Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,427
11,813
5,871
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects potential reconnaissance activities targeting Redis services on port 6379, specifically looking for unauthenticated 'PING' commands and subsequent responses indicating either authentication requirements or an open, unauthenticated instance.
Detects HTTP requests targeting the /terminal/ws endpoint of a Marimo notebook application, which indicates an attempt to exploit CVE-2026-39987, a pre-authentication Remote Code Execution vulnerability involving WebSocket connections.
Detects network activity associated with the SilkParasite botnet. The rule identifies inbound/outbound HTTP heartbeat check-ins using a specific URI pattern (/ping?h=) and direct TCP connections to a known malicious C2 IP address.
Detects network activity associated with the Psychedelic Stealer malware command-and-control (C2) communication patterns. The rule identifies specific API endpoints used for task polling, heartbeat pings, check-ins, and task acknowledgement, as well as connections to a known malicious C2 infrastructure, all characterized by the presence of a specific 'X-API-Key' header.
Detects network activity associated with RatHat FRP (Fast Reverse Proxy), including configuration fetching, deployment notifications, and command-and-control handshakes. These rules monitor for specific HTTP API endpoints and TCP patterns used by the tool to establish unauthorized reverse tunnels.
Detects network traffic associated with the RatHat malware family, which leverages the Gemini API to perform automated UI navigation on Android devices. The rule identifies both the outgoing prompt containing UI analysis instructions and the corresponding incoming API response containing coordinate-based navigation instructions.
Detects HTTP beaconing activity characteristic of the OnyxC2 stealer malware, specifically identifying the synchronization command ('action=sync') containing hardcoded parameters for host identification and bot versioning.
Detects network activity associated with Adversary-in-the-Middle (AiTM) phishing kits that perform client-side fingerprinting and geolocation tracking. The rules identify the initial fingerprinting request, the subsequent setting of a geolocation cookie by the proxy, and the query to a third-party geolocation service, using state tracking to correlate the chain of events.
Detects network activity associated with the GhostCode kit's bot-filter challenge, which performs session token/hash chaining prior to a device-code phishing redirect. The rule monitors for specific URL patterns containing 'check=1' and a session identifier, coupled with a mandatory 'js_enabled=1' cookie, commonly used to filter automated security scanners and verify bot activity before serving malicious content.
These rules monitor for suspicious WordPress authentication activity, including brute force and credential spraying attacks targeting XML-RPC endpoints and the standard wp-login.php interface. The rule set includes detections for high-frequency login attempts and subsequent indicators of potential successful authentication.
Detects anomalous POST requests containing the 'CrpxBoundary' string sent to a '/relay.php' endpoint. This signature is associated with the pre-encryption data exfiltration phase of CRPx0 ransomware.
Detects high-volume account enumeration activity associated with the TeamFiltration tool, characterized by the use of legacy Microsoft Teams desktop client User-Agent strings (specific versions of Teams, Electron, and Chrome) within a short time window.
Detects network traffic patterns indicative of adversary-in-the-middle (AiTM) phishing infrastructure. The rule identifies suspicious TLS Server Name Indication (SNI) strings matching common SaaS login portals (Microsoft, Okta, Google) paired with SSL/TLS certificates issued by 'Let's Encrypt' that contain suspicious subject names, suggesting a freshly generated infrastructure for credential harvesting.
This rule detects unauthorized downloads of Tailscale VPN client binaries or related dependencies (such as wintun.dll) originating from a specific GitHub repository ('cphc811-ui'). Such activity is often associated with the Kothamine threat actor attempting to establish unauthorized remote access or command-and-control channels by provisioning VPN software on compromised hosts.
This rule detects unauthorized downloads of Tailscale VPN client binaries or related dependencies (such as wintun.dll) originating from a specific GitHub repository ('cphc811-ui'). Such activity is often associated with the Kothamine threat actor attempting to establish unauthorized remote access or command-and-control channels by provisioning VPN software on compromised hosts.
This rule detects unauthorized downloads of Tailscale VPN client binaries or related dependencies (such as wintun.dll) originating from a specific GitHub repository ('cphc811-ui'). Such activity is often associated with the Kothamine threat actor attempting to establish unauthorized remote access or command-and-control channels by provisioning VPN software on compromised hosts.
This rule detects unauthorized downloads of Tailscale VPN client binaries or related dependencies (such as wintun.dll) originating from a specific GitHub repository ('cphc811-ui'). Such activity is often associated with the Kothamine threat actor attempting to establish unauthorized remote access or command-and-control channels by provisioning VPN software on compromised hosts.
Detects network traffic attempting to exploit CVE-2021-33044, an authentication bypass vulnerability in Dahua NetKeyboard devices, by identifying specific login request strings used in the exploit chain.
Detects outbound TCP traffic originating from internal hosts to known command and control infrastructure associated with the SilkParasite campaign and the SpiceRAT malware family.
Detects repeated authentication login attempts (opcode 0xA0) against Dahua Easy4IP devices over TCP port 37777, indicative of a brute-force or credential stuffing attack.
Detects outbound TCP traffic originating from internal hosts to known command and control infrastructure associated with the SilkParasite campaign and the SpiceRAT malware family.
Page 33 of 110