Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,401
11,795
5,864
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects HTTP traffic involving the retrieval of 7z.exe or 7zp.dll payloads from a known Alibaba Cloud staging server associated with the UNC3569 threat actor and the GRAYRABBIT malware. The rule uses a threshold-based detection to identify repeated download attempts from the external IP 8.218.50.207.
Detects HTTP traffic involving the retrieval of 7z.exe or 7zp.dll payloads from a known Alibaba Cloud staging server associated with the UNC3569 threat actor and the GRAYRABBIT malware. The rule uses a threshold-based detection to identify repeated download attempts from the external IP 8.218.50.207.
Detects attempts to exploit CVE-2023-2825, a path traversal vulnerability in GitLab. The rule monitors HTTP GET requests to the /uploads/ endpoint containing directory traversal sequences (e.g., ../ or encoded variants) in the URI, indicating an effort to access restricted files on the system.
Detects established outbound network connections on TCP port 853 (DNS-over-TLS) to known C2 infrastructure associated with the RedTail malware. The rule monitors for both connection attempts to anomalous resolvers and specific TLS handshake patterns characteristic of RedTail C2 activity.
Detects mass automated POST requests directed at the 'super_submit_form' action within the 'admin-ajax.php' endpoint of the Super Forms WordPress plugin, indicative of exploitation attempts or vulnerability scanning against CVE-2026-14894.
Detects a malicious HTTP POST request targeting the Elementor Pro WordPress plugin's 'elementor_pro_forms_send_form' action. The rule looks for a specific attempt to bypass file upload restrictions by manipulating the array index of form fields to upload a PHP file via the 'admin-ajax.php' endpoint.
This rule detects inbound HTTP requests directed at known file paths associated with malicious PHP web shells commonly dropped within the Elementor plugin directory of WordPress installations, including attempts to pass parameters to the web shell for command execution.
This rule detects network communication associated with the REVSTEALER 'EtherHiding' technique. It monitors for POST requests to Polygon network RPC endpoints containing specific contract interaction signatures ('eth_call' with '0x4965e13f' and a specific contract address), as well as TLS connections to known malicious domains and fallback RPC providers used to resolve C2 instructions from blockchain data.
This rule detects network communication associated with the REVSTEALER 'EtherHiding' technique. It monitors for POST requests to Polygon network RPC endpoints containing specific contract interaction signatures ('eth_call' with '0x4965e13f' and a specific contract address), as well as TLS connections to known malicious domains and fallback RPC providers used to resolve C2 instructions from blockchain data.
This rule detects rapid, repetitive connection attempts (TCP SYN) from a source within the internal network to a set of high-value targets (SSH, HTTP, SMB, RDP ports) within the same internal network. Such patterns are indicative of lateral movement or internal network reconnaissance, often performed by adversaries pivoting through a compromised host to discover services on other internal systems.
Detects network requests originating from the Netch gateway tool or similar environments, attempting to fetch auto-configuration profiles for Shadowsocks from the external domain 'www.sheng886.top' using the '/api/v1/internal/shadowsocks/auto-config' endpoint. The rule specifically matches the Go-http-client user agent, which is common in automated scripts and Go-based proxy tools.
This rule detects HTTP GET requests for static image assets (jpg, jpeg, png, gif, webp, svg) where the Referer header originates from a .shop top-level domain. This behavior may indicate an unauthorized use of brand image assets, often associated with fraudulent e-commerce sites or phishing campaigns using lookalike or disposable infrastructure.
This rule detects HTTP GET requests for static image assets (jpg, jpeg, png, gif, webp, svg) where the Referer header originates from a .shop top-level domain. This behavior may indicate an unauthorized use of brand image assets, often associated with fraudulent e-commerce sites or phishing campaigns using lookalike or disposable infrastructure.
This rule detects HTTP GET requests for static image assets (jpg, jpeg, png, gif, webp, svg) where the Referer header originates from a .shop top-level domain. This behavior may indicate an unauthorized use of brand image assets, often associated with fraudulent e-commerce sites or phishing campaigns using lookalike or disposable infrastructure.
This rule detects high-volume DNS resolution of domains ending in the .shop TLD from internal hosts, which may indicate interaction with a cluster of infrastructure used by the DoppelCart fake-shop campaign.
This rule detects high-volume DNS resolution of domains ending in the .shop TLD from internal hosts, which may indicate interaction with a cluster of infrastructure used by the DoppelCart fake-shop campaign.
Detects high-frequency DNS query responses for domains ending in '.shop' from external sources within a 10-minute window. This behavior is indicative of domain churn often associated with 'DoppelCart'-style fake e-commerce shop infrastructure.
Detects high-frequency DNS query responses for domains ending in '.shop' from external sources within a 10-minute window. This behavior is indicative of domain churn often associated with 'DoppelCart'-style fake e-commerce shop infrastructure.
Detects high-frequency DNS query responses for domains ending in '.shop' from external sources within a 10-minute window. This behavior is indicative of domain churn often associated with 'DoppelCart'-style fake e-commerce shop infrastructure.
Detects high-volume, potentially malicious activity where a client requests a large number of distinct hostnames ending in .shop from a single destination IP address within a short time frame, which may indicate infrastructure used for phishing or fraudulent e-commerce storefronts similar to DoppelCart-style activity.
Detects high-volume, potentially malicious activity where a client requests a large number of distinct hostnames ending in .shop from a single destination IP address within a short time frame, which may indicate infrastructure used for phishing or fraudulent e-commerce storefronts similar to DoppelCart-style activity.
Page 78 of 110