Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
452 detections
Filters
Last updated
All Time
Detection languages
251
100
69
13
8
Contributors
113
74
46
46
44
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
302
94
46
43
29
Products / Services
317
231
88
54
28
MITRE Techniques
171
167
100
60
59
CVEs
4
3
2
2
2
IDS Classtypes
5
3
3
1
1
IDS Protocols
7
6
This rule detects potential brute-force or credential stuffing attempts against web application authentication endpoints by monitoring patterns of success and failure. It aggregates requests over 5-minute intervals, calculating a risk score based on high volumes of authentication failures relative to successful requests from individual source IPs targeting sensitive API paths (e.g., auth, session, login, token).
This rule identifies potential Command and Control (C2) beaconing activity by detecting recurring, consistent HTTP(S) requests from internal hosts to unknown or newly seen external destinations, characterized by stable time intervals and low variance in response sizes. The detection logic filters out common User-Agents, indicating non-browser or automated traffic often associated with malware communication.
Detects outbound proxy traffic originating from identified AI and automation agent user-agents (e.g., ChatGPT, Perplexity, Claude, etc.) attempting to access sensitive URI paths, such as credential files, SSH keys, configuration files, or cloud-hosted secrets. This may indicate an attempt to exfiltrate sensitive data to or through AI platforms.
This rule monitors network logs (from proxies and firewalls) for web traffic (HTTP GET requests) containing suspicious JavaScript code injection patterns in the request context or message fields. It specifically looks for common XSS indicators such as <script tags, eval(), document.write(), fromCharCode(), and atob().
Detects outbound proxy requests to the Bing Search-by-Image endpoint where the imgurl parameter is used to perform a server-side request forgery (SSRF). Attackers use this to bypass security controls by forcing Microsoft services to fetch an external, malicious URL containing exfiltrated data within the path, as seen in the SearchLeak (CVE-2026-42824) exploit chain.
Detects outbound requests to the Bing 'searchbyimage' endpoint where the 'imgurl' parameter points to an external (non-trusted) domain. This pattern is indicative of potential SSRF exploitation, such as the described SearchLeak (CVE-2026-42824) vulnerability chain, where an attacker uses Bing's search functionality as a proxy to reach internal or restricted infrastructure.
Detects malicious HTTP/1.1 Upgrade requests directed at nghttpx that include a Content-Length body. This combination is characteristic of a request smuggling attack, where an attacker injects a smuggled request into the backend connection. By poisoning the backend queue, the attacker can cause the nghttpx proxy to forward sensitive or malicious responses to victim clients sharing the same connection.
Detects network proxy activity associated with the 'Polymarket Trap' supply chain attack, where developers are lured into cloning a fake arbitrage bot repository or fetching malicious npm packages from the wshu.net domain. The rule monitors for access to known malicious repositories (Trum3it/polymarket-arbitrage-bot) and malicious dependencies (clob-client-math).
Detects web proxy traffic containing links to lookalike recruitment portals using specific typosquatting suffixes (e.g., .com.de) and URL paths (/careers/auth). These patterns are linked to UNC1549, an adversary identified as targeting aerospace and defense organizations with fake React-based recruitment lures.
This rule detects exploitation attempts against Microsoft 365 Copilot (CVE-2026-42824) where attackers inject HTML or malicious prompt sequences into the 'q' query parameter. These payloads aim to perform prompt injection, SSRF via Bing, and cross-site scripting to exfiltrate sensitive data such as mailbox content and MFA tokens.
Detects network requests to a typosquatted domain 'perplexity-ai.online' initiated by a malicious browser extension. The extension uses the 'suggest_url' feature to exfiltrate keystrokes typed into the browser omnibox in real-time, effectively performing browser-based keylogging.
Detects high-frequency authentication failure events targeting the Microsoft Remote Desktop Web (RDWeb) access login page, indicating a potential brute force or password spraying attack against remote access services.
Detects bulk file downloads of executable or script content from web proxies using automated or headless client agents (e.g., curl, wget) where no browser-like Referer is present. The rule aggregates these downloads within a 10-minute window and correlates them with endpoint Sysmon file creation events in non-standard directories, indicating potential tool staging or malware delivery.
Detects malicious browser extensions associated with the StegoAd campaign fetching steganographic payloads (WebP/PNG) from known C2 infrastructure. The detection identifies requests originating from a browser extension context (via Referer header) that target specific image files commonly used by the malware for post-compromise staging and execution guardrail fingerprinting.
Detects anomalous bulk GET requests directed at Cisco SD-WAN (vManage) REST API endpoints, specifically targeting topology information, device lists, and configuration templates. This pattern of activity is indicative of reconnaissance or exfiltration attempts against the SD-WAN fabric management interface.
This rule monitors for two types of anomalous network behavior: first, it identifies connections to known domains from IP addresses not previously associated with those domains over a seven-day lookback period. Second, it identifies HTTP proxy responses (from Zscaler or Squid) where the content-length significantly deviates from the historical baseline for specific URLs. These patterns are potential indicators of C2 channel shifts or data exfiltration via web protocols.
This rule detects potential data exfiltration through the Bing Image Search 'search-by-image' feature. It identifies web traffic to Bing that contains an 'imgurl' parameter, decodes the URL, and filters out legitimate Microsoft-related domains. It then flags suspicious, potentially encoded file paths or data structures that might indicate the use of this public service to exfiltrate or host staging data.
This rule detects potential Server-Side Request Forgery (SSRF) exploitation where Bing's 'search by image' functionality is abused to fetch external, non-Microsoft controlled URLs. The query monitors web proxy logs for specific Bing search parameters ('cbir=sbi' and 'imgurl') and filters out requests to trusted domains, effectively identifying attempts to use the search engine as an intermediary for unauthorized external web requests. The rule further correlates these hits with Microsoft Copilot interaction logs to identify if the activity is associated with authenticated Copilot user sessions.
This rule monitors network logs (from proxies and firewalls) for web traffic (HTTP GET requests) containing suspicious JavaScript code injection patterns in the request context or message fields. It specifically looks for common XSS indicators such as <script tags, eval(), document.write(), fromCharCode(), and atob().
Detects exploitation attempts against Gitea instances where an attacker impersonates an admin user by injecting the 'X-WEBAUTH-USER' header. This vulnerability typically occurs when 'REVERSE_PROXY_TRUSTED_PROXIES' is misconfigured to trust all proxies ('*'), allowing unauthenticated users to gain administrative access via header manipulation. The rule covers web request headers, container logs for suspicious admin creation, and process execution arguments associated with the exploitation.
Detects suspicious interactions with Google Cloud Pub/Sub APIs occurring shortly after an OAuth2 token request, specifically when the activity is performed by processes other than standard Google Cloud SDK tools (gcloud, gsutil, etc.). This behavior may indicate an attempt to utilize stolen OAuth tokens to exfiltrate or manipulate data within a GCP environment.
Page 10 of 22