Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,417
11,806
5,870
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects network activity associated with the Handala Loader malware, specifically identifying attempts to download disguised shellcode or malicious payloads from deadhub.org and associated infrastructure. The rule monitors for specific URI patterns mimicking UI assets and fallback communication attempts to known C2 IP addresses.
Detects phishing attempts related to 'Operation DoppelBrand' campaign using common email service providers (ESPs) to spoof legitimate-looking emails with fraud-themed subjects, such as invoices or payment requests, associated with the Brickstorm malware.
This rule detects outbound TLS connections from the internal network to external destinations where the server certificate is self-signed. It identifies connections where both the certificate issuer and subject common names (CN) are present, which is often indicative of opportunistic encryption used by C2 infrastructure or malicious payloads. The rule includes a threshold to reduce noise by limiting alerts for the same source over a specific window.
Detects incoming HTTP requests to sensitive LiteLLM endpoints (/mcp and /guardrails) which are typically intended for internal or controlled use. Exposing these to the public internet may allow unauthorized individuals to interact with, enumerate, or exploit the LiteLLM framework's capabilities.
Detects outbound network traffic associated with the Tailscale VPN protocol, specifically identifying potential unauthorized or personal tailnet communication channels. The detection monitors for TLS SNI strings ending in '.ts.net' and WireGuard handshakes on UDP port 41641. These indicators are common to all Tailscale client activity and require environment-specific exclusions of sanctioned Tailscale infrastructure to minimize noise.
Detects potential exfiltration activity by identifying HTTP POST/PUT requests to known suspicious domains, including specific operator-controlled hosts and anonymous file sharing services, as well as the use of HTTP Range headers for bulk API data exfiltration.
Detects outbound network traffic containing cleartext Windows command shell banners, which is highly indicative of a reverse shell connection where a remote attacker has established interactive command-line access to a compromised host.
Detects outbound TCP traffic originating from the internal network destined for a known malicious IP associated with Meterpreter Java payload retrieval and post-exploitation Command and Control (C2) activity, potentially related to PaperCut vulnerability exploitation.
Detects DNS queries and TLS SNI traffic directed towards known malicious domains associated with passkey and SSO phishing campaigns, specifically attributed to Storm-3121 and Storm-3032. These domains are used to deceive users into providing credentials or authentication tokens via fraudulent login portals.
This rule monitors incoming HTTP requests for the use of PHP stream wrappers (e.g., php://, data://, expect://, etc.). Such wrappers are often leveraged by adversaries to perform Local File Inclusion (LFI) or to achieve Remote Code Execution (RCE) by manipulating input parameters in vulnerable web applications.
This rule detects potential OS command injection attempts in HTTP request parameters by monitoring for common shell command separators and subsequent execution of suspicious system binaries (e.g., sh, bash, curl, wget, python).
Detects HTTP traffic that contains an abnormal number of nested encoding layers, which is often used by attackers to evade network-based inspection signatures and WAF filters.
Detects established TLS outbound connections to external networks on ports other than standard ones (e.g., 443, 465, 587, 993, 995, 8443, 9443). This behavior may indicate a covert C2 channel or unauthorized data exfiltration attempting to bypass standard firewall controls.
Detects inbound HTTP traffic directed to internal hosts on ports other than commonly used web ports (80, 443, 8080, 8443, 8000, 8888, 3128). This behavior may indicate an attempt to bypass network security controls or the use of non-standard ports for command and control or data exfiltration.
This rule detects HTTP requests that contain duplicate 'Content-Length' headers, a technique used to perform HTTP Request Smuggling attacks. Attackers exploit discrepancies in how front-end and back-end servers interpret duplicate or conflicting request headers to smuggle requests, bypass security controls, or gain unauthorized access to back-end systems.
Detects repeated suspicious network requests, including non-standard HTTP methods and URI structures, as well as TLS SNI anomalies, targeting the internal sales portal 'agent.3bb.co.th'. The rule triggers when a threshold of 20 requests within a 60-second window is reached from a single source, indicating likely automated reconnaissance or vulnerability scanning activity.
Detects repeated suspicious network requests, including non-standard HTTP methods and URI structures, as well as TLS SNI anomalies, targeting the internal sales portal 'agent.3bb.co.th'. The rule triggers when a threshold of 20 requests within a 60-second window is reached from a single source, indicating likely automated reconnaissance or vulnerability scanning activity.
Detects repeated suspicious network requests, including non-standard HTTP methods and URI structures, as well as TLS SNI anomalies, targeting the internal sales portal 'agent.3bb.co.th'. The rule triggers when a threshold of 20 requests within a 60-second window is reached from a single source, indicating likely automated reconnaissance or vulnerability scanning activity.
Detects HTTP POST requests to a Gitea repository's diffpatch API endpoint whose body contains both a real git diff header and the malicious 'hooks/post-index-change' file path used by the CVE-2026-60004 exploit chain to plant an executable Git hook via an add/add merge collision.
Detects repeated manual HTTP GET requests from many distinct source IPs to a canary token resource. The URI pattern follows a format indicative of a tracked canary token resource, and the threshold of 49 unique source IPs accessing the resource within a prolonged period suggests potential unauthorized reconnaissance or probing activities.
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
Page 65 of 110