Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
743 detections
Filters
Last updated
All Time
Detection languages
319
311
30
25
23
Contributors
208
198
121
84
25
Categories
20,440
11,814
5,871
5,145
4,864
743
Platforms
416
262
181
51
41
Products / Services
328
230
136
84
55
MITRE Techniques
204
124
121
111
109
CVEs
15
10
8
7
7
IDS Classtypes
124
84
26
23
12
IDS Protocols
168
91
30
11
4
Detects unauthenticated POST requests to the TorchServe Management API '/models' endpoint containing a 'url=' parameter. This pattern is indicative of an attempt to perform remote model registration, which could be leveraged for Remote Code Execution (RCE) on the server hosting the TorchServe service.
This rule detects unauthorized and potentially unauthenticated POST requests directed at the completion API endpoints (/api/v1/generate and /run/textgen) of the Oobabooga text-generation-webui, which is commonly used to host Large Language Models (LLMs). Such access, if not secured, could allow an external actor to interact with the model or potentially exploit the underlying infrastructure.
Detects incoming HTTP GET requests to common Jupyter Notebook endpoints ('/tree' or '/api/kernels') that do not include a token in the URI. This behavior is indicative of an adversary attempting to interact with or explore an insecurely configured Jupyter Notebook server that lacks authentication.
Detects a high frequency of SSH connection attempts originating from a single source address within a short timeframe, specifically targeting the initial SSH handshake string. This is indicative of automated brute force or credential stuffing activity against SSH services.
Detects multiple inbound HTTP requests targeting known vulnerable application paths (e.g., cgi-bin, .env files, actuator gateways, path traversal, WordPress plugins, PHP eval files, and various server administration consoles) from a single source within a short timeframe. This behavior is indicative of an automated scanner or exploit chain attempting to identify and compromise public-facing applications.
Detects unauthenticated POST requests directed at the '/v1/completions' endpoint of a vLLM server. This behavior is indicative of potential unauthorized access or exploitation attempts against an exposed LLM inference API that lacks authentication controls.
Detects unauthenticated HTTP POST requests targeting the '/v1/graphql' endpoint of a Weaviate vector database. This pattern is indicative of reconnaissance or exploitation attempts against exposed Weaviate API instances.
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
Detects network exploitation attempts targeting CVE-2026-82329 in JFrog Artifactory. The rule identifies path traversal, malicious Java deserialization payloads, and unauthorized access attempts to sensitive administrative API endpoints.
This rule detects reconnaissance activity targeting Azure App Service instances, specifically looking for attempts to access web-shell-like files, WordPress administration paths, PHP-CGI endpoints, or LangFlow code validation paths. It identifies potential Storm-3168 actor infrastructure through known IOCs or through patterns of high-volume, path-diverse HTTP requests that deviate from typical noise, helping to distinguish targeted probing from common internet background scanning.
This rule detects potential exploitation of CVE-2026-86134, a NULL pointer dereference vulnerability in WatchGuard Fireware. It identifies a burst of authentication-related requests (login, authd, management) targeting a device, followed by system logs indicating a service crash, daemon restart, or core dump within a short correlation window. This behavior is indicative of a Denial of Service attack.
Detects anomalous network traffic patterns characteristic of the PetitPotam exploit, specifically targeting the MS-EFSRPC interface on Windows SMB pipes. This behavior is used to force a remote system to initiate authentication to a specified target, facilitating NTLM relay attacks.
Detects NTLM authentication attempts targeting administrative network shares (ADMIN$ or C$) over the SMB protocol. This behavior is a common indicator of lateral movement techniques such as Pass-the-Hash, where an adversary uses captured NTLM hashes to authenticate to remote systems.
This rule detects inbound network traffic directed at NetScaler ADC or Gateway devices originating from IP addresses flagged as malicious by threat intelligence feeds. It correlates activity logs with active threat intelligence data (categorized as Malware, C2, Exploit, Scanning, or related to known NetScaler/Citrix vulnerabilities) to identify potential reconnaissance or exploitation attempts.
Detects external reconnaissance activity targeting AI backend services. Adversaries scan for known AI infrastructure ports (such as TensorFlow Serving, Triton, or Ray) and common API paths (e.g., /v1/models, /predict) to identify potential targets. The detection utilizes proxy logs to correlate these suspicious network attributes, high request rates, or known scanning user agents.
Detects anomalous authentication behavior originating from a single source IP targeting an SSL VPN gateway. The rule identifies a high volume of unique usernames failing authentication within a short time window, a pattern indicative of password spraying and often associated with initial access attempts on environments lacking multi-factor authentication (MFA), such as those leveraged in Akira ransomware operations.
Detects unauthenticated GET requests to known AI and machine learning infrastructure management endpoints (e.g., DCGM, Ray, Kubeflow) that are commonly exposed without authentication. These interfaces provide operational metrics, cluster status, or job management details, which can be leveraged for reconnaissance.
Detects attempts to access administrative or configuration endpoints on Cisco Identity Services Engine (ISE) without providing valid authentication headers, cookies, or authorization tokens. This behavior is indicative of exploitation attempts targeting CVE-2026-20192 to gain unauthorized administrative access.
Detects the initialization and persistence of a 'tailcat.exe' process operating from a non-standard, user-profile directory, typically mimicking legitimate tools. The rule monitors for the specific 'forward' command-line argument containing port mapping strings, an immediate loopback connection to that port, and subsequent periodic external network keep-alive traffic originating from the same process or parent lineage, indicating a C2 tunnel setup.
Page 5 of 36