Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,427
11,813
5,871
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects HTTP traffic originating from internal hosts to external destinations on port 8989, specifically targeting '/chat/completions' URI patterns. This activity is indicative of the CARBONATO/Hermes Agent leveraging LLM gateway infrastructure as a command-and-control (C2) channel.
Detects network activity associated with the NeedyMantis malware command and control (C2), including DNS queries for the domain corp.tripswithengine.com, TLS SNI identification, and specific HTTP beaconing patterns to /library/zip/ with a hardcoded user agent.
Detects HTTP traffic associated with the NeedyMantis malware, specifically identifying initial beacons to a known C2 domain using a specific User-Agent, followed by command-and-control response headers that suggest the exfiltration of reconnaissance data via the Set-Cookie field.
Detects network patterns associated with NeedyMantis-style command-and-control (C2) activity. This includes specific HTTP GET requests with hardcoded User-Agent strings, cookie-based binary data transfer in server responses, and WebSocket communication attempting to establish binary protocol channels.
Detects outbound network requests to known infrastructure associated with the ClickFix Traffic Direction System (TDS), specifically targeting domains 'fsputnik.com' and 'uasputnik.com'. The rules monitor for requests to specific lure pages, tracker files, and established IP connections used by this malicious campaign to deliver fraudulent prompts or lures to victims.
Experimental CommonSecurityLog template for sensor-reported attempts associated with Cisco advisory cisco-sa-ise-rce-se7bYU57: CVE-2026-20307, CVE-2026-20176 and CVE-2026-20211. Cisco links Snort SIDs 67114, 67115, 67116 and 67130-67132. Configure exact exporter event IDs, sensor vendor/product and confirmed ISE management IPs. A match does not prove successful exploitation or root compromise.
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
Detects anomalous outbound HTTP/TLS requests to rutracker.org that contain a GUID-like identifier in the URI or deviate from normal user traffic patterns, which is characteristic of the 'VPN-for-X' browser extension acting as a command-and-control beacon.
This rule detects outgoing HTTP POST requests to the '/api/credentials' endpoint, which is characteristic of the AMOS (Atomic macOS Stealer) malware family communicating with its command-and-control server to exfiltrate stolen sensitive information.
Detects HTTP beaconing patterns and TLS SNI traffic associated with the Sauron Loader malware. The rules identify specific URI structures (including versioned resources and various configuration/profile endpoints), specific URL parameters used for session management, and characteristic User-Agent strings. Additionally, it monitors for connections to known command-and-control infrastructure via TLS SNI filtering.
Detects inbound command-and-control traffic to the MOVEit Transfer application targeting the LEMURLOOT web shell, and subsequent detection of gzip-compressed database exfiltration.
This rule detects potentially malicious Command and Control (C2) traffic utilizing DNS over HTTPS (DoH) to interact with public resolvers like Cloudflare, Google, and Quad9. It identifies both high-frequency, repeated direct-to-resolver TLS sessions and specific HTTP requests to these resolvers that resolve domains associated with known C2 infrastructure, such as the ClickFix campaign.
Detects high-volume account enumeration activity associated with the TeamFiltration tool, characterized by the use of legacy Microsoft Teams desktop client User-Agent strings (specific versions of Teams, Electron, and Chrome) within a short time window.
Detects NeedyMantis' initial C2 beacon: an HTTP GET to /library/zip/ on port 443, anchored to the URI root, carrying a client-originated 'Set-Cookie:' header (clients normally send 'Cookie:', never 'Set-Cookie:' -- this direction reversal is the core anomaly and is near-impossible for legitimate traffic) alongside an explicit 'Upgrade: websocket' header. Matching the literal header text (not just header-name presence) and anchoring the URI removes generic WebSocket apps and any unrelated path containing '/library/zip/' as a substring.
Detects HTTP response bodies containing indicators of 'ClickFix' social engineering lures. The rule monitors for JavaScript code designed to manipulate the user's clipboard (execCommand('copy') or clipboard.writeText) in conjunction with instructions for the user to execute the Windows Run dialog (Win+R), a common technique to trick users into executing malicious commands under the guise of solving a fake CAPTCHA or error.
This rule detects a multi-stage phishing redirection chain where a user visits a known survey platform (t.maze.co) followed immediately by a request to a Cloudflare Workers landing page (.workers.dev), a common pattern used by adversaries to obfuscate malicious delivery endpoints.
Detects unauthenticated POST requests to the TorchServe Management API '/models' endpoint containing a 'url=' parameter. This pattern is indicative of an attempt to perform remote model registration, which could be leveraged for Remote Code Execution (RCE) on the server hosting the TorchServe service.
This rule detects unauthorized and potentially unauthenticated POST requests directed at the completion API endpoints (/api/v1/generate and /run/textgen) of the Oobabooga text-generation-webui, which is commonly used to host Large Language Models (LLMs). Such access, if not secured, could allow an external actor to interact with the model or potentially exploit the underlying infrastructure.
This rule detects POST requests to the '/v2/repository/index' endpoint of a Triton Inference Server. This endpoint is part of the Model Repository control API and is typically used to manage or inspect models. Unauthorized access to this API can be indicative of reconnaissance or exploitation attempts against the inference server.
This rule detects unauthorized and unauthenticated attempts to access the Ray Dashboard API '/api/jobs' endpoint. An absence of an Authorization header in these requests indicates potential reconnaissance or exploitation attempts against an exposed Ray cluster management interface.
Detects incoming HTTP GET requests to common Jupyter Notebook endpoints ('/tree' or '/api/kernels') that do not include a token in the URI. This behavior is indicative of an adversary attempting to interact with or explore an insecurely configured Jupyter Notebook server that lacks authentication.
Page 14 of 110