Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects anomalous, repeated 512KB multipart POST requests sent to a 'relay.php' endpoint, indicative of bulk data exfiltration performed by the CRPx0 ransomware prior to file encryption.
Detects the early-stage HTTP beaconing behavior of the CRPx0 ClickFix social engineering campaign. This rule monitors for specific request patterns to 'relay.php' that include session identifiers and indicators of the lure, such as 'WINUPDATE_TRACK' or 'CAPTCHA_WEB'. This signal represents the initial interaction with the malicious infrastructure before the victim is coerced into running commands.
This rule correlates successful Microsoft 365 sign-in events with preceding network events involving identified NovaCookies AiTM phishing infrastructure (specifically targeting .vu domains or specific URL patterns). It triggers when a user successfully authenticates using MFA shortly after accessing a known phishing link, which is a strong indicator of an active AiTM session hijacking attempt.
This rule monitors for web server exploit attempts (indicated by patterns like JNDI lookups or SQL injection sequences in URI/cookie data) that correlate with a surge in server-side errors (400+ status codes) and subsequent anomalous process creation or outbound network connections from the web server process.
Detects a specific adversary pattern termed 'Phantom Deal' where a user is socially engineered into disabling their VPN (by claiming a link won't open), followed immediately by a rapid succession of accesses to the same tracking or canary link from that user account. The rule correlates sign-in events indicating a shift in VPN or MFA context with subsequent bursts of URL clicks.
Detects high-frequency, automated web scraping behavior targeting product catalog pages, indicative of content harvesting for site replication. The rule monitors IIS logs for non-browser user agents (e.g., Python, curl, Scrapy) performing rapid, multi-page requests within a short duration.
Detects anomalous serialized object payloads within authenticated GraphQL subscription requests to GitLab Duo Chat endpoints. This pattern is indicative of exploitation attempts targeting the insecure deserialization vulnerability in GitLab EE (CVE-2026-87719), where malicious payloads are injected into serialized data streams.
This rule detects potential exploitation attempts (CVE-2026-59822) against LiteLLM MCP tool endpoints. It identifies HTTP requests where the authorization bearer token is unusually short (<= 12 chars), lacks the 'sk-' prefix, and does not appear to be a valid JWT, yet successfully results in a 200 OK status, indicating a potential bypass of authentication logic.
Detects high-frequency requests to the RubyGems legacy API key endpoint, which may indicate attempts to harvest or bruteforce developer API keys. The rule specifically monitors for request patterns involving variations like .yaml, .json, or parameter-based variants often observed in scanning activities.
Detects high-frequency requests to the RubyGems legacy API key endpoint, which may indicate attempts to harvest or bruteforce developer API keys. The rule specifically monitors for request patterns involving variations like .yaml, .json, or parameter-based variants often observed in scanning activities.
This rule detects potential Server-Side Request Forgery (SSRF) attempts targeting specific UK council ModernGov websites (e.g., Lambeth, Wandsworth, Southwark). It looks for outbound HTTP requests from non-browser clients (specifically identifying 'Ruby' in the User-Agent string) to these specific gov.uk domains, with a threshold to catch repeated attempts.
This rule correlates successful Microsoft 365 sign-in events with preceding network events involving identified NovaCookies AiTM phishing infrastructure (specifically targeting .vu domains or specific URL patterns). It triggers when a user successfully authenticates using MFA shortly after accessing a known phishing link, which is a strong indicator of an active AiTM session hijacking attempt.
Detects network communication associated with Mantax Otax Android malware, including traffic to identified command-and-control (C2) infrastructure and attempts to retrieve dynamic configuration files from GitHub.
This rule detects network traffic directed to the subdomain 'testing.perplexity.com', which is identified as being associated with the BragJack campaign. This specific subdomain is leveraged by the campaign to facilitate browser session redirect bypasses, indicative of an attempt to intercept or manipulate user sessions.
This rule detects network traffic directed to the subdomain 'testing.perplexity.com', which is identified as being associated with the BragJack campaign. This specific subdomain is leveraged by the campaign to facilitate browser session redirect bypasses, indicative of an attempt to intercept or manipulate user sessions.
Detects unauthorized or suspicious POST requests to the Cisco Firepower Management Center (FMC) web interface that lack standard authentication headers (Cookie, Authorization, or X-Api-Token). This pattern is consistent with exploit attempts targeting CVE-2026-20079.
This rule detects potential exploitation attempts (CVE-2026-59822) against LiteLLM MCP tool endpoints. It identifies HTTP requests where the authorization bearer token is unusually short (<= 12 chars), lacks the 'sk-' prefix, and does not appear to be a valid JWT, yet successfully results in a 200 OK status, indicating a potential bypass of authentication logic.
Detects attempts to bypass AWS IMDSv2 security protections via the LiteLLM /config/pass_through_endpoint, where attackers inject the 'x-pass-X-aws-ec2-metadata-token' header to potentially strip authentication requirements.
Detects attempts to bypass AWS IMDSv2 security protections via the LiteLLM /config/pass_through_endpoint, where attackers inject the 'x-pass-X-aws-ec2-metadata-token' header to potentially strip authentication requirements.
Detects a multi-stage authentication bypass attempt against LiteLLM MCP endpoints. The rule tracks an initial malformed Authorization Bearer token request to the /mcp/ endpoint, followed by a server response returning a 200 OK status code accompanied by an 'mcp-session-id' header, confirming the exploitation of CVE-2026-59822.
Detects incoming HTTP requests to sensitive LiteLLM endpoints (/mcp and /guardrails) which are typically intended for internal or controlled use. Exposing these to the public internet may allow unauthorized individuals to interact with, enumerate, or exploit the LiteLLM framework's capabilities.
Page 79 of 202