Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,306 detections
Filters
Last updated
All Time
Detection languages
2,251
24
22
7
2
Contributors
910
584
506
125
48
Categories
20,427
11,813
5,871
5,145
4,864
2,306
Platforms
2,193
209
169
62
61
Products / Services
2,253
2,159
163
32
31
MITRE Techniques
713
422
387
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
This rule detects POST requests to the '/v2/repository/index' endpoint of a Triton Inference Server. This endpoint is part of the Model Repository control API and is typically used to manage or inspect models. Unauthorized access to this API can be indicative of reconnaissance or exploitation attempts against the inference server.
This rule detects unauthorized and unauthenticated attempts to access the Ray Dashboard API '/api/jobs' endpoint. An absence of an Authorization header in these requests indicates potential reconnaissance or exploitation attempts against an exposed Ray cluster management interface.
Detects incoming HTTP GET requests to common Jupyter Notebook endpoints ('/tree' or '/api/kernels') that do not include a token in the URI. This behavior is indicative of an adversary attempting to interact with or explore an insecurely configured Jupyter Notebook server that lacks authentication.
Detects a high frequency of SSH connection attempts originating from a single source address within a short timeframe, specifically targeting the initial SSH handshake string. This is indicative of automated brute force or credential stuffing activity against SSH services.
Detects high-frequency requests from automated scripting tools like 'python-requests', 'aiohttp', or 'Scrapy' targeting sensitive directories or files often associated with administrative panels or application configurations (e.g., admin, .env, wp-admin). The rule triggers when a threshold of 10 requests is reached within a 60-second window, indicating potential automated vulnerability or information gathering activity.
Detects multiple inbound HTTP requests targeting known vulnerable application paths (e.g., cgi-bin, .env files, actuator gateways, path traversal, WordPress plugins, PHP eval files, and various server administration consoles) from a single source within a short timeframe. This behavior is indicative of an automated scanner or exploit chain attempting to identify and compromise public-facing applications.
Detects high-volume DNS traffic characterized by long, high-entropy subdomain labels, which are often used as a mechanism for command-and-control (C2) communication or data exfiltration via DNS tunneling.
Detects unauthenticated POST requests directed at the '/v1/completions' endpoint of a vLLM server. This behavior is indicative of potential unauthorized access or exploitation attempts against an exposed LLM inference API that lacks authentication controls.
Detects unauthenticated HTTP POST requests targeting the '/v1/graphql' endpoint of a Weaviate vector database. This pattern is indicative of reconnaissance or exploitation attempts against exposed Weaviate API instances.
This rule detects established TLS connections to external domains that exhibit characteristics often associated with phishing campaigns. Specifically, it looks for domain names in the SNI field that contain common brand names (e.g., microsoft, google, paypal) combined with typical login-related keywords (e.g., login, verify, auth) on high-churn or suspicious Top-Level Domains (TLDs) such as .top, .xyz, or .icu.
Detects network traffic associated with Adversary-in-the-Middle (AiTM) phishing kits that impersonate Microsoft and Google login pages. The rules identify the presence of specific HTML elements (like Cloudflare Turnstile anti-bot gates) and authentication session cookie headers served from non-authorized/non-official domains, indicating a reverse-proxy phishing attack.
Detects specific markers in UDP traffic on ports 3478, 5349, and 443 that are associated with the DragonForce malware's TRN1 C2 beaconing protocol. The rules identify session initiation, task polling, task acknowledgment, and result uploading behaviors.
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
Detects network activity associated with the DragonForce backdoor, specifically the use of MQTT for command and control. The rules monitor for unique 16-character client IDs used during registration on non-standard ports, subsequent command retrieval structures containing 'cmdnum', and DNS queries for the hardcoded broker 'broker.emqx.io'.
Detects network activity associated with the DragonForce backdoor, specifically the use of MQTT for command and control. The rules monitor for unique 16-character client IDs used during registration on non-standard ports, subsequent command retrieval structures containing 'cmdnum', and DNS queries for the hardcoded broker 'broker.emqx.io'.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects network exploitation attempts targeting CVE-2026-82329 in JFrog Artifactory. The rule identifies path traversal, malicious Java deserialization payloads, and unauthorized access attempts to sensitive administrative API endpoints.
Detects high-frequency, sequential outbound GET requests to short URL patterns, potentially indicating a sandbox escape attempt or automated command-and-control activity where shortened links are used to download multi-stage payloads.
Page 15 of 110