Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
This rule detects the download of Android Application Package (APK) files from Amazon S3 buckets, where the HTTP URI contains keywords related to gambling (slot, bet, play, jackpot). This activity is indicative of potential malware distribution, specifically targeting Android devices with gambling-themed applications, as observed in Indonesian gambling ecosystems.
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
This rule detects potential Browser-in-the-Browser (BITB) phishing attacks, specifically targeting the 'Sneaky2FA' technique. It looks for HTTP responses containing an iframe, base64 encoded image data, and the string ';base64,', which are indicators of a malicious page attempting to mimic a legitimate login portal within an iframe to steal credentials.
This rule detects HTTP GET requests containing specific URL patterns associated with Calisto phishing campaigns. The patterns include '/vendor/plugx/', '/wp-content/plugins/(bungs|areada|leykos)/', '/prueba/phantomrise/', or '/plugins/unite/', combined with the 'utm_refferer=' parameter in the URI. This indicates an attempt to redirect users to malicious content, likely as part of a phishing attack.
This rule detects outbound HTTP traffic where the User-Agent header contains the string 'Internet Explorer'. This has been seen used by malware, and the legitimate Internet Explorer browser uses the User-Agent string "MSIE". The MSIE browser was end-of-lifed in 2022. The rule specifically looks for this pattern in established, to_server HTTP flows.
This rule detects command and control (C2) communication associated with the Lazarus Group's ScoringMathTea Remote Access Trojan (RAT). It specifically looks for HTTP traffic where the User-Agent header matches a known string used by this malware: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.42'. This User-Agent string attempts to masquerade as a legitimate Microsoft Edge browser.
This rule detects Command and Control (C2) beaconing activity associated with the UNC1549 threat group and the LIGHTRAIL malware. It specifically looks for HTTP traffic with a URI containing '/news', an 'Upgrade: websocket' header, and a distinct User-Agent string 'Mozilla/5.0 (Windows NT 10.0) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/42.0.2311.135 Safari/537.36 Edge/12.10136'. This combination of indicators suggests an attempt to tunnel C2 communications over HTTP, potentially masquerading as legitimate WebSocket traffic.
This rule detects inbound HTTP requests containing the User-Agent string 'Salesforce-Multi-Org-Fetcher/1.0'. This specific User-Agent has been associated with data theft from Salesforce instances, as detailed in a Google Cloud blog post. The detection aims to identify potential malicious activity targeting web server applications, specifically Salesforce environments, where an attacker might be attempting to exfiltrate data.
This rule detects inbound HTTP requests containing the User-Agent string 'Salesforce-CLI/1.0'. This activity is considered suspicious as it may indicate reconnaissance or data theft attempts targeting Salesforce instances, potentially leveraging compromised credentials or systems. The presence of this specific User-Agent inbound to a network could be an indicator of malicious activity, as Salesforce CLI is typically used by developers and administrators for managing Salesforce organizations and is not expected to be seen in inbound traffic from external networks to internal systems.
ET WEB_SPECIFIC_APPS VMware Workspace ONE Access OAuth2TokenResourceController ACS Authentication Bypass (CVE-2022-22956)
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Authentication Bypass (SyncServlet) (CVE-2025-61882)
ET MOBILE_MALWARE Android/TrickMo.Banker POST Request
ET WEB_SPECIFIC_APPS Adobe ColdFusion Unauthenticated Remote Code Execution (CVE-2023-29300)
This rule detects attempts to exploit an insecure deserialization vulnerability (CVE-2025-53690) in Sitecore Experience Platform via exposed ASP.NET MachineKeys. It specifically looks for HTTP POST requests to '/sitecore/blocked.aspx' containing a '__VIEWSTATE' parameter with a highly encoded string, indicative of a crafted ViewState payload used in deserialization attacks.
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Template Manager Template Copy (CVE-2025-61882)
This rule detects an attempt to exploit a critical vulnerability (CVE-2025-31324) in SAP NetWeaver Visual Composer's Metadata Uploader. The exploit leverages unauthenticated HTTP GET or HEAD requests to the '/developmentserver/metadatauploader' URI, combined with specific characters in the URI parameters (semicolon, dollar sign, backtick, pipe, or their URL-encoded equivalents) that indicate an attempt to execute arbitrary commands. This vulnerability allows an unauthenticated attacker to achieve remote command execution on the affected SAP system.
ET MOBILE_MALWARE Android/TrickMo.Banker Config Response
ET WEB_SPECIFIC_APPS Oracle E-Business Suite (EBS) Unauthenticated Template Manager Template Preview (CVE-2025-61882)
Page 108 of 116