Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
743 detections
Filters
Last updated
All Time
Detection languages
319
311
30
25
23
Contributors
208
198
121
84
25
Categories
20,440
11,814
5,871
5,145
4,864
743
Platforms
416
262
181
51
41
Products / Services
328
230
136
84
55
MITRE Techniques
204
124
121
111
109
CVEs
15
10
8
7
7
IDS Classtypes
124
84
26
23
12
IDS Protocols
168
91
30
11
4
Detects incoming HTTP requests to Microsoft Exchange servers that match patterns indicative of exploitation attempts for the ProxyLogon SSRF vulnerability (CVE-2021-26855). This includes detecting specific manipulation of the Autodiscover service and the injection of X-BEResource or X-AnonResource-Backend headers, which were commonly used during the initial access phase of this campaign.
Detects unauthenticated HTTP POST requests targeting the FortiGate administrative API (/api/v2/), which may indicate exploitation attempts related to CVE-2025-25249. The rule specifically looks for requests lacking authentication headers (Cookie or Authorization).
Detects HTTP responses containing content that clones the RTX Corporation homepage, often associated with SilkParasite C2 infrastructure. The rule flags matches based on embedded text in the HTTP body combined with specific nginx server header fingerprints.
Detects network activity related to the exploitation of Dahua P2P relay services via easy4ipcloud.com. The rule monitors for unauthorized device probing, serial number enumeration, and illicit relay authentication attempts (e.g., using DHP2P protocols and X-WSSE authentication), which are indicative of attackers attempting to abuse IoT device remote access functionality (CVE-2025-31702).
Detects high-frequency TCP SYN scanning activity targeting port 37777, commonly associated with the discovery of vulnerable Dahua DVR and NVR devices.
Detects network activity related to Dahua P2P relay services (easy4ipcloud.com) on port 8800. The rules monitor for device lookup queries (/online/p2psrv/), probe requests (/probe/device/), and the presence of WSSE authentication headers, which may indicate interaction with or exploitation attempts by tools targeting P2P-enabled surveillance hardware.
Detects incoming HTTP requests to the WSO2 admin API endpoint that utilize a JSON Web Token (JWT) with the 'alg=none' algorithm, indicating an attempt to bypass authentication via JWT token forgery (CVE-2026-5430).
Detects a malicious command sequence targeting Redis instances where an attacker uses 'CONFIG SET' to modify the 'dir' and 'dbfilename' configuration directives followed by a 'SLAVEOF' or 'REPLICAOF' command. This is a common exploit pattern used to achieve remote code execution by forcing the Redis instance to load a malicious database file (often containing binary webshells or cron jobs) from an attacker-controlled server.
Detects malicious activities associated with the SilkParasite campaign targeting Redis servers. The rules identify the initiation of a 'SLAVEOF' command to a rogue replication host, subsequent handshake (PSYNC/REPLCONF) with an external attacker-controlled node, and the modification of server configuration ('CONFIG SET dbfilename') to potentially facilitate unauthorized file persistence or data exfiltration through the Redis replication mechanism.
Detects malicious activities associated with the SilkParasite campaign targeting Redis servers. The rules identify the initiation of a 'SLAVEOF' command to a rogue replication host, subsequent handshake (PSYNC/REPLCONF) with an external attacker-controlled node, and the modification of server configuration ('CONFIG SET dbfilename') to potentially facilitate unauthorized file persistence or data exfiltration through the Redis replication mechanism.
Detects malicious activities associated with the SilkParasite campaign targeting Redis servers. The rules identify the initiation of a 'SLAVEOF' command to a rogue replication host, subsequent handshake (PSYNC/REPLCONF) with an external attacker-controlled node, and the modification of server configuration ('CONFIG SET dbfilename') to potentially facilitate unauthorized file persistence or data exfiltration through the Redis replication mechanism.
This rule detects activity associated with the exploitation of PaperCut vulnerabilities. It looks for connections to known malicious IP addresses, the presence of specific credential harvesting tools, reconnaissance commands (whoami, tasklist) executed by the PaperCut application (pc-app.exe), suspicious PowerShell downloads of AnyDesk, and unauthorized access to PaperCut configuration files or log files containing known exploit strings.
Detects anomalous network connection attempts using DCOM (port 135) or WinRM (ports 5985/5986) that originate from external networks or exceed established internal baseline frequencies. This pattern is often indicative of lateral movement or remote administration abuse via WMI or WinRM.
Detects suspicious process execution patterns originating from Langflow or Nacos AI orchestration services, including the spawning of sensitive binaries like cmd, powershell, or scripts (python/bash/sh) with suspicious command-line arguments. Additionally, it identifies potential exploitation attempts targeting known-vulnerable API endpoints (code validation and Nacos user authentication).
Detects high-volume authentication attempts against Fortinet network appliances where multiple distinct source IPs successfully authenticate against multiple distinct accounts matching specific administrative naming patterns. This pattern is indicative of potential credential stuffing or brute-force campaigns targeting edge infrastructure.
This rule detects anomalous high-frequency, short-duration bursts of CAPWAP (Control and Provisioning of Wireless Access Points) traffic originating from external sources and targeting internal FortiGate devices. This behavior is indicative of automated exploitation attempts, specifically targeting known heap-grooming activities used in vulnerabilities like CVE-2023-27997, which rely on repetitive 'Add-Station' operations. Legitimate controller traffic is filtered by focusing on internal-to-internal communication patterns.
This rule detects potential command and control (C2) communication related to the GhostContainer malware. It inspects HTTP POST requests directed at Microsoft Outlook Web Access (OWA) paths containing a suspicious 'x-owa-urlpostdata' header. The presence of this specific header, followed by a base64-encoded string of significant length, indicates an attempt to deliver C2 commands or exfiltrate data through OWA infrastructure.
This rule detects potential command and control (C2) communication related to the GhostContainer malware. It inspects HTTP POST requests directed at Microsoft Outlook Web Access (OWA) paths containing a suspicious 'x-owa-urlpostdata' header. The presence of this specific header, followed by a base64-encoded string of significant length, indicates an attempt to deliver C2 commands or exfiltrate data through OWA infrastructure.
Detection rules identifying malformed RDP MCS Connect Initial PDUs and unusual service crashes following RDP connection attempts, both indicative of exploitation attempts against the CVE-2019-0708 (BlueKeep) vulnerability.
Detects incoming HTTP requests to the WSO2 admin API endpoint that utilize a JSON Web Token (JWT) with the 'alg=none' algorithm, indicating an attempt to bypass authentication via JWT token forgery (CVE-2026-5430).
Detects incoming HTTP requests to the WSO2 admin API endpoint that utilize a JSON Web Token (JWT) with the 'alg=none' algorithm, indicating an attempt to bypass authentication via JWT token forgery (CVE-2026-5430).
Page 10 of 36