Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
743 detections
Filters
Last updated
All Time
Detection languages
319
311
30
25
23
Contributors
208
198
121
84
25
Categories
20,440
11,814
5,871
5,145
4,864
743
Platforms
416
262
181
51
41
Products / Services
328
230
136
84
55
MITRE Techniques
204
124
121
111
109
CVEs
15
10
8
7
7
IDS Classtypes
124
84
26
23
12
IDS Protocols
168
91
30
11
4
Detects potential exploitation attempts targeting the vulnerable Oracle PeopleSoft PSEMHUB Environment Management Hub endpoint (associated with CVE-2026-35273 and UNC6240). The rule identifies suspicious bursts of POST requests where the URI path uses percent-encoding or mixed-case characters to evade Web Application Firewall (WAF) filtering.
This rule detects potential exploitation of CVE-2026-86134, a NULL pointer dereference vulnerability in WatchGuard Fireware. It identifies a burst of authentication-related requests (login, authd, management) targeting a device, followed by system logs indicating a service crash, daemon restart, or core dump within a short correlation window. This behavior is indicative of a Denial of Service attack.
Detects incoming HTTP GET requests containing a specific URI path '/favorite_list_2x_m500_ico.jpg' associated with the Ted Backdoor, commonly used by North Korean state-sponsored threat actors including APT37, Lazarus Group, and Kimsuky for Command and Control (C2) beaconing.
Detects the initialization and persistence of a 'tailcat.exe' process operating from a non-standard, user-profile directory, typically mimicking legitimate tools. The rule monitors for the specific 'forward' command-line argument containing port mapping strings, an immediate loopback connection to that port, and subsequent periodic external network keep-alive traffic originating from the same process or parent lineage, indicating a C2 tunnel setup.
Detects potential SQL injection attempts targeting Cisco AsyncOS Email Gateways via the SMTP DATA command. The rule monitors for malicious patterns, specifically those attempting to execute unauthorized commands or database queries (such as COPY TO PROGRAM or embedded SQL statements) within SMTP traffic.
This rule detects high-frequency API endpoint access originating from a single source IP address within a one-minute window, where the User-Agent does not match common browser strings. This behavior is indicative of automated scanning, scraping, or brute-force enumeration of API resources by non-browser clients.
This rule detects administrative or user activity within Azure via AzureActivity logs and web request patterns in AppServiceHTTPLogs that originate from a predefined list of known malicious IP addresses.
Detects unauthenticated network requests targeting MLflow Model Registry and Ajax API endpoints on port 5000. These requests are characteristic of unauthorized reconnaissance against exposed machine learning management services.
Detects unauthorized attempts to access exposed Chroma or Weaviate vector database APIs via standard HTTP requests (GET/POST) targeting known API endpoints for collections or objects. This may indicate an adversary conducting reconnaissance on publicly accessible database infrastructure.
Detects inbound HTTP POST requests directed at common paths associated with self-hosted OpenAI-compatible LLM inference APIs, such as LocalAI or vLLM. This rule identifies potentially unauthorized or unintended public exposure of internal LLM infrastructure, which could lead to unauthorized model usage, information disclosure, or exploitation of the inference engine.
Detects the creation of suspicious Windows services associated with remote execution tools like PsExec, PAExec, or custom tools that leverage SMB administrative shares (ADMIN$, IPC$). The rule correlates the service creation event (Event ID 7045, 4697) with preceding network connection attempts to SMB shares, and subsequent service termination or state change events within a short timeframe, which is a pattern characteristic of remote lateral movement and command execution.
Detects potential lateral movement and persistence activities by identifying suspicious Windows service installations via event ID 7045. The rule flags services with suspicious names or paths (e.g., Temp folders, Public directory) and correlates them with incoming SMB connections (port 445) or services spawned directly by services.exe from suspicious locations, aggregated by host and remote IP.
Detects potential lateral movement by monitoring for the creation of services associated with PsExec (e.g., PSEXESVC or ADMIN$ share usage), followed by a network connection over SMB (port 445) and the subsequent execution of the corresponding remote process.
Detects high-volume web crawling or reconnaissance activities originating from autonomous AI agent frameworks, such as AutoGPT, BabyAGI, LangChain, or CrewAI. These activities are identified by analyzing User-Agent strings and applying threshold-based rate limiting to identify potential automated reconnaissance patterns.
Detects high-volume SSH authentication failures from a single source IP address within a short time frame, which is indicative of credential spraying or brute force activity.
Detects HTTP traffic patterns associated with the default staging URIs of the PowerShell Empire C2 framework. This rule identifies inbound requests to specific .php files (admin/get, news, login/process) with a 'session=' cookie, which are characteristic of Empire agent beaconing behavior.
Experimental CommonSecurityLog template for sensor-reported attempts associated with Cisco advisory cisco-sa-ise-rce-se7bYU57: CVE-2026-20307, CVE-2026-20176 and CVE-2026-20211. Cisco links Snort SIDs 67114, 67115, 67116 and 67130-67132. Configure exact exporter event IDs, sensor vendor/product and confirmed ISE management IPs. A match does not prove successful exploitation or root compromise.
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
Detects inbound command-and-control traffic to the MOVEit Transfer application targeting the LEMURLOOT web shell, and subsequent detection of gzip-compressed database exfiltration.
This rule detects potential unauthorized account creation by correlating suspicious administrative activity on network edge devices (VPNs, firewalls) with subsequent local administrator account creation on an internal host within a one-hour window. This behavior is indicative of ransomware affiliates exploiting internet-facing infrastructure to gain initial access and escalate privileges.
Detects the initialization and persistence of a 'tailcat.exe' process operating from a non-standard, user-profile directory, typically mimicking legitimate tools. The rule monitors for the specific 'forward' command-line argument containing port mapping strings, an immediate loopback connection to that port, and subsequent periodic external network keep-alive traffic originating from the same process or parent lineage, indicating a C2 tunnel setup.
Page 4 of 36