Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
743 detections
Filters
Last updated
All Time
Detection languages
319
311
30
25
23
Contributors
208
198
121
84
25
Categories
20,440
11,814
5,871
5,145
4,864
743
Platforms
416
262
181
51
41
Products / Services
328
230
136
84
55
MITRE Techniques
204
124
121
111
109
CVEs
15
10
8
7
7
IDS Classtypes
124
84
26
23
12
IDS Protocols
168
91
30
11
4
This rule detects inbound HTTP GET requests to a specific IP address (103.86.86.244) requesting a file named 'deploy.ps1'. This behavior is characteristic of adversaries using PowerShell one-liners (cradles) like 'irm' (Invoke-RestMethod) or 'iex' (Invoke-Expression) to fetch and execute malicious scripts directly from a remote C2 infrastructure.
This rule detects exploitation attempts against CVE-2021-33045 in Dahua devices. It identifies network traffic where a 'global.login' RPC request uses the 'Loopback' login type with a spoofed source IP address of '127.0.0.1' within the request body, while the actual TCP source address of the packet originates from a remote/external location. This technique is used to bypass authentication mechanisms.
Audits Direct Send traffic against an approved-IP watchlist, flagging unauthenticated inbound mail spoofing an internal domain from an unrecognized source IP. Fixed: RecipientDomain/SenderFromDomain were referenced but never defined (would have errored at runtime); replaced with derived SenderDomain/RecipientDomain consistent with the sibling rules. Removed a noisy display-name-contains-domain OR-branch. Replaced an always-true-in-practice auth check (required every one of SPF/DKIM/DMARC to show literal "Pass", which fails for many legitimate senders that pass via alignment on only one protocol) with the same CompAuth/all-three-fail logic used elsewhere in this set.
Detects instances of an mcp-grafana server responding with an HTTP 200 status code to a 'tools/call' request without an Authorization header, indicating potential unauthenticated remote tool execution on a vulnerable or misconfigured server.
Detects inbound emails associated with the Mirage phishing campaign. The detection monitors for known malicious domains in sender information and URL links, as well as specific command-and-control (C2) IP addresses and URL patterns.
This rule monitors for network connections, firewall traffic, and Entra ID authentication events involving known malicious IP addresses (the 'Wall of Shame'). The rule specifically flags interactions occurring over common VPN ports, suggesting potential unauthorized access or persistence attempts via VPN services.
Detects inbound emails associated with the Mirage phishing campaign. The detection monitors for known malicious domains in sender information and URL links, as well as specific command-and-control (C2) IP addresses and URL patterns.
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
This rule detects activity associated with the exploitation of PaperCut vulnerabilities. It looks for connections to known malicious IP addresses, the presence of specific credential harvesting tools, reconnaissance commands (whoami, tasklist) executed by the PaperCut application (pc-app.exe), suspicious PowerShell downloads of AnyDesk, and unauthorized access to PaperCut configuration files or log files containing known exploit strings.
This rule detects activity associated with the exploitation of PaperCut vulnerabilities. It looks for connections to known malicious IP addresses, the presence of specific credential harvesting tools, reconnaissance commands (whoami, tasklist) executed by the PaperCut application (pc-app.exe), suspicious PowerShell downloads of AnyDesk, and unauthorized access to PaperCut configuration files or log files containing known exploit strings.
This rule detects activity associated with the exploitation of PaperCut vulnerabilities. It looks for connections to known malicious IP addresses, the presence of specific credential harvesting tools, reconnaissance commands (whoami, tasklist) executed by the PaperCut application (pc-app.exe), suspicious PowerShell downloads of AnyDesk, and unauthorized access to PaperCut configuration files or log files containing known exploit strings.
This rule detects a high volume of inbound network connection attempts to the default Redis port (6379) originating from local loopback or local host addresses, excluding known legitimate Redis and web server processes. This activity is indicative of potential unauthorized access attempts or exploitation of local Redis instances.
Detects inbound network connections from known IP addresses associated with the StyleSmuggler malware distribution, which is used to inject malicious scripts into web applications.
Detects possible unauthenticated exploitation attempts against CVE-2025-53521 (F5 BIG-IP APM RCE). Tightened from a generic 'any POST without a cookie on 443/8443' match (extremely broad, alerts on ordinary cookie-less API/health-check traffic) to POST requests specifically targeting F5 APM access-policy processing endpoints (/my.policy, /vdesk/) that lack a session cookie, since the CVE requires an access policy configured on the virtual server and legitimate APM sessions carry a session cookie. Added detection_filter (3 hits/60s per source) to suppress single incidental matches and prioritize repeated attempts. Note: public reporting for this CVE does not include the exact exploit URI/payload, so this is a behavioral/namespace heuristic, not a payload-specific signature — validate against your own APM traffic baseline and update once exploit specifics are published.
Detects instances of an mcp-grafana server responding with an HTTP 200 status code to a 'tools/call' request without an Authorization header, indicating potential unauthenticated remote tool execution on a vulnerable or misconfigured server.
Detects specific suspicious processes (identified by hash or path) initiating a listening network connection on non-standard ports typically associated with honeypot captures, specifically referencing Cowrie-related paths or known malicious samples.
This rule monitors for two indicators of potentially self-propagating malware: the creation of autorun.inf files on removable or network-mapped drives combined with active SMB network connections (suggesting worm propagation), and the rapid creation of multiple unique executable files across multiple devices (suggesting an outbreak or worm activity).
Detects inbound network traffic originating from IP addresses known to be associated with an exploit campaign targeting the Super Forms plugin (CVE-2026-14894). The rule acts as an indicator of compromise (IoC) match for potential exploitation attempts directed at internal network infrastructure.
This rule detects exploitation attempts against CVE-2021-33045 in Dahua devices. It identifies network traffic where a 'global.login' RPC request uses the 'Loopback' login type with a spoofed source IP address of '127.0.0.1' within the request body, while the actual TCP source address of the packet originates from a remote/external location. This technique is used to bypass authentication mechanisms.
Detects inbound emails associated with the Mirage phishing campaign. The detection monitors for known malicious domains in sender information and URL links, as well as specific command-and-control (C2) IP addresses and URL patterns.
Detects potential remote code execution (RCE) attempts targeting vulnerable Sub-Store instances (versions < 2.38.2). The detection identifies web browsers making network connections to local ports (38324) associated with Sub-Store, followed by the spawning of shell processes (cmd, powershell, bash, sh) by the Node.js process hosting the application.
Page 16 of 36