Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
743 detections
Filters
Last updated
All Time
Detection languages
319
311
30
25
23
Contributors
208
198
121
84
25
Categories
20,440
11,814
5,871
5,145
4,864
743
Platforms
416
262
181
51
41
Products / Services
328
230
136
84
55
MITRE Techniques
204
124
121
111
109
CVEs
15
10
8
7
7
IDS Classtypes
124
84
26
23
12
IDS Protocols
168
91
30
11
4
Detects incoming network traffic from external IP addresses to common AI agent and model gateway ports (e.g., Ollama, vLLM, ClawdBot). This could indicate an exposed, unauthenticated service vulnerable to hijacking, potentially leading to unauthorized access or data exfiltration.
Detects inbound network connections from external (non-loopback, non-private) IP addresses to ports commonly used by Clawdbot/Moltbot gateways (3000, 8080, 16007). An exposed gateway is a significant security risk that can allow unauthorized remote administrative control over the AI agent.
Detects network traffic to or from known IP addresses associated with TA584 command and control (C2) servers and hosting infrastructure. This actor is a known initial access broker, and infections can lead to ransomware.
Detects incoming network traffic from external IP addresses to common AI agent and model gateway ports (e.g., Ollama, vLLM, ClawdBot). This could indicate an exposed, unauthenticated service vulnerable to hijacking, potentially leading to unauthorized access or data exfiltration.
This rule detects inbound network connections to internet-facing devices on ports other than 80 (HTTP) or 443 (HTTPS). This could indicate an adversary attempting to establish command and control, exfiltrate data, or exploit services running on non-standard ports.
This rule detects an attempt to exploit an XML External Entity (XXE) vulnerability in GeoServer's Web Map Service (WMS) GetMap function. The detection logic looks for HTTP POST requests to the '/wms?' endpoint containing 'request=GetMap' in the URI, and specific XML elements like '<StyledLayerDescriptor>', '<!DOCTYPE', '<!ENTITY', and 'SYSTEM' within the request body, along with a URL-like pattern '://' indicating an attempt to fetch external content.
This query identifies devices that have accepted inbound web traffic (ports 80/443) where the accepting process is IIS worker (w3wp.exe) or IIS Express (iisexpress.exe). It focuses on public IPv4 sources (excluding RFC1918/private, loopback, and IPv6), helping you surface internet-exposed web servers that are actively receiving external connections.
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
Detects potential WARP PANDA Junction implant activity by identifying processes, other than the legitimate 'vvold' service, listening on TCP port 8090. The Junction implant uses this port to masquerade and receive commands.
This rule detects inbound HTTP requests containing the User-Agent string 'Salesforce-CLI/1.0'. This activity is considered suspicious as it may indicate reconnaissance or data theft attempts targeting Salesforce instances, potentially leveraging compromised credentials or systems. The presence of this specific User-Agent inbound to a network could be an indicator of malicious activity, as Salesforce CLI is typically used by developers and administrators for managing Salesforce organizations and is not expected to be seen in inbound traffic from external networks to internal systems.
This rule detects inbound network traffic attempting to exploit a path traversal vulnerability (CVE-2025-8088) related to RAR files and Alternate Data Streams (ADS). The detection logic specifically looks for a pattern indicative of path traversal attempts within the RAR file structure over raw TCP connections, excluding HTTP traffic. This exploit could allow an attacker to write files to arbitrary locations on a compromised system.
This rule detects inbound network traffic attempting to exploit an open redirect vulnerability within the Google APIs 'AddItNow' service. Specifically, it looks for requests to 'apis.google.com/additnow/l?__lu=' which could be used to redirect users to arbitrary malicious websites.
ET ATTACK_RESPONSE Unknown Payload Downloader Inbound
This rule detects inbound network traffic associated with the Braodo Loader malware. It specifically looks for a unique byte sequence and a specific string within the HTTP response body, indicating the download or communication related to this loader.
ET ATTACK_RESPONSE Koi Loader/Stealer CnC Config Inbound
Detects potential exploitation of Motex LANSCOPE Endpoint Manager (CVE-2025-61932). This rule identifies when a process listening on TCP port 443 receives an inbound connection and subsequently spawns a suspicious child process (like cmd.exe or powershell.exe), a behavior consistent with exploiting a remote service vulnerability.
This rule detects connection attempts to the SSH service running on an OpenCanary honeypot node. OpenCanary is a honeypot designed to attract and detect unauthorized access attempts. A connection attempt to an SSH service on an OpenCanary instance indicates potential reconnaissance or attack activity against the honeypot, which should be investigated as it suggests an adversary is probing for vulnerable services.
This rule identifies successful user sign-ins originating from IP addresses known to belong to VPN services. It leverages an external list of VPN IP ranges to correlate with Azure AD SigninLogs. This can indicate an attempt to bypass geo-restrictions, hide true origin, or could be legitimate use of a VPN by an employee.
This rule detects VPN connections originating from countries that are not the user's usual work country. It leverages VPN logs, specifically Zscaler VPN logs, to identify active connections and compares the source IP's country with a lookup of the user's expected work country. Alerts are generated when a mismatch is found, indicating a potentially unauthorized or suspicious access attempt.
KQL Query from file: Endpoint SMB Exposed on Public Internet
New KSMBD DoS (CVE-2025-38501) can exhaust SMB connections via half-open TCP handshakes — patch to Linux 6.1.15+ or rate-limit TCP/445 to mitigate.
This KQL query helps to hunt for connection attempts to port 445 across Linux endpoints in Defender XDR:
This KQL query helps to hunt for connection attempts to port 445 across Linux endpoints in Defender XDR:
Page 33 of 36