Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,401
11,795
5,864
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects Server-Side Request Forgery (SSRF) attempts targeting an MLflow server where an attacker-controlled HTTP redirect response forces the server to reach out to the cloud instance metadata service at 169.254.169.254. This rule specifically looks for HTTP 30x redirect status codes where the Location header contains the sensitive metadata service IP address.
Detects outbound network traffic associated with the Tailscale VPN protocol, specifically identifying potential unauthorized or personal tailnet communication channels. The detection monitors for TLS SNI strings ending in '.ts.net' and WireGuard handshakes on UDP port 41641. These indicators are common to all Tailscale client activity and require environment-specific exclusions of sanctioned Tailscale infrastructure to minimize noise.
Detects potential exfiltration activity by identifying HTTP POST/PUT requests to known suspicious domains, including specific operator-controlled hosts and anonymous file sharing services, as well as the use of HTTP Range headers for bulk API data exfiltration.
Detects indicators of cross-site scripting (XSS) attacks aimed at stealing web session cookies. The rule covers the injection of malicious scripts into client responses, anomalous CORS preflight responses that could facilitate data exfiltration, and subsequent HTTP callbacks or beaconing containing cookie data to external endpoints.
This rule detects command-and-control (C2) communication patterns associated with the 'soraki-proxy.workers.dev' domain, a Cloudflare Workers-hosted proxy service. Additionally, it identifies potential malicious mTLS implants by flagging non-standard TLS handshakes that use self-signed or auto-generated certificates missing standard organization (O) fields in the subject DN.
Detects Server-Side Request Forgery (SSRF) attempts against Grafana instances using the 'X-Grafana-URL' header. The rule identifies requests attempting to access internal network ranges, link-local addresses, or cloud metadata endpoints (e.g., 169.254.169.254, localhost) via the Grafana MCP interface, particularly when non-GET HTTP methods are used to potentially mutate internal resources.
Detects high-frequency TCP/445 connection attempts (a 'connect sweep') characteristic of automated SMB share enumeration, which is commonly used for lateral movement reconnaissance. The rule triggers when a threshold of 40 connection requests occurs from a single source within a 30-second window, specifically targeting SMB-related lateral movement behaviors.
Detects network activity associated with the ProRAM C2 infrastructure. The rule monitors for DNS resolutions, TLS SNI field matches, and specific HTTP WebSocket upgrade patterns directed towards the 'clash-verge-upgrade.com' domain.
Detects high-rate scanning and automated service probing patterns consistent with network reconnaissance. This includes tracking TCP SYN floods to external segments, excessive HTTP/login requests, and automated fingerprinting probes (e.g., favicon or admin panel enumeration). The rule accounts for common uptime monitoring services to minimize false positives.
Detects high-rate scanning and automated service probing patterns consistent with network reconnaissance. This includes tracking TCP SYN floods to external segments, excessive HTTP/login requests, and automated fingerprinting probes (e.g., favicon or admin panel enumeration). The rule accounts for common uptime monitoring services to minimize false positives.
Detects HTTP traffic patterns associated with the JSCeal malware family, specifically focusing on the exfiltration of crypto wallet information and account balances. The rule identifies communication to suspicious domains, unauthorized access to balance field names, and the masquerading of traffic to impersonate legitimate exchanges like Binance.
Detects the download of a JavaScript module named JSCeal, which contains code indicative of an HTTPS interception proxy. The rule looks for Node.js-based server creation code combined with cryptographic operations like keypair generation, certificate creation, and PEM conversion, excluding common legitimate JavaScript libraries and CDNs.
Detects high-frequency SYN scanning activity targeting TCP port 37777 (commonly associated with Dahua devices) from an external source. This behavior is indicative of automated reconnaissance or mass-scanning campaigns, such as Operation CameraSwarm, attempting to identify exposed or potentially vulnerable IoT/surveillance hardware.
Detects repeated HTTP requests targeting the '/cgi-bin/' path on Dahua camera web interfaces with a specific user-agent string ('CGI Brute'). This behavior is characteristic of an automated brute-force campaign attempting to gain unauthorized access to camera web administration interfaces.
This rule detects rapid SYN packet patterns from external sources targeting the Dahua proprietary port 37777, characteristic of network scanning tools like Masscan attempting to discover or identify vulnerable Dahua devices.
This rule detects a high volume of TCP synchronization (SYN) packets from external sources directed at a Cisco IOS XR network device. This behavioral pattern is indicative of a resource exhaustion denial-of-service (DoS) attack, potentially attempting to exploit vulnerabilities such as CVE-2026-20274 by flooding the control plane.
Detects network activity (HTTP, TLS SNI, and DNS) associated with the domain 'noht1ng.top', which is linked to the GRAYRABBIT malware utilized by the threat actor UNC3569.
Detects network activity (HTTP, TLS SNI, and DNS) associated with the domain 'noht1ng.top', which is linked to the GRAYRABBIT malware utilized by the threat actor UNC3569.
Detects network activity (HTTP, TLS SNI, and DNS) associated with the domain 'noht1ng.top', which is linked to the GRAYRABBIT malware utilized by the threat actor UNC3569.
Detects DNS queries originating from an internal host to 'mail.uaiubifas.top', which is associated with GRAYRABBIT command-and-control (C2) activity.
Detects HTTP traffic involving the retrieval of 7z.exe or 7zp.dll payloads from a known Alibaba Cloud staging server associated with the UNC3569 threat actor and the GRAYRABBIT malware. The rule uses a threshold-based detection to identify repeated download attempts from the external IP 8.218.50.207.
Page 77 of 110