Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
743 detections
Filters
Last updated
All Time
Detection languages
319
311
30
25
23
Contributors
208
198
121
84
25
Categories
20,440
11,814
5,871
5,145
4,864
743
Platforms
416
262
181
51
41
Products / Services
328
230
136
84
55
MITRE Techniques
204
124
121
111
109
CVEs
15
10
8
7
7
IDS Classtypes
124
84
26
23
12
IDS Protocols
168
91
30
11
4
This rule detects a multi-stage process indicative of Server-Side Request Forgery (SSRF) leveraging Bing's Search-by-Image service. Stage 1 captures browsers submitting arbitrary URLs (via the imgurl= parameter) to Bing. Stage 2 detects subsequent inbound requests to an external, attacker-controlled server originating from Bing's infrastructure, suggesting that Bing performed an unauthorized fetch of a resource and delivered it to the attacker, potentially exfiltrating sensitive data.
This rule detects the installation, service configuration, and key management activities associated with the OpenSSH server on both Windows and Linux environments. It monitors for commands related to installing OpenSSH capabilities or packages, starting the sshd service, modifying SSH registry keys on Windows, creating or modifying configuration files (sshd_config), and updating authorized_keys files. It also flags inbound network connections to non-standard or default SSH ports originating from external IP ranges.
Detects anomalous activity consistent with the Velvet Ant 'Operation Highland' methodology, which leverages Nginx/FastCGI to bridge external requests to internal SSH execution. The rule monitors three conditions: 1) HTTP POST requests to internal endpoints containing SSH-related command parameters; 2) suspicious Nginx configuration modifications or reload events; and 3) spawning of SSH processes by FastCGI handlers. Findings are correlated by time and entity to identify potential persistence or lateral movement mechanisms.
Detects unusual network connections or process creation events originating from the 'sharingd' daemon on macOS. 'sharingd' handles various Apple sharing features (AirDrop, Handoff, Shared Clipboard). Unusual child processes or network activity involving this daemon may indicate abuse for unauthorized data transfer, lateral movement, or remote service interaction.
Detects suspicious WinRM SOAPAction headers indicating potential lateral movement or remote command execution (e.g., shell command, process creation, or WMI operations) over WinRM HTTP ports 5985 and 5986.
Detects potential Server-Side Template Injection (SSTI) attacks targeting the Flocci API Gateway using Velocity Template Language (VTL). The rule monitors for malicious VTL patterns in network traffic, subsequent OS command execution, anomalous file creation indicating RCE, and IAM scope bypass patterns in cloud environment logs.
Detects multiple failed SSH authentication attempts against a server from a single source within a short timeframe, which is indicative of a brute force password attack.
Detects when AI agent processes establish listening connections on network ports, indicating potential unauthorized service exposure or lateral movement activity.
Detects network activity and successful administrative logins to Cisco SD-WAN vManage devices originating from IPs associated with threat actor UAT-8616. The rule also flags any successful vmanage-admin logins originating from outside known trusted management network ranges, which may indicate exploitation of CVE-2026-20127 or CVE-2026-20182.
Detects successful SSH authentication to administrative accounts ('vmanage-admin' or 'admin') on Cisco Catalyst SD-WAN Manager (vManage) devices originating from IP addresses associated with the threat actor UAT-8616. This activity relates to exploits targeting CVE-2026-20127 and CVE-2026-20182 for unauthorized access via authentication bypass or certificate abuse.
Detects rapid Socket.IO 'key' event traffic directed at the unauthenticated Remote Mouse service (TCP 1313) followed by the spawning of command shell processes (cmd.exe, powershell.exe) on the same host. This pattern aligns with the Metasploit Remote Mouse RCE module, where an attacker simulates keystrokes to execute arbitrary commands.
Detects the execution of cmd.exe originating from the Remote Mouse or Peyara service process, correlating with an immediately preceding unauthenticated network connection on TCP port 1313. This behavior is indicative of exploitation of a remote service vulnerability, often associated with the Peyara Remote Mouse remote code execution exploit.
This rule detects successful SSH login attempts from external IP addresses (not within common private IP ranges). It specifically looks for 'Accepted' messages in syslog from the 'sshd' process and filters out internal source IPs.
Detects anomalous lateral movement or network pivoting activity originating from an internet-facing Nginx server. The detection identifies an incoming HTTP POST request from an external IP address followed immediately by an outbound network connection from that same Nginx server to an internal RFC1918 host on the FastCGI port (9000). This behavior is consistent with the 'Velvet Ant' operation's technique of abusing proxy_pass configurations to relay traffic into isolated internal network segments via FastCGI request-chaining.
Detects potential exploitation attempts against management interfaces of SOHO network devices (Cisco, Ubiquiti, Draytek) by monitoring for suspicious web request activity, specifically targeting paths like /admin, /cgi-bin, or /setup.cgi. The rule identifies high-volume or systematic scan patterns from external sources, which may indicate automated exploitation attempts (e.g., related to CVE-2026-35616).
Detects high frequency inbound network connection attempts or accepted connections initiated by common file sharing processes (e.g., NearShare.exe, NearbySharing.exe, quickshare.exe, sharingd, airplayd). A high volume of inbound connection attempts may indicate brute force, discovery, or malicious scanning behavior using legitimate file sharing tools as a conduit.
This rule detects network traffic indicative of PsExec lateral movement, specifically identifying the authentication or access to the hidden 'ADMIN$' network share followed by the transfer or execution of the 'PSEXESVC' service binary, a hallmark of the PsExec tool.
Detects attempts to exploit Apache Struts vulnerabilities by identifying OGNL (Object-Graph Navigation Language) expressions (starting with %{ or ${) within the Content-Type HTTP header, combined with requests to .action or .do endpoints.
Detects remote attempts to stop sensitive security, database, and system services using the SMB SVCCTL (Service Control Manager) interface. This is often associated with adversary attempts to disable defensive tools or prepare for destructive operations.
This rule detects potential SSH brute force attacks by identifying high-frequency authentication failures from sshd logs (more than 10 failures in 5 minutes) and rapid, potentially automated connection attempts on port 22 (more than 20 connections in 1 minute) originating from the same source IP on Linux systems.
Detects artifacts and activity related to the exploitation of CVE-2026-55200 in libssh2. The rule monitors for the creation or execution of identified libpwn exploit harness files and scripts, as well as suspicious network activity involving TCP port 2222, which is the default port for the PoC rogue SSH server. It also correlates the appearance of these exploit files with subsequent outbound SSH connections.
Page 20 of 36