Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,401
11,795
5,864
5,145
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects network communication to Firebase infrastructure (.firebaseio.com) initiated by Android devices, which may indicate command-and-control (C2) activity associated with the Mantax Otax malware family. This rule tracks initial connections and should be correlated with specific suspicious domains for higher confidence.
Detects network communication to Firebase infrastructure (.firebaseio.com) initiated by Android devices, which may indicate command-and-control (C2) activity associated with the Mantax Otax malware family. This rule tracks initial connections and should be correlated with specific suspicious domains for higher confidence.
Detects high-frequency, repeated access to a specific fraud-tracking or canary token link by sources utilizing rotating VPNs or proxies over an extended period. This behavior is indicative of automated probing or credential validation attempts associated with the Phantom Deal campaign.
This rule detects network traffic indicative of the PEEP Browser RAT, specifically HTTP beacons targeting the URI path '/api/commands'. It monitors for unique HTTP headers ('X-PEEP-Agent-Id', 'X-PEEP-Agent-Key') and connections to known malicious infrastructure.
Detects Server-Side Request Forgery (SSRF) attempts against Grafana instances using the 'X-Grafana-URL' header. The rule identifies requests attempting to access internal network ranges, link-local addresses, or cloud metadata endpoints (e.g., 169.254.169.254, localhost) via the Grafana MCP interface, particularly when non-GET HTTP methods are used to potentially mutate internal resources.
Detects unauthenticated attempts to invoke Grafana API tools via the Model Context Protocol (MCP) by utilizing spoofed Mcp-Session-Id headers while bypassing bearer token authentication requirements. This primarily targets unauthorized access to API functionality on Grafana instances configured with bearer-token authentication (v1.1.0+).
Detects anomalous use of the 'X-Grafana-URL' header in conjunction with an 'Authorization: Bearer' token, indicative of an attempt to exfiltrate a service account token to an unauthorized or external domain, exploiting CVE-2026-15583.
This rule detects outbound network connections from internal hosts to specific IP addresses associated with known AlexHost infrastructure identified as command-and-control (C2) servers for the Bandook Remote Access Trojan (RAT), which is utilized by the threat actor Dark Caracal.
Detects HTTP 301 redirection responses from a hardcoded IP address to an external domain associated with ProRAM command-and-control infrastructure.
Detects network activity associated with the ProRAM C2 infrastructure. The rule monitors for DNS resolutions, TLS SNI field matches, and specific HTTP WebSocket upgrade patterns directed towards the 'clash-verge-upgrade.com' domain.
This rule detects attempted exploitation of Adobe Commerce (Magento) via GraphQL, specifically targeting Template Property Poisoning through malicious 'styles' array injection as observed in the StyleSmuggler campaign (CVE-2025-54236).
Detects suspicious GET requests to the Magento '/customer/section/load/' endpoint with specific parameters ('sections=customer' and 'force_new_section_timestamp=true'). These requests are indicative of reconnaissance activity related to the StyleSmuggler campaign, potentially associated with exploitation of Magento vulnerabilities such as CVE-2025-54236.
Detects DNS queries for known typosquatted time-sync domains and associated UDP traffic on port 123 (NTP) utilized by the StyleSmuggler malware for command and control purposes.
Detects malicious traffic directed towards unpkg.com associated with the 'Beamglea' campaign. The rule specifically monitors for connections to known malicious npm-mirrored packages or pages serving fake Cloudflare CAPTCHA challenges, which are common tactics for credential theft and browser-based exploitation.
Detects network activity related to the Beamglea/ClickFix framework using api.keyval.org as a dead-drop resolver. The rule monitors for DNS resolutions, TLS SNI requests, and HTTP GET/PUT requests to the identified C2 infrastructure, which is used for retrieving and storing obfuscated redirect values.
This rule detects potentially malicious network activity involving Dahua PTCP protocol packets that specifically request a loopback bind (127.0.0.1) using an inverted-STUN style mechanism. This behavior is indicative of an adversary attempting to bypass network segmentation or perform local service proxying/tunneling to maintain command and control or enable unauthorized access to internal services on the target device.
Detects outbound network traffic from internal hosts to the HiveMQ public broker using the MQTT protocol over TLS, a behavior associated with the Toy Ghouls mqtt-bird-agent C2 infrastructure.
Detects outbound HTTP traffic originating from a WordPress host containing specific signatures associated with the Mushr00w Uploader webshell, indicating command-and-control communication or data exfiltration.
Detects network traffic associated with the GemStone malicious browser extension, including initial registration to a command-and-control (C2) server on Cloudflare Workers, periodic heartbeat beacons, command polling, and external public IP address lookups for victim identification.
Detects HTTP GET requests for executable or installer files (e.g., .exe, .msi) containing 'tradingview' in the URI, originating from suspicious external domains that are not associated with legitimate software providers such as TradingView, GitHub, SourceForge, Apple, Google, or Microsoft. This activity is indicative of JSCeal malvertising campaigns targeting users with fraudulent installers.
Detects HTTP GET requests for executable or installer files (e.g., .exe, .msi) containing 'tradingview' in the URI, originating from suspicious external domains that are not associated with legitimate software providers such as TradingView, GitHub, SourceForge, Apple, Google, or Microsoft. This activity is indicative of JSCeal malvertising campaigns targeting users with fraudulent installers.
Page 79 of 110