Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
118 detections
Filters
Last updated
All Time
Detection languages
117
1
Contributors
52
30
22
5
3
Categories
98
67
61
26
22
Platforms
102
27
19
6
6
Products / Services
113
102
14
3
2
MITRE Techniques
67
39
37
29
28
CVEs
4
4
3
2
1
IDS Classtypes
1,937
503
461
381
236
118
IDS Protocols
64
44
4
2
2
Detects unauthorized or external access attempts to the Ollama LLM API service (TCP port 11434). The rule specifically flags POST requests targeting the /api/generate or /api/chat endpoints, which are commonly exposed via misconfiguration or lack of authentication, potentially allowing remote command execution or model exploitation.
Detects repeated attempts to perform IIS 8.3 tilde short-filename enumeration. This reconnaissance technique exploits the legacy DOS 8.3 file naming convention to identify the existence and naming of files or directories on a Microsoft IIS web server.
Detects a suspicious sequence of events where Kubernetes API resources (namespaces, secrets, configmaps, pods, or nodes) are enumerated, followed by a search query against the Slack API, indicative of a potential reconnaissance phase or sandbox escape attempt.
This rule monitors for a rapid sequence of TCP SYN packets directed towards common administrative ports (SSH/22, RDP/3389, SMB/445) within a short window, indicative of an automated lateral movement scanning attempt or a brute-force discovery phase originating from within the internal network.
This rule detects external reconnaissance attempts targeting MLflow Tracking Servers by monitoring for inbound HTTP GET requests to the default MLflow API path '/api/2.0/mlflow/'. This behavior is indicative of an adversary scanning for exposed machine learning infrastructure, potentially to facilitate subsequent unauthorized access or exploitation of the tracking server.
Detects unauthenticated network requests targeting MLflow Model Registry and Ajax API endpoints on port 5000. These requests are characteristic of unauthorized reconnaissance against exposed machine learning management services.
Detects unauthorized attempts to access exposed Chroma or Weaviate vector database APIs via standard HTTP requests (GET/POST) targeting known API endpoints for collections or objects. This may indicate an adversary conducting reconnaissance on publicly accessible database infrastructure.
Detects potential credential stuffing activity by monitoring for a high volume of HTTP 401 (Unauthorized) or 403 (Forbidden) responses originating from a single source IP address within a 60-second window, specifically targeting URIs containing the path 'login'.
Detects Git clone or fetch operations targeting bitbucket.org where the requested branch or ref is formatted as a SHA hash. This specific pattern is identified as a potential precondition for exploitation attempts targeting vulnerabilities like Plugin4Shell, where malicious branch names are used to trigger code execution on the server-side.
Detects high-volume web crawling or reconnaissance activities originating from autonomous AI agent frameworks, such as AutoGPT, BabyAGI, LangChain, or CrewAI. These activities are identified by analyzing User-Agent strings and applying threshold-based rate limiting to identify potential automated reconnaissance patterns.
Detects HTTP requests where the User-Agent header matches known strings associated with AI-powered penetration testing or reconnaissance agents, such as PentestGPT, AutoGPT, or AI-Recon tools.
Detects unauthenticated HTTP requests directed at management or schema APIs for common vector databases (Milvus, Weaviate, Qdrant). These requests lack the required Authorization header, potentially indicating unauthorized reconnaissance or attempts to exploit public-facing database management interfaces.
Detects high-volume account enumeration activity associated with the TeamFiltration tool, characterized by the use of legacy Microsoft Teams desktop client User-Agent strings (specific versions of Teams, Electron, and Chrome) within a short time window.
Detects incoming HTTP GET requests to common Jupyter Notebook endpoints ('/tree' or '/api/kernels') that do not include a token in the URI. This behavior is indicative of an adversary attempting to interact with or explore an insecurely configured Jupyter Notebook server that lacks authentication.
Detects high-frequency requests from automated scripting tools like 'python-requests', 'aiohttp', or 'Scrapy' targeting sensitive directories or files often associated with administrative panels or application configurations (e.g., admin, .env, wp-admin). The rule triggers when a threshold of 10 requests is reached within a 60-second window, indicating potential automated vulnerability or information gathering activity.
Detects a single source IP address attempting to connect to multiple hosts over TCP port 3389 (RDP) within a short timeframe (10 attempts in 60 seconds). This behavior is indicative of a host scanning the network for accessible RDP services, a common precursor to lateral movement or brute force attacks.
Detects unauthenticated POST requests directed at the '/v1/completions' endpoint of a vLLM server. This behavior is indicative of potential unauthorized access or exploitation attempts against an exposed LLM inference API that lacks authentication controls.
Detects unauthenticated HTTP POST requests targeting the '/v1/graphql' endpoint of a Weaviate vector database. This pattern is indicative of reconnaissance or exploitation attempts against exposed Weaviate API instances.
Detects unauthenticated GET requests to known AI and machine learning infrastructure management endpoints (e.g., DCGM, Ray, Kubeflow) that are commonly exposed without authentication. These interfaces provide operational metrics, cluster status, or job management details, which can be leveraged for reconnaissance.
Detects unauthorized GET requests to common default paths associated with AI agent developer consoles and infrastructure, such as '/playground', '/api/predict', or '/_stcore'. These requests are identified by the absence of expected 'Authorization' or 'Cookie' headers, suggesting an unauthenticated probe or discovery attempt by an external actor looking for misconfigured or exposed AI development interfaces.
Detection of common web server reconnaissance, enumeration, and brute-force patterns targeting IIS environments. This includes detection of short-name (~1) probes, WebDAV method usage, NTFS alternate data stream requests, and brute-force attempts on login endpoints originating from PowerShell user agents.
Page 1 of 6