Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,306 detections
Filters
Last updated
All Time
Detection languages
2,251
24
22
7
2
Contributors
910
584
506
125
48
Categories
20,427
11,813
5,871
5,145
4,864
2,306
Platforms
2,193
209
169
62
61
Products / Services
2,253
2,159
163
32
31
MITRE Techniques
713
422
387
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects network traffic associated with Adversary-in-the-Middle (AiTM) phishing kits that impersonate Microsoft and Google login pages. The rules identify the presence of specific HTML elements (like Cloudflare Turnstile anti-bot gates) and authentication session cookie headers served from non-authorized/non-official domains, indicating a reverse-proxy phishing attack.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Detects attempts to exploit Oracle WebLogic Server vulnerabilities, specifically those leveraging the T3 protocol to transmit malicious Java serialized payloads, as seen in CVE-2026-70756. The rule identifies suspicious T3 handshake patterns and the presence of common Java deserialization gadget chains.
This rule detects attempts to exploit the Microsoft Support Diagnostic Tool (MSDT) vulnerability CVE-2022-30190, known as 'Follina'. The rules monitor for malicious HTTP traffic and payloads that leverage the 'ms-msdt' URI scheme to execute arbitrary commands, often delivered via weaponized documents or external references to remote malicious HTML files.
Detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by identifying JNDI lookups (ldap, rmi, dns) via malicious strings within HTTP URI and request headers, a common attack vector for remote code execution.
Detects Heartbleed (CVE-2014-0160) exploitation attempts by monitoring for malformed TLS heartbeat requests (undersized payload) followed by oversized responses from the server that indicate potential memory disclosure.
Detects anomalous network traffic patterns characteristic of SectopRAT, specifically utilizing Binance Smart Chain (BSC) RPC nodes to facilitate fallback Command and Control (C2) communication. The rule monitors for POST requests to known BSC data seed domains containing 'eth_call' in the body, specifically looking for START and FINISH markers in the response body.
This rule detects security alerts (IDS, WAF, or infrastructure logs) indicating exploitation attempts against JFrog Artifactory instances related to CVE-2026-66384, specifically involving cache poisoning techniques observed in recent threat campaigns.
Detects network activity associated with the RatHat Android malware, specifically tracking device registration, log uploads to '/api/node/', and subsequent WebSocket protocol upgrades used for command-and-control communications.
Detects network exploitation attempts targeting Fortinet FortiOS and FortiProxy vulnerabilities (CVE-2024-55591, CVE-2025-24472) involving authentication bypass via HTTP header manipulation (Forwarded, X-Forwarded-For) and unauthorized access to the /jsconsole endpoint.
Detects outbound HTTP requests or TLS traffic to known C2 domains associated with APT28/UAC-0001 related to the CVE-2026-21509 campaign.
Detects network activity associated with the APT36 threat group, specifically HTTP requests for PowerShell stagers (irm/iex) from 'indiatodays.org' and TLS connections to that same domain, which is identified as a typosquat used for command and control or ingress tool transfer.
Detects HTTP GET requests to raw.githubusercontent.com that include an 'Authorization: token' header, indicating the potential use of a GitHub Personal Access Token (PAT) for command and control or data exfiltration by the Kimsuky threat group.
Detects outbound HTTP GET requests to Pastebin.com with a path starting with /raw/. This pattern is commonly used by threat actors, including the Kimsuky APT group, to retrieve secondary payloads, configuration files, or malicious scripts from a public repository.
Detects anomalous HTTP GET requests to the Microsoft Teams trap-exp/tokens endpoint that do not carry the expected 'Teams' user-agent string. This pattern is indicative of the DragonForce backdoor attempting to illicitly request Skype authentication tokens.
Detects anomalous HTTP GET requests to the Microsoft Teams trap-exp/tokens endpoint that do not carry the expected 'Teams' user-agent string. This pattern is indicative of the DragonForce backdoor attempting to illicitly request Skype authentication tokens.
Detects anomalous HTTP GET requests to the Microsoft Teams trap-exp/tokens endpoint that do not carry the expected 'Teams' user-agent string. This pattern is indicative of the DragonForce backdoor attempting to illicitly request Skype authentication tokens.
Detects anomalous HTTP GET requests to the Microsoft Teams trap-exp/tokens endpoint that do not carry the expected 'Teams' user-agent string. This pattern is indicative of the DragonForce backdoor attempting to illicitly request Skype authentication tokens.
Detects specific markers in UDP traffic on ports 3478, 5349, and 443 that are associated with the DragonForce malware's TRN1 C2 beaconing protocol. The rules identify session initiation, task polling, task acknowledgment, and result uploading behaviors.
Detects specific markers in UDP traffic on ports 3478, 5349, and 443 that are associated with the DragonForce malware's TRN1 C2 beaconing protocol. The rules identify session initiation, task polling, task acknowledgment, and result uploading behaviors.
Detects network activity associated with the DragonForce backdoor, specifically the use of MQTT for command and control. The rules monitor for unique 16-character client IDs used during registration on non-standard ports, subsequent command retrieval structures containing 'cmdnum', and DNS queries for the hardcoded broker 'broker.emqx.io'.
Page 10 of 110