Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects high-volume bursts of HTTP GET requests against specific paths associated with a Vite development server (/@vite/client, /@fs/, /src/) on port 5173. This pattern is indicative of automated reconnaissance or vulnerability scanning targeting an exposed development environment.
This rule detects attempted exploitation of Adobe Commerce (Magento) via GraphQL, specifically targeting Template Property Poisoning through malicious 'styles' array injection as observed in the StyleSmuggler campaign (CVE-2025-54236).
Detects inbound HTTP POST requests to the /paypal/transparent/response/ endpoint containing encoded PHP webshell payloads, specifically attempting to execute base64-decoded code via eval.
Detects HTTP GET requests to '/api.php?t=' containing a 13-digit timestamp identifier, followed by a response body containing 'download_link'. This pattern is indicative of the SilverFox malware relaying instructions or stage-two payload delivery.
Detects HTTP GET requests to '/api.php?t=' containing a 13-digit timestamp identifier, followed by a response body containing 'download_link'. This pattern is indicative of the SilverFox malware relaying instructions or stage-two payload delivery.
Detects network, HTTP, and DNS activity associated with the known three-tier delivery infrastructure (phishing sites, relay/dispatcher servers, and payload hosts) used by the threat actor UNC6671/SilverFox/Aurora. The rule distinguishes between high-confidence confirmed connections and low-confidence DNS-only events.
Detects network, HTTP, and DNS activity associated with the known three-tier delivery infrastructure (phishing sites, relay/dispatcher servers, and payload hosts) used by the threat actor UNC6671/SilverFox/Aurora. The rule distinguishes between high-confidence confirmed connections and low-confidence DNS-only events.
Detects exploitation attempts against the WordPress LiteSpeed Cache plugin (CVE-2024-28000), including suspicious web requests involving ESI/crawler cookie hash manipulation, execution of known exploit binaries (wp28000, wp28000_cp), and subsequent unauthorized creation of administrator accounts via the WordPress REST API.
Detects instances of an mcp-grafana server responding with an HTTP 200 status code to a 'tools/call' request without an Authorization header, indicating potential unauthenticated remote tool execution on a vulnerable or misconfigured server.
Detects country-coded lure path requests (/eg, /ma) followed by a cloaking differential response (desktop UA blocked with 404, mobile UA served content). Fixed a regex bug where the original pattern matched any path merely starting with 'eg' or 'ma' (e.g. /egg.jpg, /mail, /manifest.json) instead of the exact path segment.
This rule monitors for interactions with a list of known malicious phishing domains across email ingestion, user click events, and device network activity. It identifies potential exposure to phishing campaigns by tracking domain matches in incoming email URLs, user-clicked links, and outbound device network connections.
This rule monitors for interactions with a list of known malicious phishing domains across email ingestion, user click events, and device network activity. It identifies potential exposure to phishing campaigns by tracking domain matches in incoming email URLs, user-clicked links, and outbound device network connections.
This rule monitors for interactions with a list of known malicious phishing domains across email ingestion, user click events, and device network activity. It identifies potential exposure to phishing campaigns by tracking domain matches in incoming email URLs, user-clicked links, and outbound device network connections.
Detects sensitive data exfiltration attempts (PII, credit card, OTP) via HTTP POST requests to suspicious lookalike domains, followed by a WebSocket connection to known IronToll C2 infrastructure.
Detects sensitive data exfiltration attempts (PII, credit card, OTP) via HTTP POST requests to suspicious lookalike domains, followed by a WebSocket connection to known IronToll C2 infrastructure.
Detects anomalous outbound HTTP traffic directed to /cli/check containing a specific 'X-CLI-Token' header value. This pattern is indicative of a Command and Control (C2) beaconing mechanism used by a compromised CLI tool or supply chain implant to verify connectivity or receive instructions.
Detects high-frequency POST requests to the JFrog Artifactory '/access/api/v1/tokens' endpoint, which is indicative of mass exploitation attempts targeting vulnerabilities (CVE-2026-82329) against administrative token management.
Detects high-frequency POST requests to the JFrog Artifactory '/access/api/v1/tokens' endpoint, which is indicative of mass exploitation attempts targeting vulnerabilities (CVE-2026-82329) against administrative token management.
Detects network activity (HTTP, TLS SNI, and DNS) associated with the domain 'noht1ng.top', which is linked to the GRAYRABBIT malware utilized by the threat actor UNC3569.
Detects OAuth2 JWT bearer-grant token requests to Google's OAuth endpoint using the attacker-controlled service-account identity and Sheets API scope observed in the fake GlobalProtect campaign
Detects HTTP GET requests to the GitLab project repository commits API that contain path traversal sequences ('../' or encoded variations). This behavior is characteristic of exploitation attempts targeting vulnerabilities that allow unauthorized file access or directory traversal within the GitLab environment.
Page 85 of 202