Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects high-frequency access to 'about' pages from a single IP address, indicative of potential reconnaissance or information gathering on an organization's public-facing infrastructure. The rule filters out common search engine crawlers and triggers only when a significant number of distinct pages are requested within a short timeframe.
Detects high-frequency access to 'about' pages from a single IP address, indicative of potential reconnaissance or information gathering on an organization's public-facing infrastructure. The rule filters out common search engine crawlers and triggers only when a significant number of distinct pages are requested within a short timeframe.
Detects anomalous, high-frequency access to LinkedIn 'about' pages, which may indicate reconnaissance activity or attempts to gather sensitive organizational information by an adversary. The rule uses threshold-based aggregation to filter out standard search engine crawlers and identify potentially malicious scanning behavior.
Detects anomalous, high-frequency access to LinkedIn 'about' pages, which may indicate reconnaissance activity or attempts to gather sensitive organizational information by an adversary. The rule uses threshold-based aggregation to filter out standard search engine crawlers and identify potentially malicious scanning behavior.
Detects potential data exfiltration activity where a host is communicating with the Telegram Bot API. The rule identifies high-frequency connections to api.telegram.org and inspects HTTP URIs for signs of Telegram Bot token usage combined with 'sendDocument' or 'sendPhoto' commands, which are common indicators of malicious exfiltration.
This rule monitors network traffic, DNS queries, and user web clicks to detect interactions with known malicious domains associated with credential harvesting and phishing campaigns, specifically those impersonating security or SSO portals.
This rule detects network traffic directed to the subdomain 'testing.perplexity.com', which is identified as being associated with the BragJack campaign. This specific subdomain is leveraged by the campaign to facilitate browser session redirect bypasses, indicative of an attempt to intercept or manipulate user sessions.
Detects Server-Side Request Forgery (SSRF) attempts originating from the Grafana MCP (Model Context Protocol) process. The rule specifically monitors for instances where the 'grafana_api_request' tool is used in conjunction with a 'X-Grafana-URL' header targeting cloud metadata IP ranges (169.254.0.0/16), or where the host attempts to resolve GCP metadata domains ('metadata.google.internal'). This behavior is indicative of an attacker attempting to access cloud provider instance metadata to exfiltrate security credentials.
Detects HTTP requests containing JNDI lookup patterns commonly associated with the Log4Shell (CVE-2021-44228) vulnerability exploitation, where an attacker attempts to force an application to execute remote code via Java Naming and Directory Interface (JNDI) injection.
This rule detects HTTP requests that contain duplicate 'Content-Length' headers, a technique used to perform HTTP Request Smuggling attacks. Attackers exploit discrepancies in how front-end and back-end servers interpret duplicate or conflicting request headers to smuggle requests, bypass security controls, or gain unauthorized access to back-end systems.
This rule detects multiple instances of HTTP double-encoded URIs from a single source within a 60-second window. Attackers often use double encoding to bypass security filters, WAFs, or input validation mechanisms that only perform a single decoding pass. This behavior is indicative of attempted exploitation, evasion, or directory traversal attacks.
Detects inbound HTTP traffic directed to internal hosts on ports other than commonly used web ports (80, 443, 8080, 8443, 8000, 8888, 3128). This behavior may indicate an attempt to bypass network security controls or the use of non-standard ports for command and control or data exfiltration.
This rule detects attempts to exploit a path traversal vulnerability (CVE-2024-21762) in FortiOS SSL-VPN by monitoring for malformed GET requests targeting the /remote/fgt_lang endpoint. The rule also tracks successful exploitation by identifying HTTP 200 responses containing Linux password file patterns (root:x:0:0:), indicating potential remote file disclosure.
This rule detects attempts to exploit a path traversal vulnerability (CVE-2024-21762) in FortiOS SSL-VPN by monitoring for malformed GET requests targeting the /remote/fgt_lang endpoint. The rule also tracks successful exploitation by identifying HTTP 200 responses containing Linux password file patterns (root:x:0:0:), indicating potential remote file disclosure.
This rule detects network connections and HTTP requests to known malicious URLs, including file downloads associated with C2 infrastructure and malware distribution campaigns. It monitors both direct device network events and HTTP requests logged through security product events to identify potential secondary-stage payload delivery.
Detects network requests to the Gitea Prometheus metrics API that contain 'k=' and 'x=' query parameters, a pattern indicative of a C2 command channel disguised as legitimate telemetry traffic.
Detects network requests to the Gitea Prometheus metrics API that contain 'k=' and 'x=' query parameters, a pattern indicative of a C2 command channel disguised as legitimate telemetry traffic.
Detects HTTP POST requests to a Gitea repository's diffpatch API endpoint whose body contains both a real git diff header and the malicious 'hooks/post-index-change' file path used by the CVE-2026-60004 exploit chain to plant an executable Git hook via an add/add merge collision.
Detects HTTP POST requests to a Gitea repository's diffpatch API endpoint whose body contains both a real git diff header and the malicious 'hooks/post-index-change' file path used by the CVE-2026-60004 exploit chain to plant an executable Git hook via an add/add merge collision.
Detects an attempt to exploit CVE-2021-33045 in Dahua devices, where an attacker sends a malicious JSON-RPC request to bypass authentication by leveraging the 'Loopback' login type and targeting the '127.0.0.1' address in the 'ipAddr' parameter.
Detects an attempt to exploit CVE-2021-33045 in Dahua devices, where an attacker sends a malicious JSON-RPC request to bypass authentication by leveraging the 'Loopback' login type and targeting the '127.0.0.1' address in the 'ipAddr' parameter.
Page 69 of 202