Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,303 detections
Filters
Last updated
All Time
Detection languages
2,251
22
21
7
2
Contributors
910
584
506
125
48
Categories
20,396
11,792
5,863
5,144
4,864
2,303
Platforms
2,190
209
168
62
61
Products / Services
2,250
2,159
163
32
31
MITRE Techniques
713
422
384
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects DNS queries for domains associated with Kratos Phishing-as-a-Service (PhaaS) hosting infrastructure. This activity is indicative of a user or system attempting to resolve domains used for phishing campaigns or command and control communication.
Detects outbound network traffic containing the string 'Secret: ', which indicates potential sensitive data exfiltration. The rule specifically targets the use of netcat-like behavior directed toward external endpoints, which are commonly associated with tunneling services like ngrok used to bypass network egress restrictions.
Detects established TLS traffic over WebSockets where the certificate subject field lacks a common name (CN), often indicative of non-standard, self-signed, or improperly generated TLS certificates used by command-and-control (C2) agents to bypass standard certificate validation or hide within encrypted channels.
Detects unauthenticated HTTP POST requests targeting the /api/v1/validate/code endpoint in Langflow, which is indicative of an exploitation attempt associated with CVE-2025-3248.
Detects HTTP POST requests directed at a '/save.php' URI, a common signature associated with the Kratos phishing kit used for capturing and exfiltrating user credentials.
Detects HTTP traffic identified as MarkiRAT command and control beaconing, characterized by a specific multipart POST request structure directed at a known malicious URI and domain.
Detects outbound network traffic consistent with CrySome RAT Command and Control (C2) communication, including direct connections to a known hardcoded IP address on port 5555 and the observation of the '##CRYCFG##' configuration marker within the TCP stream.
This rule detects outbound TLS 1.2 traffic communicating over TCP port 99, which is a non-standard port for TLS/HTTPS traffic. This behavior is indicative of potential command-and-control (C2) communication where an adversary is attempting to hide traffic using encryption on an unconventional port.
This Suricata rule detects potential exfiltration of stolen data by the StealC or Amadey malware families. It specifically looks for an HTTP POST request to a .php URI containing a 'PK' header (the magic bytes for a ZIP file), suggesting the transmission of compressed stolen logs to a C2 server.
Detects network activity (DNS queries, HTTP requests, and TLS SNI) associated with the PamStealer malware communicating with its known command and control domain maccyapp.com.
This rule detects attempts to exploit the Nacos CVE-2021-29441 authentication bypass vulnerability. The vulnerability allows an attacker to bypass authentication by leveraging default or forged JWT tokens, specifically targeting the /nacos/ path with an Authorization header containing a Bearer token starting with 'eyJ'.
Detects established TLS connections to external networks where the server certificate subject contains a Common Name (CN) but lacks Organization (O) or Organizational Unit (OU) fields. This pattern is characteristic of basic, potentially malicious self-signed certificates used by command-and-control (C2) frameworks to mask communication.
Detects network traffic associated with Cavern Manticore command-and-control communication. The rule identifies a specific HTTP request pattern characterized by a static User-Agent string resembling a Chrome/Edge browser on Windows and the inclusion of a specific 'X-User-token' header in the HTTP request.
This rule detects HTTP GET requests for specific file paths associated with known malicious lure archives (e.g., YEPlayer.rar, Pis2rayVPN.zip, YEMPlayer.msi). These files are typically used in social engineering campaigns to trick users into downloading and executing malware.
Detects HTTP GET requests to the URI '/beacon' destined for a known JadePuffer command-and-control server IP address (45.131.66.106) on port 4444. This signature identifies potential beaconing activity, which is a common communication pattern for malware implants communicating with an adversary-controlled server.
Detects unauthorized access attempts to MinIO object storage using the default 'minioadmin' credentials. The rule specifically flags attempts to access sensitive files like 'terraform-state' or 'credentials.json' via HTTP GET requests.
Detects outbound network traffic originating from internal assets destined for IP addresses identified as Command and Control (C2) infrastructure associated with the UAT-7810 threat actor group.
This rule detects attempts to exploit an unauthenticated administration API vulnerability (CVE-2026-35616) in FortiClient EMS versions 7.4.5 and 7.4.6, commonly referred to as FortiBleed. This vulnerability could allow an unauthenticated attacker to gain unauthorized access to the administration interface.
Detects incoming HTTP POST requests to the /PSEMHUB/hub endpoint on Oracle PeopleSoft servers, which is indicative of exploitation attempts related to the Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2026-35273.
This rule detects suspicious Google OAuth authorization requests directed at accounts.google.com that utilize a local redirect URI (http://localhost) and are missing mandatory security parameters such as code_challenge, state, and login_hint. These characteristics are often associated with OAuth-based phishing or credential theft campaigns where an adversary attempts to intercept authorization codes.
Detects HTTP GET requests to signindat.com for suspected malicious payloads, including executables (.exe) and scripts (.ps1), as well as a decoy PDF document. The rule identifies communication with an external host using generic User-Agent strings, characteristic of the CrySome RAT multi-stage download process.
Page 88 of 110