Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
This rule detects network connections to known IP addresses associated with the FortiBleed vulnerability exploitation. These IP addresses have been categorized based on their observed roles in FortiBleed attacks, including C2, pentest lab, credential validation, and sniffer nodes. Monitoring these connections can help identify compromised systems communicating with FortiBleed infrastructure.
Detects a specific DNS-over-TCP exploitation sequence used to trigger a Use-After-Free (UAF) vulnerability in the c-ares library. The rule monitors for a series of DNS responses from a resolver containing a FORMERR (RCODE=2) response without an OPT RR, followed immediately by a TCP Reset (RST) packet. This pattern is characteristic of the exploitation attempt against applications utilizing c-ares, such as Node.js, curl, gRPC, Envoy, and Wireshark.
Detects a specific DNS-over-TCP exploitation sequence used to trigger a Use-After-Free (UAF) vulnerability in the c-ares library. The rule monitors for a series of DNS responses from a resolver containing a FORMERR (RCODE=2) response without an OPT RR, followed immediately by a TCP Reset (RST) packet. This pattern is characteristic of the exploitation attempt against applications utilizing c-ares, such as Node.js, curl, gRPC, Envoy, and Wireshark.
This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.
This rule detects a high volume of access attempts to the IPC$ administrative share from a single source IP address within a one-hour window. This behavior can be indicative of reconnaissance, lateral movement, or other malicious activities using SMB/Windows Admin Shares.
This rule detects network connections to known IP addresses associated with FortiBleed activity, categorizing them by their suspected role (e.g., C2, pentest lab, credential validation, sniffer node). It monitors both successful connections and connection attempts.
Detects HTTP traffic patterns associated with LokiBot malware beaconing to a hardcoded command and control (C2) endpoint. The rule specifically looks for established network connections to identified malicious domains or IP addresses using the /fre.php URI path.
Detects HTTP POST requests directed at PHP script endpoints with randomized 16-32 character hexadecimal filenames, which is a known C2 communication pattern used by the StealC infostealer.
This rule detects network activity associated with the StealC information stealer, specifically focusing on HTTP POST requests made to known command-and-control (C2) domains. It identifies characteristic URL patterns, such as randomly generated 16-character PHP files or specific index.php structures, which are used for bot registration and communication. The detection includes patterns indicative of RC4-encrypted payloads and behavior mimicking Amadey bot status checks.
Detects FTP protocol traffic (on port 21) initiated by a process named 'squid.exe' or containing 'squid' in its filename. This rule is designed to identify potential exploitation attempts related to the Squidbleed vulnerability, where a compromised Squid proxy might be used for unauthorized FTP communications.
This rule detects a high frequency of successful network connections from a single device to multiple unique destination IP addresses within a one-hour window. The targeted ports (445, 139, 3389, 22, 21) are commonly used for remote administrative access, file transfers, and remote shell services, which are frequently leveraged by adversaries for lateral movement. The threshold of 3 unique targets in an hour may indicate automated scanning or credential brute-forcing activity across the network.
Detects the use of the Windows 'finger' utility, often renamed to 'ct.exe', to download and pipe remote commands to cmd.exe. This is a key LoLBin technique used in the CrashFix campaign.
Detects the use of curl.exe to upload files to the temp.sh service while simultaneously passing the resulting temp.sh URL within the User-Agent string to a C2 server. This specific exfiltration and beaconing TTP was observed in the Notepad++ supply chain attack.
Identifies a local device repeatedly attempting to access default router gateway IPs (192.168.1.1, 192.168.0.1, 10.0.0.1) on common web ports (80, 443) to brute-force admin passwords. The rule triggers if more than 20 attempts are observed within a one-minute window from a single device to a specific remote IP.
Detects a device attempting to resolve a legitimate Microsoft/Banking domain, but receiving a non-standard/malicious IP indicative of router-level DNS hijacking.
This rule detects two distinct but related network-based adversary-in-the-middle (AiTM) techniques. The first part identifies ARP spoofing by looking for the same IP address being claimed by multiple MAC addresses within a short time frame, which can indicate an attacker is attempting to intercept local network traffic. The second part detects TLS certificate pinning failures, which can occur when an attacker attempts to perform a man-in-the-middle attack by presenting an untrusted or modified TLS certificate to a client that expects a specific certificate (pinning). This is often indicative of an attempt to intercept or decrypt encrypted network communications.
Detects repeated restarts of vLLM pods (due to OOMKilled, CrashLoopBackOff, or other failure reasons) that are correlated with a burst of multimodal requests. This pattern can indicate a denial-of-service attack, resource exhaustion, or exploitation of vulnerabilities (such as CVE-2026-22778) targeting the vLLM service, potentially leading to service instability or compromise.
Detects network activity and DNS resolutions related to the tonapi.io domain initiated by unexpected processes. This pattern is indicative of the TONResolver RAT, which abuses TON smart contracts as a mechanism for command and control (C2).
Correlates a successful Fortinet SSL VPN session with nltest, net, Get-AD*, AdFind, ldapsearch, WinRS, or WMIC discovery commands for the same account within forty-five minutes. This behavior can indicate an attacker establishing initial access via VPN and then performing internal reconnaissance.
Detects network traffic using the Generic Routing Encapsulation (GRE) protocol originating from or destined to external (non-private) IP addresses. GRE is often used for tunneling and can be abused to bypass network security controls.
Detects anomalous network traffic patterns indicative of two distinct techniques: P2P injection into Microsoft 365 Copilot search queries and Server-Side Request Forgery (SSRF) leveraging Bing's image search functionality for data exfiltration.
Page 108 of 246