tampering related to CVE-2020-0688, and correlates this with suspicious behavior in the w3wp.exe process, such as unauthorized module loading (e.g., clr.dll, system.web.dll) and abnormal child process creation which may indicate the deployment of in-memory backdoors like GhostContainer.
Detects an attempt to exploit CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow. The rule identifies POST requests to the '/api/v1/validate/code' endpoint that contain base64 encoded strings in the request body, which are characteristic of malicious Python payloads designed to execute arbitrary code.
This rule detects network traffic indicative of N0va Phishkit verification or session initialization. It looks for specific GET request URI parameters (/api/verification/init?session=, flow=, prompt_profile=) that align with the initial handshake phase of this phishing kit, which is often used for credential and session cookie theft.
This rule detects network traffic indicative of N0va Phishkit verification or session initialization. It looks for specific GET request URI parameters (/api/verification/init?session=, flow=, prompt_profile=) that align with the initial handshake phase of this phishing kit, which is often used for credential and session cookie theft.
Detects high-volume, systematic API requests to AI inference endpoints from a single user ID, which may indicate automated model extraction or scraping attacks against AI services.
Detects HTTP downloads from GitHub involving specific repositories and archive naming patterns commonly associated with the 'NightEagle GhostContainer' threat activity. These patterns involve downloading ZIP files disguised as development or resource packages (e.g., 'mirror-js', 'browserthemes', 'resource-pack').
Detects specific malformed HTTP request patterns associated with the Casbaneiro (Metamorfo) banking trojan. The rules identify suspicious beaconing attempts, including specific URI structures ('/$p', '/$or?u=') and malformed headers (missing Host header combined with specific Content-Length anomalies).
Detects network communication associated with the Casbaneiro (Metamorfo) banking trojan, specifically identifying DNS queries, TLS SNI headers, HTTP Host headers, and direct IP connections to known malicious C2 infrastructure.
Detects network communication associated with the Casbaneiro (Metamorfo) banking trojan, specifically identifying DNS queries, TLS SNI headers, HTTP Host headers, and direct IP connections to known malicious C2 infrastructure.
This rule detects potential command and control (C2) activity associated with the Koktevrat malware, specifically looking for WebSocket handshake requests (HTTP GET with 'Upgrade' header) to domain names that follow a generated pattern (8-27 alphanumeric characters ending in .icu or .cfd).
Page 57 of 202