Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
5,155 detections
Filters
Last updated
All Time
Detection languages
2,301
1,070
640
289
288
Contributors
918
814
769
696
224
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
2,858
2,017
816
524
213
Products / Services
1,336
1,144
831
576
366
MITRE Techniques
1,822
1,307
787
747
577
CVEs
9
7
7
6
6
IDS Classtypes
538
151
101
57
48
IDS Protocols
375
373
132
64
42
Detects high-frequency, sustained queries to an ML inference endpoint from a single identity, indicative of gradient-free training data reconstruction or model inversion attacks. The rule triggers when a specific user or API key performs over 100 successful requests within a 15-minute window, where the responses include granular confidence, probability, or logit values, which are typical targets for reconstructing training data.
Detects potential Denial of Service (DoS) against AI/LLM inference endpoints. It monitors for high-frequency request spikes or abnormally large request payloads (oversized context windows) directed at common model endpoints that could lead to disproportionate compute resource consumption.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects high-frequency, automated API requests to commercial Large Language Model (LLM) endpoints from a single source IP. The rule identifies suspicious activity characterized by a rapid rotation of multiple API tokens, often indicative of an intermediary proxy or middleware service attempting to bypass provider-specific usage limits, billing controls, or safety guardrails.
This rule detects potential supply chain compromise by monitoring for the installation of pip or npm packages with names similar to popular AI/LLM frameworks (e.g., langchain, llamaindex, mastra, litellm). It then correlates these installations with subsequent suspicious activity, including potential beaconing to external IPs, execution of known crypto-miners, or access to sensitive local files (e.g., AWS credentials, SSH keys).
Detects high-volume, systematic querying of LLM inference endpoints, which may indicate unauthorized model extraction, distillation attempts, or targeted data exfiltration from an LLM.
This rule detects potential prompt injection attacks against internal AI-powered assistants, agents, or LLM gateways. It monitors network HTTP requests for common patterns used to override system instructions, bypass safety filters, or force the model to adopt a privileged, unauthorized persona (e.g., administrator or debug mode). These techniques are often used in social engineering to manipulate the AI's output or security posture.
Detects high-volume, systematic querying of LLM inference endpoints, which may indicate unauthorized model extraction, distillation attempts, or targeted data exfiltration from an LLM.
Detects HTTP requests to popular LLM API services (OpenAI, Anthropic, Google, Cohere) containing common jailbreak or role-play patterns. These patterns attempt to bypass safety guardrails by using techniques such as persona-switching (e.g., 'DAN'), hypothetical scenario framing, or unauthorized security testing pretexts.
Detects indicators associated with the exploitation of CVE-2025-3248 in Langflow. The rule identifies anomalous web requests targeting the /api/v1/validate/code endpoint, subsequent suspicious process creation (base64 encoded payloads in Python/shell), and network communication with identified command and control (C2) or data exfiltration IP addresses. It also includes alerts for observed contact with known extortion email addresses.
Detects outbound network connections from internal devices to a set of known malicious IP addresses (45.151.45.31 and 46.166.79.31) which may indicate command and control communication or other malicious activity.
Sweeps Defender Advanced Hunting telemetry for known Sauron Loader indicators: 5 malicious SHA256 hashes (MSI installer, rnp.dll loader, tdwp.dll decrypter, embedded RSA private/public key blobs) across file/process/image-load events, plus 4 C2 domains and their full URLs across network and DNS telemetry. No IP indicators were published in the source reporting (C2 is domain-based over HTTPS) — the IP bucket is intentionally omitted rather than filled with placeholder data.
Detects Sauron Loader C2 registration/polling: an HTTPS POST whose URI path matches the malware's exact <prefix>/v<1-9>/<action><Resource> structure (action = set|get; resource = one of the 10 known config/task resource names) combined with the malware's hardcoded Windows-10 Edge/Chrome 143 user agent. Narrowing the URI regex from a generic '/api/v1/anything' wildcard to the exact action+resource vocabulary eliminates matches against ordinary versioned REST API traffic, which was the dominant false-positive source.
Detects Sauron Loader C2 registration/polling: an HTTPS POST whose URI path matches the malware's exact <prefix>/v<1-9>/<action><Resource> structure (action = set|get; resource = one of the 10 known config/task resource names) combined with the malware's hardcoded Windows-10 Edge/Chrome 143 user agent. Narrowing the URI regex from a generic '/api/v1/anything' wildcard to the exact action+resource vocabulary eliminates matches against ordinary versioned REST API traffic, which was the dominant false-positive source.
Detects Sauron Loader C2 registration/polling: an HTTPS POST whose URI path matches the malware's exact <prefix>/v<1-9>/<action><Resource> structure (action = set|get; resource = one of the 10 known config/task resource names) combined with the malware's hardcoded Windows-10 Edge/Chrome 143 user agent. Narrowing the URI regex from a generic '/api/v1/anything' wildcard to the exact action+resource vocabulary eliminates matches against ordinary versioned REST API traffic, which was the dominant false-positive source.
Detects Sauron Loader C2 registration/polling: an HTTPS POST whose URI path matches the malware's exact <prefix>/v<1-9>/<action><Resource> structure (action = set|get; resource = one of the 10 known config/task resource names) combined with the malware's hardcoded Windows-10 Edge/Chrome 143 user agent. Narrowing the URI regex from a generic '/api/v1/anything' wildcard to the exact action+resource vocabulary eliminates matches against ordinary versioned REST API traffic, which was the dominant false-positive source.
Detects execution and network activity related to the PamStealer / Wavel malware campaign, including the JXA dropper and associated C2 infrastructure. The rule monitors for known malicious file hashes (e.g., JXA dropper, pkgunpack utility) and network connections to identified lure, distribution, and C2 domains and URLs used by the campaign.
Detects execution and network activity related to the PamStealer / Wavel malware campaign, including the JXA dropper and associated C2 infrastructure. The rule monitors for known malicious file hashes (e.g., JXA dropper, pkgunpack utility) and network connections to identified lure, distribution, and C2 domains and URLs used by the campaign.
This rule monitors endpoint network events, file events, and process executions for indicators associated with the Kamasers malware. It specifically looks for connections to known malicious C2 IP addresses and domains, as well as the presence or execution of files matching known malicious SHA256 hashes.
Detects network traffic associated with the SloppyRAT backdoor, which utilizes a reverse SOCKS proxy mechanism. The rule identifies specific HTTP GET/POST heartbeats and command responses to the '/api/poll' and '/api/proxy/ack' endpoints commonly used for C2 operations.
Page 47 of 246