Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects browser-based network requests to the Google Sheets Visualization API (gviz/tq) that appear to be used for fetching malicious JavaScript payloads from public Google Sheets. The rule specifically identifies instances where a process initiates these requests without any corresponding active browser session associated with standard Google Docs or Sheets editing activity.
This rule detects potential browser-based wallet address substitution attacks by monitoring for a specific sequence of network connections within a single browser process. It looks for connections to cryptocurrency swap platforms (SimpleSwap/SwapZone) closely followed by the retrieval of an external loader script (paste.sh) and a Google Sheets Visualization API payload, which is a known technique for injecting malicious scripts that intercept and modify XHR/fetch responses in the user's browser.
This rule detects potential browser-based wallet address substitution attacks by monitoring for a specific sequence of network connections within a single browser process. It looks for connections to cryptocurrency swap platforms (SimpleSwap/SwapZone) closely followed by the retrieval of an external loader script (paste.sh) and a Google Sheets Visualization API payload, which is a known technique for injecting malicious scripts that intercept and modify XHR/fetch responses in the user's browser.
This rule detects potential browser-based manipulation or phishing campaigns where a user visits a known loader script host (paste.sh) and subsequently visits cryptocurrency trading sites (SimpleSwap, SwapZone) within a short time window. This behavior is indicative of an injected script modifying the browser's view of trading sites to display deceptive 'Loyalty Bonus' or discount banners to lure users into transactions.
This rule detects potential browser-based manipulation or phishing campaigns where a user visits a known loader script host (paste.sh) and subsequently visits cryptocurrency trading sites (SimpleSwap, SwapZone) within a short time window. This behavior is indicative of an injected script modifying the browser's view of trading sites to display deceptive 'Loyalty Bonus' or discount banners to lure users into transactions.
Detects JNDI lookup patterns associated with Log4Shell (CVE-2021-44228) exploitation attempts.
Detects the creation of a WordPress administrator account within one hour of a recorded web request to a known web shell path (Mushr00w) or suspect plugin upload directory. This correlation is a high-fidelity indicator of post-exploitation persistence and administrative account hijacking.
Detects outbound network traffic from a potential backdoor known as 'Toy Ghouls' (bird-agent) to the ip-api.com service, likely used for geolocation-based reconnaissance or target validation.
This rule detects high-volume, potentially automated POST requests to specific WordPress plugin endpoints (Super Forms and Elementor Pro) used for form submissions and file uploads. A high frequency of these requests from a single source within a short timeframe suggests active reconnaissance or exploitation attempts against these vulnerable components.
Detects Server-Side Request Forgery (SSRF) attempts originating from the Grafana MCP (Model Context Protocol) process. The rule specifically monitors for instances where the 'grafana_api_request' tool is used in conjunction with a 'X-Grafana-URL' header targeting cloud metadata IP ranges (169.254.0.0/16), or where the host attempts to resolve GCP metadata domains ('metadata.google.internal'). This behavior is indicative of an attacker attempting to access cloud provider instance metadata to exfiltrate security credentials.
Detects high-frequency requests for 'tools/list' from a single source IP across multiple unique destination hosts. This pattern is indicative of a breadth-first scan attempting to identify reachable Model Context Protocol (MCP) servers, rather than typical legitimate client-to-server communication.
Detects Server-Side Request Forgery (SSRF) attempts targeting vulnerable versions of Grafana MCP Server (versions < 1.1.0). The rule identifies requests attempting to access sensitive internal or cloud-metadata endpoints (e.g., 169.254.169.254, localhost, internal subnets) via the X-Grafana-URL header.
Detects DNS lookups, TLS SNI headers, and HTTP Host headers associated with the known StyleSmuggler malware download domain '247.cdnflare.xyz'.
This rule detects an unauthenticated exploitation attempt against Magento GraphQL endpoints, specifically targeting the 'styles' parameter. The attack pattern involves sending a malformed request to the /graphql endpoint with an 'X-TRACE-' header, which is indicative of the StyleSmuggler vulnerability exploit.
Detects inbound HTTP POST requests to the /paypal/transparent/response/ endpoint containing encoded PHP webshell payloads, specifically attempting to execute base64-decoded code via eval.
Detects outbound web requests directed at public NPM mirrors and CDNs (unpkg, npmmirror, yarnpkg, jsdelivr) that contain strings matching known malicious package names associated with the 'Beamglea/ClickFix' campaign. This activity is typically indicative of a victim visiting a deceptive Cloudflare CAPTCHA phishing page designed to execute malicious scripts in the browser.
Detects abnormally long request URIs, often indicating fuzzing or buffer-overflow probing.
Detects network requests originating from the Netch gateway tool or similar environments, attempting to fetch auto-configuration profiles for Shadowsocks from the external domain 'www.sheng886.top' using the '/api/v1/internal/shadowsocks/auto-config' endpoint. The rule specifically matches the Go-http-client user agent, which is common in automated scripts and Go-based proxy tools.
Detects an HTTP POST request targeting the host 'tt.yeyoujs.com' at the URI path '/api/agent/enroll', containing a specific Python aiohttp User-Agent string. This pattern is characteristic of a C2 agent attempting to register or enroll with an external command-and-control server.
This rule detects inbound HTTP GET requests to a specific IP address (103.86.86.244) requesting a file named 'deploy.ps1'. This behavior is characteristic of adversaries using PowerShell one-liners (cradles) like 'irm' (Invoke-RestMethod) or 'iex' (Invoke-Expression) to fetch and execute malicious scripts directly from a remote C2 infrastructure.
This rule detects potential unauthenticated access or unauthorized configuration modifications to an AI agent management backend. It monitors HTTP logs for requests targeting configuration endpoints that lack proper authentication, specifically identifying attempts to retrieve sensitive information like Dify or Coze keys, or attempts to inject new agent configurations via unauthenticated POST requests.
Page 93 of 202