Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects high-frequency requests to the RubyGems legacy API key endpoint, which may indicate attempts to harvest or bruteforce developer API keys. The rule specifically monitors for request patterns involving variations like .yaml, .json, or parameter-based variants often observed in scanning activities.
This rule detects potential Server-Side Request Forgery (SSRF) attempts targeting specific UK council ModernGov websites (e.g., Lambeth, Wandsworth, Southwark). It looks for outbound HTTP requests from non-browser clients (specifically identifying 'Ruby' in the User-Agent string) to these specific gov.uk domains, with a threshold to catch repeated attempts.
This rule detects potential Server-Side Request Forgery (SSRF) attempts targeting specific UK council ModernGov websites (e.g., Lambeth, Wandsworth, Southwark). It looks for outbound HTTP requests from non-browser clients (specifically identifying 'Ruby' in the User-Agent string) to these specific gov.uk domains, with a threshold to catch repeated attempts.
This rule detects email activity involving DocuSign-themed messages that contain attachments and also coincide with URL click events that redirect users to Microsoft-related login portals (e.g., login.microsoftonline.com or teams.microsoft.com) containing 'redirect' or 'redirect_uri' parameters. This behavior is indicative of a phishing attempt designed to capture credentials or perform OAuth consent phishing by mimicking legitimate document-signing workflows.
This rule detects browser activity where a page rendered via a data blob loads a sandboxed iframe containing cross-origin content originating from cdn.bloom.io. This pattern is consistent with known phishing delivery mechanisms often used in DocuSign or Teams-themed phishing campaigns to facilitate credential theft or secondary payloads.
Detects an HTTP POST request targeting the host 'tt.yeyoujs.com' at the URI path '/api/agent/enroll', containing a specific Python aiohttp User-Agent string. This pattern is characteristic of a C2 agent attempting to register or enroll with an external command-and-control server.
This rule monitors incoming HTTP requests for the presence of the Base64-encoded string 'rO0AB', which is the standard header for serialized Java objects. The presence of this header in an HTTP request body is a strong indicator of a Java deserialization exploitation attempt.
This rule detects common patterns associated with Expression Language (EL) injection attacks in HTTP traffic. These patterns typically attempt to invoke Java reflection, runtime execution, or process creation through vulnerable applications utilizing templating engines or expression evaluators (e.g., OGNL, Spring Expression Language). Attackers use these to achieve remote code execution (RCE).
This rule detects HTTP requests containing an invalid or malformed 'Transfer-Encoding' header value. Such malformations are often used in HTTP Request Smuggling (HRS) attacks to cause desynchronization between a front-end load balancer/proxy and a back-end web server, potentially allowing an attacker to smuggle requests, bypass security controls, or perform cache poisoning.
This rule monitors for HTTP header folding, a legacy evasion technique where header fields are split across multiple lines by using whitespace characters (tabs or spaces). This technique may be used by adversaries to bypass security controls such as web application firewalls or load balancers by smuggling malicious payloads or obfuscating traffic.
Detects repeated HTTP request field length anomalies which may indicate attempts to exploit buffer overflows, memory corruption vulnerabilities, or parser abuse against web services.
Detects anomalous outbound HTTP requests to the Google OAuth token endpoint that mimic the behavior of the JSCeal malware. The rule identifies requests that lack standard browser-based User-Agent strings and omit the 'code_verifier' parameter, which is typically required in legitimate PKCE-enabled OAuth flows, indicating potential automated token theft.
Detects anomalous outbound HTTP requests to the Google OAuth token endpoint that mimic the behavior of the JSCeal malware. The rule identifies requests that lack standard browser-based User-Agent strings and omit the 'code_verifier' parameter, which is typically required in legitimate PKCE-enabled OAuth flows, indicating potential automated token theft.
This rule detects multiple instances of HTTP double-encoded URIs from a single source within a 60-second window. Attackers often use double encoding to bypass security filters, WAFs, or input validation mechanisms that only perform a single decoding pass. This behavior is indicative of attempted exploitation, evasion, or directory traversal attacks.
This rule detects anomalous access patterns on a specific IIS host (agent.3bb.co.th) by comparing recent traffic against a 30-day historical baseline. It identifies requests from accounts or source IPs not seen in the baseline, activity occurring during off-hours, or traffic from external sources. The rule further filters for high-volume or high-path diversity requests, which are indicative of automated reconnaissance or potential brute-force activity against the web application.
This rule detects anomalous access patterns on a specific IIS host (agent.3bb.co.th) by comparing recent traffic against a 30-day historical baseline. It identifies requests from accounts or source IPs not seen in the baseline, activity occurring during off-hours, or traffic from external sources. The rule further filters for high-volume or high-path diversity requests, which are indicative of automated reconnaissance or potential brute-force activity against the web application.
This rule detects anomalous access patterns on a specific IIS host (agent.3bb.co.th) by comparing recent traffic against a 30-day historical baseline. It identifies requests from accounts or source IPs not seen in the baseline, activity occurring during off-hours, or traffic from external sources. The rule further filters for high-volume or high-path diversity requests, which are indicative of automated reconnaissance or potential brute-force activity against the web application.
This rule detects anomalous access patterns on a specific IIS host (agent.3bb.co.th) by comparing recent traffic against a 30-day historical baseline. It identifies requests from accounts or source IPs not seen in the baseline, activity occurring during off-hours, or traffic from external sources. The rule further filters for high-volume or high-path diversity requests, which are indicative of automated reconnaissance or potential brute-force activity against the web application.
Detects instances where internal devices access the 3BB sales portal (agent.3bb.co.th) while demonstrating signs of compromise. The rule correlates the portal access with recent network activity involving identified MeshCentral attacker infrastructure (ayuthayatech.com or 92.63.180.133) and further filters for behavioral anomalies such as off-hours access, the use of non-standard browser processes, or the use of unexpected service accounts.
Detects instances where internal devices access the 3BB sales portal (agent.3bb.co.th) while demonstrating signs of compromise. The rule correlates the portal access with recent network activity involving identified MeshCentral attacker infrastructure (ayuthayatech.com or 92.63.180.133) and further filters for behavioral anomalies such as off-hours access, the use of non-standard browser processes, or the use of unexpected service accounts.
Detects HTTP POST requests to a Gitea repository's diffpatch API endpoint whose body contains both a real git diff header and the malicious 'hooks/post-index-change' file path used by the CVE-2026-60004 exploit chain to plant an executable Git hook via an add/add merge collision.
Page 83 of 202