Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects the exfiltration of encrypted archives over HTTP POST requests. It specifically looks for HTTP POST methods, the presence of file data, the 'PK' magic bytes indicating a ZIP or similar archive, and a file size greater than 50,000 bytes. This combination suggests an attempt to send a large, potentially encrypted, archive out of the network.
Detects AiTM compromise where user click phishing URL, completed MFA, and signed in from a different IP within 10 minutes
This rule detects an inbound HTTP POST request targeting the Langflow AI pipeline application, specifically looking for attempts to exploit CVE-2026-33017. The detection logic focuses on specific URI paths and keywords within the HTTP request body that indicate an attempt to inject code, such as 'import '.
This rule detects an inbound HTTP POST request targeting the Langflow AI pipeline application, specifically looking for attempts to exploit CVE-2026-33017. The detection logic focuses on specific URI paths and keywords within the HTTP request body that indicate an attempt to inject code, such as 'import '.
Detect .NET hollowing technique
Suricata
.NET hollowing technique - external fetch of InstallUtil.exe (rare)
Intellexa PREYHUNTER - HTTP
Suricata
Intellexa PREYHUNTER - HTTP response contains distinctive iOS build/artifact strings
UNC5142 CLEARSHORT - injected Web3 + BSC contract addresses in HTTP response
Triofox CVE-2025-12480
Suricata
Triofox CVE-2025-12480 - localhost Host header to admin setup pages
This query identifies rare or newly observed application sign-ins by comparing activity in the last 24 hours against a 30‑day historical baseline.
It highlights applications that are never used or seldom used in the tenant, helping detect anomalous or suspicious application activity that may indicate OAuth abuse, automation tools, or compromised accounts.
It highlights applications that are never used or seldom used in the tenant, helping detect anomalous or suspicious application activity that may indicate OAuth abuse, automation tools, or compromised accounts.
This rule set detects various stages of the OysterLoader malware activity, including its registration and login attempts to a command and control (C2) server, specific C2 communication patterns via HTTP URIs, and connections to known OysterLoader C2 domains and IP addresses. The rules look for specific HTTP URI paths like "/reg" and "/login" combined with distinct User-Agent strings ("WordPressAgent" and "FingerPrint"), as well as specific API paths under "/api/" and hardcoded C2 domains and IP addresses.
This rule detects attempts to exploit Ivanti EPMM vulnerabilities CVE-2025-4427 and CVE-2025-4428. The first signature identifies requests to the '/api/v2/featureusage' endpoint containing patterns indicative of remote code execution (e.g., '${', 'Runtime', 'getRuntime', 'exec'). The second signature detects requests for a '.jsp' file named '403', which could indicate a backdoor or web shell deployment post-exploitation.
This rule detects HTTP requests for 'install.sh' from the domains 'clawd.bot' or 'openclaw.ai'. These domains are associated with the OpenClaw/Clawd malware, indicating an attempt to download a malicious installation script.
This rule set detects network communication associated with macOS infostealers, including C2 infrastructure, SHub stealer heartbeat and exfiltration, and ClickFix staging and landing pages. It identifies specific hostnames and URI paths used by these malicious campaigns.
ET PHISHING Microsoft ClickFix Landing Domain
ET PHISHING Microsoft ClickFix Landing Domain
This rule detects an attempt to exploit an XML External Entity (XXE) vulnerability in GeoServer's Web Map Service (WMS) GetMap function. The detection logic looks for HTTP POST requests to the '/wms?' endpoint containing 'request=GetMap' in the URI, and specific XML elements like '<StyledLayerDescriptor>', '<!DOCTYPE', '<!ENTITY', and 'SYSTEM' within the request body, along with a URL-like pattern '://' indicating an attempt to fetch external content.
Detects specific User-Agent strings associated with the DDoSia malware, which is used by the NoName057(16) hacktivist group for DDoS attacks. The rule looks for two distinct User-Agent patterns in HTTP traffic.
This rule detects patterns indicative of an Evilginx-style Adversary-in-the-Middle (AiTM) phishing attack. It specifically looks for HTTP requests to hostnames ending in suspicious top-level domains (TLDs) such as .click, .online, .cloud, or .shop, combined with specific URI paths like /wlc/, /load/, or /success/. These patterns are commonly used by AiTM redirectors to capture credentials and session tokens.
This rule detects command and control (C2) beaconing activity associated with the SHADOW-VOID-042 malware family. Specifically, it looks for HTTP POST requests containing the string "get_module_hello" in the request body, which is indicative of a C2 communication pattern used by this malware.
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
This rule detects a possible Remote Code Execution (RCE) attempt targeting a React application, specifically exploiting CVE-2025-55182. It looks for inbound HTTP POST requests containing 'child_process' and 'response' and 'Sync' in the request body, along with specific HTTP headers ('Next-Action', 'rsc-action-id', or 'text/x-component'). The presence of 'child_process' suggests an attempt to execute system commands.
Page 107 of 116