Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,427
11,813
5,871
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
This rule detects suspicious HTTP POST requests to a /collect endpoint that contain tracking parameters (visitorId, stage, variant, events) associated with 'ClickFix' social engineering campaigns. These campaigns typically trick users into copying and pasting malicious code by simulating error prompts or CAPTCHAs.
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying outbound HTTP POST requests to the '/api/t' URI path occurring on non-standard ports. The detection utilizes a threshold-based trigger to identify potential C2 communication heartbeats.
This rule detects network traffic patterns indicative of the Lumma Stealer 'ClickFix' phishing campaign. It identifies outbound requests to suspicious domains ending in .cyou utilizing specific user agents (WinHttp or Microsoft BITS), which are characteristic of malicious PowerShell scripts attempting to retrieve secondary payloads.
This rule detects HTTP POST requests to .php files containing suspicious PHP execution functions in the request body, such as 'system', 'eval', or 'shell_exec'. These patterns are indicative of an attempt to execute commands via an in-memory or injected PHP web shell on an F5 BIG-IP APM device.
Detects post-exploitation activity against Citrix NetScaler appliances associated with CVE-2026-8452. The rule specifically monitors for HTTP GET requests targeting PHP files within the /var/vpn/theme/ directory, accompanied by efforts to execute shell commands (bin/sh) via the web server.
Detects an exploitation attempt targeting SharePoint through the EditingPageParser by injecting a Register directive. This attempt involves bypassing SafeControls through specifically crafted HTTP POST requests to ToolPane.aspx, utilizing the GetPartPreviewAndPropertiesFromMarkup function to execute malicious tag patterns.
Detects two-stage phishing activity involving an initial visit to a Vercel-hosted lure page followed by the exfiltration or relay of fingerprinting and sandbox-evasion results to api.telegram.org.
Detects high-frequency DNS NXDOMAIN responses for domains exhibiting patterns indicative of Domain Generation Algorithms (DGA), specifically fixed-length, high-entropy character strings. This behavior is commonly associated with botnets attempting to locate command and control infrastructure.
Detects HTTP POST requests directed at common Machine Learning inference endpoints (e.g., /predict, /classify, /infer) where the request body claims to be a multipart form-data image upload (Content-Type: image/jpeg) but the actual binary data does not contain the standard JPEG file signature (FF D8 FF). This pattern is indicative of adversarial attempts to bypass security controls or provide malformed payloads to ML models.
Detects unauthenticated GET requests to known AI and machine learning infrastructure management endpoints (e.g., DCGM, Ray, Kubeflow) that are commonly exposed without authentication. These interfaces provide operational metrics, cluster status, or job management details, which can be leveraged for reconnaissance.
Detects network traffic containing TLS Server Name Indication (SNI) fields associated with known 'jailbreak-as-a-service' LLM proxies, specifically WormGPT, FraudGPT, and EvilGPT. These services are often used by threat actors to generate malicious content, phishing emails, or exploit code.
Detects attempts to exploit CVE-2026-48710 in Starlette frameworks where an attacker attempts to smuggle path or authority information via the HTTP Host header using character encoding variations like slashes or URL-encoded sequences.
Detects unauthenticated attempts to access Adobe Commerce/Magento REST API endpoints. This rule specifically looks for HTTP GET requests containing /rest/ and /V1/ paths without an Authorization header, which may indicate an attempt to exploit CVE-2026-71362.
This rule detects attempts to exploit a SQL injection vulnerability in Sangoma Switchvox (CVE-2026-9586) by inspecting HTTP POST request bodies and URIs for common SQL injection patterns such as UNION SELECT, SLEEP(), and DROP TABLE. This vulnerability allows an attacker to execute arbitrary SQL commands on the backend database.
This rule detects HTTP POST requests to the Apache Qpid Broker-J Management API that include a pre-set JSESSIONID in the cookie header during a login operation, indicating an attempt to exploit CVE-2026-92609 via session fixation.
Detects anomalous LDAP bind requests containing specific byte sequences characteristic of a potential authentication bypass exploit identified as CVE-2026-83059. The rule monitors LDAP traffic on standard ports for malformed bind operations that attempt to subvert authentication controls.
Detects suspicious LDAP modify or add operations targeting privileged DNs (orcladmin, OracleContext) on Oracle Internet Directory, indicative of exploitation attempts related to CVE-2026-83057.
Detects attempts to access administrative or configuration endpoints on Cisco Identity Services Engine (ISE) without providing valid authentication headers, cookies, or authorization tokens. This behavior is indicative of exploitation attempts targeting CVE-2026-20192 to gain unauthorized administrative access.
Detects high-volume RDP X.224 connection requests originating from a single source within a short timeframe, which is a strong indicator of a brute force or password spraying attack targeting Remote Desktop Protocol services.
Detects incoming HTTP POST requests that match the signature of the China Chopper web shell client, specifically looking for common evaluative functions (eval, assert, base64_decode) being passed to single-letter parameters, which is a hallmark of this specific web shell's communication pattern.
Detects outbound network traffic exhibiting the default self-signed TLS certificate subject and issuer fields 'O=Cobalt Strike' combined with the known default JA3 fingerprint '72a589da586844d7f0818ce684948eea' associated with Cobalt Strike C2 communication.
Page 18 of 110