Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule monitors DNS queries and network connections for access to a set of known domain names associated with Adversary-in-the-Middle (AiTM) phishing infrastructure. It correlates data from DNS events, device network logs, and virtual machine network connections to identify potential interactions with malicious phishing sites typically used to capture user credentials or session tokens.
Detects HTTP flood application layer DDoS attacks
Detects use of export-grade cipher suites to reduce key strength
Detects use of Google search operators for target site reconnaissance
Detects network traffic duplication using GRE for covert exfiltration
Detects fake CAPTCHA pages that trick users into pasting malicious commands
Detects creation of Kubernetes role bindings for elevated cluster access
Detects upload of potentially malicious VIB packages to ESXi hosts
Detects TFTP-based pre-boot file transfers for bootkit or firmware persistence
Detects remote enumeration of Windows services via SMB
Detects the initial ClickFix mechanism where a user is socially engineered into pasting a malicious script (Get-Clipboard) into the Run dialog (explorer.exe), which launches PowerShell to fetch the CastleLoader.
Detects script content that invokes 'mshta.exe' from the 'SysWOW64' directory to access a remote resource ending with '.7z' via HTTP or HTTPS. This pattern is associated with the Animateclipper malware, which uses MSHTA for initial access or execution of malicious scripts.
This rule detects the creation of image files (bmp, png, jpg, jpeg) within temporary or application data directories, while simultaneously monitoring for network connections to known command-and-control (C2) infrastructure (IP 223.26.63.40 or port 2671). The rule calculates a risk score based on the correlation of these events within a 30-second window, excluding common benign screenshot utility processes.
Detects browser/node subprocesses spawned by AutoGen/Python processes making loopback WebSocket connections to the AutoGen Studio MCP control plane, which is indicative of the AutoJack exploit chain. This rule specifically looks for Python processes associated with 'autogen' or 'autogenstudio' that initiate network connections to loopback addresses on ports 8080 or 8081, often with specific URL paths related to the MCP WebSocket API.
Malvertising loader delivering CastleStealer via malicious Google Ads
IoT botnet malware family used for DDoS and proxy infrastructure
Photo-themed ZIP phishing campaign dropping a Node.js implant
Lightweight remote access trojan deployed in recruiter-themed social engineering
Lumma C2Beacon
YARA
Infostealer-as-a-service targeting browser credentials and crypto wallets
Cloud extortion group exploiting exposed credentials and storage
Detects unexpected child processes (e.g., shell, Python, network utilities) spawned from vLLM or Python worker processes, or suspicious file/network activity related to vLLM/Python processes. This rule aims to identify potential exploitation of CVE-2026-22778, an FFmpeg JPEG2000 heap overflow vulnerability, which could lead to arbitrary code execution within AI/ML environments.
Page 104 of 246