Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,424
11,812
5,870
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects high-volume POST requests containing HEIF, HEIC, or AVIF image content types, indicative of automated fuzzing or exploitation attempts against an image-processing endpoint targeting CVE-2026-32882.
Detects network activity associated with the SilverFox multi-tier relay infrastructure, specifically identifying HTTP requests to known relay domains and dispatcher endpoints used for command-and-control (C2) communication.
This rule detects suspicious outbound HTTP GET requests to a known domain (noah-ssh.com.cn) targeted by the SilverFox malware relay dispatcher. It specifically monitors for requests to '/api.php' containing a 13-digit numeric timestamp parameter, which is a characteristic pattern of its C2 communication.
Detects outbound network communication attempts by the SilverFox malware to known Cloudflare Workers relay infrastructure, specifically targeting hostnames associated with 'noah-relay' instances. The rule monitors DNS lookups, TLS SNI headers, and HTTP Host headers to identify potential Command and Control (C2) traffic.
Detects high-frequency outbound TCP connection attempts from a WSO2 API Gateway or Traffic Manager host to multiple sensitive internal management and administrative ports (22, 445, 3389, 5985, 5986). This behavior is indicative of a compromised gateway being used for lateral movement across the network.
This rule detects outgoing HTTP POST requests to the public BSC testnet RPC endpoint ('bsc-testnet-rpc.publicnode.com') containing an 'eth_call' request, which is a technique used by the 'EtherHiding' campaign to fetch malicious JavaScript payloads directly from blockchain smart contracts, bypassing traditional web-based C2 infrastructure.
Detects network traffic attempting to download malicious PowerShell payloads via WebDAV from the domain leaguejazire.com, which is associated with the ClearFake malware campaign.
Detects unauthenticated HTTP POST requests targeting the FortiGate administrative API (/api/v2/), which may indicate exploitation attempts related to CVE-2025-25249. The rule specifically looks for requests lacking authentication headers (Cookie or Authorization).
This rule detects network traffic originating from the local network to external destinations that exhibit characteristics associated with the Xray-core tool, specifically the use of a spoofed TLS Server Name Indication (SNI) of 'dl.google.com' paired with a server certificate that does not contain 'Google' in the subject. This technique is used to bypass network filters by masquerading command and control traffic as legitimate Google traffic.
This rule monitors and alerts on network traffic (TCP/TLS/HTTP) directed toward a known malicious IP address associated with an Adversary-in-the-Middle (AiTM) phishing infrastructure, categorized under the PREY-0058 designation.
This rule detects potential Xray-core command-and-control (C2) activity where a client initiates a TLS connection using 'dl.google.com' as the Server Name Indication (SNI) but connects to a destination IP address that does not belong to Google's infrastructure. This technique is often used to mask C2 traffic as legitimate traffic to Google services.
Detects suspicious network traffic to Ethereum Sepolia testnet RPC endpoints (Alchemy and Infura) indicative of the 'indexed-btree' malware campaign. The rule monitors for characteristic C2 polling patterns, specifically requests involving malicious contract addresses and specific RPC methods (eth_call, eth_getStorageAt) associated with this activity.
Detects outbound TLS traffic behavior consistent with the WaterPlum RAT, characterized by periodic, low-volume connections to non-CDN/cloud providers. The rule identifies potential beaconing activity by monitoring TLS SNI fields against a list of known legitimate service providers and applying a frequency threshold.
Detects outbound TLS traffic behavior consistent with the WaterPlum RAT, characterized by periodic, low-volume connections to non-CDN/cloud providers. The rule identifies potential beaconing activity by monitoring TLS SNI fields against a list of known legitimate service providers and applying a frequency threshold.
Detects outbound TLS traffic behavior consistent with the WaterPlum RAT, characterized by periodic, low-volume connections to non-CDN/cloud providers. The rule identifies potential beaconing activity by monitoring TLS SNI fields against a list of known legitimate service providers and applying a frequency threshold.
Detects outbound HTTP POST requests to known public Ethereum RPC gateways (Alchemy and Infura) containing embedded, hardcoded API keys or references to specific contract addresses associated with the 'indexed-btree' malware campaign. This pattern indicates a compromised host leveraging legitimate Web3 infrastructure for Command and Control (C2) communication.
This rule detects malformed SCTP packets that trigger a protocol decoding error ('pkt_too_small'). This behavior is associated with the 'DiagSpill' vulnerability (CVE-2026-74469), where specially crafted chunk sequences in the SCTP stream can cause a remote service crash or potential instability. The rule includes a threshold to mitigate noise from non-malicious malformed packets.
This rule detects malformed SCTP packets that trigger a protocol decoding error ('pkt_too_small'). This behavior is associated with the 'DiagSpill' vulnerability (CVE-2026-74469), where specially crafted chunk sequences in the SCTP stream can cause a remote service crash or potential instability. The rule includes a threshold to mitigate noise from non-malicious malformed packets.
Detects a specifically malformed IPv6 Routing Header (type 0) with a 'segments_left' value of 255 preceding an Authentication Header (AH). This signature targets an exploit pattern known as 'DirtyAH6', which aims to trigger a remote kernel crash or potential remote code execution on vulnerable systems by manipulating IPv6 header processing.
Detects a specifically malformed IPv6 Routing Header (type 0) with a 'segments_left' value of 255 preceding an Authentication Header (AH). This signature targets an exploit pattern known as 'DirtyAH6', which aims to trigger a remote kernel crash or potential remote code execution on vulnerable systems by manipulating IPv6 header processing.
Detects high-frequency SCTP ASCONF/ADD-IP chunk packets originating from external networks. This behavior is indicative of a Denial-of-Service (DoS) exploit attempt targeting a vulnerability (CVE-2026-74469) related to DiagSpill transport_count integer wraparound.
Page 48 of 110