Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,306 detections
Filters
Last updated
All Time
Detection languages
2,251
24
22
7
2
Contributors
910
584
506
125
48
Categories
20,427
11,813
5,871
5,145
4,864
2,306
Platforms
2,193
209
169
62
61
Products / Services
2,253
2,159
163
32
31
MITRE Techniques
713
422
387
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
This rule detects anomalous outbound SMTP (port 25) traffic originating from a NetScaler ADC or Gateway appliance. Since these appliances have no legitimate business requirement to initiate outbound SMTP communication, such traffic is a strong indicator of post-compromise activity, potentially used for command and control or data exfiltration.
This rule detects HTTP requests containing both Content-Length and Transfer-Encoding headers, which is a technique used in HTTP Request Smuggling attacks. This specific signature targets attempts to exploit CVE-2026-88773 in Citrix NetScaler.
Detects exploitation attempts against Microsoft SharePoint leveraging the ToolShell exploit chain, as well as subsequent post-exploitation webshell activity involving anomalous 'layoutNsp.aspx' naming conventions. This covers initial exploitation of vulnerabilities such as CVE-2025-49704 and associated variants, followed by the deployment of webshells associated with the ToolShell campaign.
Detects TLS connections to a specific, potentially adversary-controlled ScreenConnect relay infrastructure endpoint. Adversaries frequently abuse legitimate remote access tools like ScreenConnect for command and control purposes.
This rule detects potentially malformed or truncated DTLS records on NetScaler appliances, specifically on port 443. The rule looks for packets with a specific record length configuration that may indicate a buffer overflow or other exploitation attempt targeting CVE-2026-88772. The detection logic relies on analyzing the DTLS handshake sequence and packet sizing, and the rule authors recommend correlating these events with SSL_HANDSHAKE_FAILURE (DTLSv1.0, Handshake failure-Internal Error) and appliance crash log entries to confirm potential exploitation.
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
This rule monitors network traffic for TLS SNI and HTTP URI indicators associated with known typo-squatted or spoofed Google Drive and Google Meet phishing domains. It also detects the download of a specific ZIP archive used as a phishing lure.
This rule detects outbound network connections directed at a known IP address associated with Akira ransomware infrastructure. The rule specifically monitors for communication with 64.227.4.134, which has been identified as a C2 node utilizing GOST tunnels. This behavior is indicative of established C2 connectivity by Akira ransomware actors.
Detects exploitation attempts against Microsoft SharePoint leveraging the ToolShell exploit chain, as well as subsequent post-exploitation webshell activity involving anomalous 'layoutNsp.aspx' naming conventions. This covers initial exploitation of vulnerabilities such as CVE-2025-49704 and associated variants, followed by the deployment of webshells associated with the ToolShell campaign.
Detects TLS connections to a specific, potentially adversary-controlled ScreenConnect relay infrastructure endpoint. Adversaries frequently abuse legitimate remote access tools like ScreenConnect for command and control purposes.
Detects incoming HTTP POST requests with unusually large payloads or malformed URI structures directed at Citrix NetScaler Gateway authentication endpoints, which are characteristic of exploitation attempts against CVE-2026-88771.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Detects exploitation attempts against Microsoft SharePoint leveraging the ToolShell exploit chain, as well as subsequent post-exploitation webshell activity involving anomalous 'layoutNsp.aspx' naming conventions. This covers initial exploitation of vulnerabilities such as CVE-2025-49704 and associated variants, followed by the deployment of webshells associated with the ToolShell campaign.
Detects exploitation attempts against Microsoft SharePoint leveraging the ToolShell exploit chain, as well as subsequent post-exploitation webshell activity involving anomalous 'layoutNsp.aspx' naming conventions. This covers initial exploitation of vulnerabilities such as CVE-2025-49704 and associated variants, followed by the deployment of webshells associated with the ToolShell campaign.
Detects TLS connections to a specific, potentially adversary-controlled ScreenConnect relay infrastructure endpoint. Adversaries frequently abuse legitimate remote access tools like ScreenConnect for command and control purposes.
Detects network activity associated with DPRK-affiliated threat actors, specifically connections to known hardcoded C2 IP addresses and DNS queries for malicious o-r.kr subdomains utilized for command and control.
Detects outbound HTTP POST requests that contain a JPEG file signature ('FF D8 FF') in the body but lack a 'Content-Type' header. This pattern is indicative of potential C2 communication from a loader or malware family attempting to exfiltrate or receive data disguised as an image file while bypassing basic header-based inspection.
Detects network traffic associated with Wazza phishkit anti-bot gates, including beacon communications, TLS SNI patterns, fingerprint iframe URIs, and challenge-platform requests.
Detects network traffic (DNS, TLS SNI, and HTTP) associated with Wazza phishkit infrastructure, specifically looking for malicious domains like boegl-krysl.eu and coppietersrecherche.eu, as well as Cloudflare workers.dev domains used for beaconing and lures.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Page 6 of 110