Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects attempts to bypass authentication on Nacos servers, including the use of spoofed Nacos-Server User-Agent headers, suspicious API query patterns missing required access tokens, and the subsequent use of forged JWT tokens signed with default keys.
Detects unauthenticated HTTP POST requests targeting the FortiGate administrative API (/api/v2/), which may indicate exploitation attempts related to CVE-2025-25249. The rule specifically looks for requests lacking authentication headers (Cookie or Authorization).
Detects an attempt to exploit CVE-2026-24858 in FortiCloud SSO by sending a crafted SAML authentication request that lacks a signature. This vulnerability allows an attacker to bypass authentication by providing an unsigned SAML response.
Detects outbound network traffic to the Telegram Bot API (api.telegram.org) indicative of long-polling command and control (C2) communication. This behavior is associated with the HEAVYGRAM malware and its use of Telegram as a C2 channel.
Detects outbound HTTP requests to the 'itorrents.org' repository for files with the '.torrent' extension, which may indicate the retrieval of malicious payload components associated with the MovieReaper supply chain campaign.
Detects network activity associated with the Handala Loader malware, specifically identifying attempts to download disguised shellcode or malicious payloads from deadhub.org and associated infrastructure. The rule monitors for specific URI patterns mimicking UI assets and fallback communication attempts to known C2 IP addresses.
Detects HTTP POST requests from Android devices identified as RatHat malware, specifically targeting exfiltration of sensitive data including credentials, cipher keys, and ADB certificate/key uploads via the malware's C2 API.
Detects outbound network traffic attempting to reach known public DNS-over-HTTPS (DoH) resolvers. This rule monitors for specific SNI fields in TLS handshakes or HTTP/2 :authority headers that indicate communication with common third-party DoH services, which may be used to bypass internal DNS filtering and monitoring controls.
Detects incoming HTTP requests to sensitive LiteLLM endpoints (/mcp and /guardrails) which are typically intended for internal or controlled use. Exposing these to the public internet may allow unauthorized individuals to interact with, enumerate, or exploit the LiteLLM framework's capabilities.
Detects potential exfiltration activity by identifying HTTP POST/PUT requests to known suspicious domains, including specific operator-controlled hosts and anonymous file sharing services, as well as the use of HTTP Range headers for bulk API data exfiltration.
Detects repeated, non-interactive requests to the Google Sheets Visualization API (gviz/tq) originating from common web browsers. This pattern is indicative of a malicious browser extension attempting to reconstruct or reinject payloads when a user visits specific targeted websites.
The detection rule identifies network connections to 'dauntingmoon.online' specifically hitting '/api/verification/init' or '/api/verification/check' paths. It validates that both 'session' and 'link_id' query parameters are present in the request. This pattern is indicative of a specific adversary beaconing or command and control (C2) callback mechanism involving session-based authentication or handshake steps with a remote server.
Detects network connections initiated by common web browsers to a specific LinodeObjects domain or any subdomains within the linodeobjects.com infrastructure, which may indicate command and control communication or data exfiltration via legitimate cloud storage providers.
This rule monitors DNS queries and HTTP traffic for indicators related to known phishing infrastructure impersonating passkey and SSO providers. The domains detected are associated with Storm-3121/3032 campaigns designed to facilitate credential or session harvesting.
Detects DNS queries, TLS SNI, and HTTP Host header traffic directed towards known phishing domains associated with Storm-3121/Storm-3032 infrastructure. These domains often use themes related to passkey setup, SSO, or account security to trick users into providing credentials.
This rule monitors incoming HTTP requests for the use of PHP stream wrappers (e.g., php://, data://, expect://, etc.). Such wrappers are often leveraged by adversaries to perform Local File Inclusion (LFI) or to achieve Remote Code Execution (RCE) by manipulating input parameters in vulnerable web applications.
This rule detects potential OS command injection attempts in HTTP request parameters by monitoring for common shell command separators and subsequent execution of suspicious system binaries (e.g., sh, bash, curl, wget, python).
Detects HTTP traffic that contains an abnormal number of nested encoding layers, which is often used by attackers to evade network-based inspection signatures and WAF filters.
This rule monitors network traffic and internal logs for connections to known malicious IP addresses or domain names associated with 'ClickFix' social engineering campaigns (often impersonating services like HBO Max). The logic explicitly filters out known threat intelligence scanners and security researcher probes. It performs correlation by requiring domain/message matches for generic IP-based alerts to reduce noise, and aggregates events per host over 15-minute windows to produce consolidated alerts.
This rule detects HTTP requests that contain duplicate 'Content-Length' headers, a technique used to perform HTTP Request Smuggling attacks. Attackers exploit discrepancies in how front-end and back-end servers interpret duplicate or conflicting request headers to smuggle requests, bypass security controls, or gain unauthorized access to back-end systems.
Detects repeated suspicious network requests, including non-standard HTTP methods and URI structures, as well as TLS SNI anomalies, targeting the internal sales portal 'agent.3bb.co.th'. The rule triggers when a threshold of 20 requests within a 60-second window is reached from a single source, indicating likely automated reconnaissance or vulnerability scanning activity.
Page 75 of 202