Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects potential exploitation attempts (CVE-2026-59822) against LiteLLM MCP tool endpoints. It identifies HTTP requests where the authorization bearer token is unusually short (<= 12 chars), lacks the 'sk-' prefix, and does not appear to be a valid JWT, yet successfully results in a 200 OK status, indicating a potential bypass of authentication logic.
This rule detects attempts to exploit the LiteLLM proxy pass-through endpoint to interact with the cloud Instance Metadata Service (IMDS). Specifically, it identifies configuration attempts to route traffic to the IMDS IP (169.254.169.254) and subsequent requests to retrieve IAM security credentials, which is indicative of a Server-Side Request Forgery (SSRF) attack to steal cloud identity tokens.
Detects unauthorized exploitation attempts against the LiteLLM Model Context Protocol (MCP) endpoint. The rule monitors for a specific malformed Authorization header pattern (short, non-standard token) associated with CVE-2026-59822, indicating potential vulnerability scanning or exploitation of the service.
Detects unauthorized exploitation attempts against the LiteLLM Model Context Protocol (MCP) endpoint. The rule monitors for a specific malformed Authorization header pattern (short, non-standard token) associated with CVE-2026-59822, indicating potential vulnerability scanning or exploitation of the service.
Detects a multi-stage authentication bypass attempt against LiteLLM MCP endpoints. The rule tracks an initial malformed Authorization Bearer token request to the /mcp/ endpoint, followed by a server response returning a 200 OK status code accompanied by an 'mcp-session-id' header, confirming the exploitation of CVE-2026-59822.
Detects a multi-stage authentication bypass attempt against LiteLLM MCP endpoints. The rule tracks an initial malformed Authorization Bearer token request to the /mcp/ endpoint, followed by a server response returning a 200 OK status code accompanied by an 'mcp-session-id' header, confirming the exploitation of CVE-2026-59822.
Detects incoming HTTP requests to sensitive LiteLLM endpoints (/mcp and /guardrails) which are typically intended for internal or controlled use. Exposing these to the public internet may allow unauthorized individuals to interact with, enumerate, or exploit the LiteLLM framework's capabilities.
Detects anomalous HTTP POST requests to the Keycloak '/login-actions/reset-credentials' endpoint that lack required action tokens (e.g., 'key=' or 'execution=' parameters). This behavior is indicative of an exploitation attempt targeting CVE-2026-18963, potentially aimed at bypassing authentication or triggering unauthorized credential reset flows.
Detects potential data exfiltration activity where a host is communicating with the Telegram Bot API. The rule identifies high-frequency connections to api.telegram.org and inspects HTTP URIs for signs of Telegram Bot token usage combined with 'sendDocument' or 'sendPhoto' commands, which are common indicators of malicious exfiltration.
Detects potential data exfiltration activity where a host is communicating with the Telegram Bot API. The rule identifies high-frequency connections to api.telegram.org and inspects HTTP URIs for signs of Telegram Bot token usage combined with 'sendDocument' or 'sendPhoto' commands, which are common indicators of malicious exfiltration.
Detects potential exfiltration activity by identifying HTTP POST/PUT requests to known suspicious domains, including specific operator-controlled hosts and anonymous file sharing services, as well as the use of HTTP Range headers for bulk API data exfiltration.
Detects indicators of cross-site scripting (XSS) attacks aimed at stealing web session cookies. The rule covers the injection of malicious scripts into client responses, anomalous CORS preflight responses that could facilitate data exfiltration, and subsequent HTTP callbacks or beaconing containing cookie data to external endpoints.
The following analytic identifies potential exploitation attempts against Citrix ADC related to CVE-2023-3519. It detects POST requests to specific web endpoints associated with this vulnerability by leveraging the Web datamodel.
This activity is significant as CVE-2023-3519 involves a SAML processing overflow issue that can lead to memory corruption, posing a high risk.
If confirmed malicious, attackers could exploit this to execute arbitrary code, escalate privileges, or disrupt services, making it crucial for SOC analysts to monitor and investigate these alerts promptly.
This activity is significant as CVE-2023-3519 involves a SAML processing overflow issue that can lead to memory corruption, posing a high risk.
If confirmed malicious, attackers could exploit this to execute arbitrary code, escalate privileges, or disrupt services, making it crucial for SOC analysts to monitor and investigate these alerts promptly.
Detects specific DNS-over-HTTPS (DoH) requests made to Google resolvers containing suspicious domain patterns associated with potential C2 infrastructure (QuietRacket). This includes both the identification of the DoH API call for a specific TXT record and the preceding TLS session initiation to the DoH provider.
Detects automated reconnaissance and enumeration of sensitive web application paths (admin, config, environment files, etc.) from a single source IP. The rule identifies high-frequency request patterns that target specific non-public surface areas while excluding known search engine crawlers and monitoring bots.
Detects high-rate scanning and automated service probing patterns consistent with network reconnaissance. This includes tracking TCP SYN floods to external segments, excessive HTTP/login requests, and automated fingerprinting probes (e.g., favicon or admin panel enumeration). The rule accounts for common uptime monitoring services to minimize false positives.
Detects path traversal attempts against a Vite development server by monitoring for various forms of URI encoding (single/double) and suspicious path patterns (e.g., /etc/passwd, .env, .git/config, /@fs/). The rule tracks these attempts using flowbits and alerts when a successful HTTP 200 response is received after a matching traversal request.
Detects path traversal attempts against a Vite development server by monitoring for various forms of URI encoding (single/double) and suspicious path patterns (e.g., /etc/passwd, .env, .git/config, /@fs/). The rule tracks these attempts using flowbits and alerts when a successful HTTP 200 response is received after a matching traversal request.
Detects attempts to access sensitive files like environment variables (.env), cloud provider credentials (AWS/Azure), or Terraform state files via a web server interface, specifically targeting Vite development server deployments.
Detects attempts to access sensitive files like environment variables (.env), cloud provider credentials (AWS/Azure), or Terraform state files via a web server interface, specifically targeting Vite development server deployments.
This rule detects inbound HTTP requests targeting a Vite development server that attempt to access the '.env' configuration file via the '//@fs/' path, which is a known technique for sensitive file exposure in misconfigured Vite environments.
Page 84 of 202