Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
743 detections
Filters
Last updated
All Time
Detection languages
319
311
30
25
23
Contributors
208
198
121
84
25
Categories
20,440
11,814
5,871
5,145
4,864
743
Platforms
416
262
181
51
41
Products / Services
328
230
136
84
55
MITRE Techniques
204
124
121
111
109
CVEs
15
10
8
7
7
IDS Classtypes
124
84
26
23
12
IDS Protocols
168
91
30
11
4
This rule detects potential command and control (C2) communication related to the GhostContainer malware. It inspects HTTP POST requests directed at Microsoft Outlook Web Access (OWA) paths containing a suspicious 'x-owa-urlpostdata' header. The presence of this specific header, followed by a base64-encoded string of significant length, indicates an attempt to deliver C2 commands or exfiltrate data through OWA infrastructure.
Detects possible unauthenticated exploitation attempts against CVE-2025-53521 (F5 BIG-IP APM RCE). Tightened from a generic 'any POST without a cookie on 443/8443' match (extremely broad, alerts on ordinary cookie-less API/health-check traffic) to POST requests specifically targeting F5 APM access-policy processing endpoints (/my.policy, /vdesk/) that lack a session cookie, since the CVE requires an access policy configured on the virtual server and legitimate APM sessions carry a session cookie. Added detection_filter (3 hits/60s per source) to suppress single incidental matches and prioritize repeated attempts. Note: public reporting for this CVE does not include the exact exploit URI/payload, so this is a behavioral/namespace heuristic, not a payload-specific signature — validate against your own APM traffic baseline and update once exploit specifics are published.
Detects possible unauthenticated exploitation attempts against CVE-2025-53521 (F5 BIG-IP APM RCE). Tightened from a generic 'any POST without a cookie on 443/8443' match (extremely broad, alerts on ordinary cookie-less API/health-check traffic) to POST requests specifically targeting F5 APM access-policy processing endpoints (/my.policy, /vdesk/) that lack a session cookie, since the CVE requires an access policy configured on the virtual server and legitimate APM sessions carry a session cookie. Added detection_filter (3 hits/60s per source) to suppress single incidental matches and prioritize repeated attempts. Note: public reporting for this CVE does not include the exact exploit URI/payload, so this is a behavioral/namespace heuristic, not a payload-specific signature — validate against your own APM traffic baseline and update once exploit specifics are published.
Detects a suspicious sequence of events on a Linux host: first, the 'iptables' firewall rules are flushed (-F), followed by the creation of an inbound TCP listener on a high port (>1024) and the activation of that port via iptables, finally correlating this with a network listener process residing in temporary or suspicious directories such as /tmp, /var/tmp, or /dev/shm. This behavior is indicative of a potential backdoor installation or temporary listener setup for unauthorized access.
Detects specific suspicious processes (identified by hash or path) initiating a listening network connection on non-standard ports typically associated with honeypot captures, specifically referencing Cowrie-related paths or known malicious samples.
Detects specific suspicious processes (identified by hash or path) initiating a listening network connection on non-standard ports typically associated with honeypot captures, specifically referencing Cowrie-related paths or known malicious samples.
Detects specific suspicious processes (identified by hash or path) initiating a listening network connection on non-standard ports typically associated with honeypot captures, specifically referencing Cowrie-related paths or known malicious samples.
This rule detects activity associated with the exploitation of PaperCut vulnerabilities. It looks for connections to known malicious IP addresses, the presence of specific credential harvesting tools, reconnaissance commands (whoami, tasklist) executed by the PaperCut application (pc-app.exe), suspicious PowerShell downloads of AnyDesk, and unauthorized access to PaperCut configuration files or log files containing known exploit strings.
This rule detects anomalous high-frequency, short-duration bursts of CAPWAP (Control and Provisioning of Wireless Access Points) traffic originating from external sources and targeting internal FortiGate devices. This behavior is indicative of automated exploitation attempts, specifically targeting known heap-grooming activities used in vulnerabilities like CVE-2023-27997, which rely on repetitive 'Add-Station' operations. Legitimate controller traffic is filtered by focusing on internal-to-internal communication patterns.
Detects anomalous network connection attempts using DCOM (port 135) or WinRM (ports 5985/5986) that originate from external networks or exceed established internal baseline frequencies. This pattern is often indicative of lateral movement or remote administration abuse via WMI or WinRM.
Detects anomalous network connection attempts using DCOM (port 135) or WinRM (ports 5985/5986) that originate from external networks or exceed established internal baseline frequencies. This pattern is often indicative of lateral movement or remote administration abuse via WMI or WinRM.
Detects high-frequency, automated requests to product and catalog pages within a short time window, characteristic of web scraping or catalog harvesting often used to feed fake-shop networks or build clone sites.
Detects high-frequency, automated requests to product and catalog pages within a short time window, characteristic of web scraping or catalog harvesting often used to feed fake-shop networks or build clone sites.
Detects high-frequency, automated requests to product and catalog pages within a short time window, characteristic of web scraping or catalog harvesting often used to feed fake-shop networks or build clone sites.
Detects network traffic between internal hosts and a known malicious IP address on port 5556, characteristic of Go_RAT (hVNC) command and control communication. This rule monitors for established TCP connections to identify potential C2 beaconing or active remote management sessions by the GapiUpdate campaign.
Detects network traffic between internal hosts and a known malicious IP address on port 5556, characteristic of Go_RAT (hVNC) command and control communication. This rule monitors for established TCP connections to identify potential C2 beaconing or active remote management sessions by the GapiUpdate campaign.
Detects network traffic between internal hosts and a known malicious IP address on port 5556, characteristic of Go_RAT (hVNC) command and control communication. This rule monitors for established TCP connections to identify potential C2 beaconing or active remote management sessions by the GapiUpdate campaign.
Detects suspicious process execution patterns originating from Langflow or Nacos AI orchestration services, including the spawning of sensitive binaries like cmd, powershell, or scripts (python/bash/sh) with suspicious command-line arguments. Additionally, it identifies potential exploitation attempts targeting known-vulnerable API endpoints (code validation and Nacos user authentication).
Detects suspicious process execution patterns originating from Langflow or Nacos AI orchestration services, including the spawning of sensitive binaries like cmd, powershell, or scripts (python/bash/sh) with suspicious command-line arguments. Additionally, it identifies potential exploitation attempts targeting known-vulnerable API endpoints (code validation and Nacos user authentication).
Detects suspicious process execution patterns originating from Langflow or Nacos AI orchestration services, including the spawning of sensitive binaries like cmd, powershell, or scripts (python/bash/sh) with suspicious command-line arguments. Additionally, it identifies potential exploitation attempts targeting known-vulnerable API endpoints (code validation and Nacos user authentication).
Detects suspicious process execution patterns originating from Langflow or Nacos AI orchestration services, including the spawning of sensitive binaries like cmd, powershell, or scripts (python/bash/sh) with suspicious command-line arguments. Additionally, it identifies potential exploitation attempts targeting known-vulnerable API endpoints (code validation and Nacos user authentication).
Page 14 of 36