Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,158 detections
Filters
Last updated
All Time
Detection languages
2,304
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
2,861
2,017
816
524
213
Products / Services
1,339
1,144
831
576
366
MITRE Techniques
1,825
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects GRE encapsulation used to traverse network boundaries and bypass controls
Detects successful network connections from hosts to specific remote IP ranges (associated with CN infrastructure) on known ports commonly used by ValleyRAT and Gh0st RAT.
Detects outbound network connections to remote URLs containing keywords associated with blockchain, cryptocurrency, or Web3 technologies. This behavior may indicate an adversary utilizing blockchain services or decentralised infrastructure for command and control (C2) communication, exfiltration, or proxying.
Detects multiple failed connection attempts to Azure Database for MySQL, which may indicate a brute force attack. This rule specifically looks for 'Access Denied' errors (error code 1045) or other non-zero error codes during connection attempts within a defined timeframe from the same client IP address.
Detects a custom frp process enabling both reverse proxy and SOCKS5 functionality from an endpoint not approved as a proxy server. This rule specifically looks for process creation events where the executable name matches common frp variants (wormfrp, frpc, ssh) and the command line arguments indicate the setup of a reverse proxy, SOCKS5 tunnel, or related server connection parameters.
This rule detects the updated GammaLoad malware's User-Agent variant. This variant is characterized by replacing double colons with double semicolons in the User-Agent string and appending '/.wsntimidate/.' to it. The detection logic specifically looks for HTTP connection events where the User-Agent matches a regex pattern indicative of this GammaLoad variant.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Detects credential abuse patterns from FortiGate logs including administrative changes, tunneling activity, and anomalous source-IP behavior.
This rule monitors for Generic Routing Encapsulation (GRE) network traffic originating from or destined to non-private (non-RFC1918) IP addresses. GRE is often used for tunneling protocols and can be abused to bypass network security controls or establish hidden command and control communication channels.
Targets anomalous Netlogon or CLDAP traffic followed by LSASS termination or domain-controller restart indicators. The UDM rule retains principal and target context for correlation.
Identifies a backdoored model's payload executing post-deserialization to read developer secrets (SSH keys, AWS credentials, NPM tokens) and exfiltrate them.
Detects access to botnet command and control panels
Detects fast flux DNS used to rapidly change C2 IP addresses
This rule detects indicators associated with the StegoAd malware family, specifically focusing on suspicious browser extension IDs observed in command-line arguments and network-related process activity (ProcessCreate or NetworkConnect). It monitors for known extension identifiers, StegoAd-specific C2 infrastructure domains, and payload frameworks observed in process command lines.
Detects browser processes invoking internal extension schemes and subsequently generating high volumes of network requests to e-commerce or advertising-related domains/URLs, indicating potentially malicious browser extension behavior such as affiliate tag substitution or ad-injection.
Detects DNS calculation technique for resolving C2 server addresses
Detects use of free hosting services for staging malicious content
Detects ransomware C2 communication to known onion domain patterns
Detects bulk GitHub API queries enumerating organization repositories
Detects deployment of phishing landing pages on attacker infrastructure
This rule monitors Cisco SD-WAN environment logs for indicators of unauthorized or suspicious control plane activity, including rogue peering attempts, unexpected NETCONF interactions, certificate mismatches, and unauthorized vBond/vSmart connections. It filters out known local management subnets and utilizes a threat intelligence lookup to identify potentially malicious infrastructure attempting to interface with the SD-WAN fabric.
Page 124 of 246