Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects a rapid sequence of blind boolean SQL injection probes against the author_exclude parameter using ASCII/SUBSTRING syntax and the X-WP-Total header oracle (CVE-2026-60137).
Detects HTTP request attempts to exploit WordPress vulnerabilities (associated with 'wp2shell' activity) targeting the 'author_exclude' or 'author__not_in' parameters with SQL injection payloads, such as sleep() functions or comment injection characters.
This rule detects the initial WebSocket handshake request used by the INTERLOCK NodeSnake RAT for beaconing. It looks for a GET request containing a 'Sec-WebSocket-Key' header and a specific URI pattern (?v=n;) common to the RAT's communication profile.
Detects an HTTP GET request to the Microsoft Graph API (/v1.0/users/*/calendarView) containing a specific hardcoded far-future date (2050-05-13) in the startDateTime parameter. This pattern is indicative of a command-and-control (C2) mechanism leveraging a legitimate cloud service to maintain persistent communication channels.
This rule detects unauthenticated HTTP requests to the WordPress REST API batch endpoint (/wp-json/batch/v1). Such requests are characteristic of attempts to exploit the wp2shell vulnerability (CVE-2026-63030), where attackers leverage the batch API to execute unauthorized actions without proper authentication headers (Cookie or Authorization).
Detects HTTP GET requests associated with the Blind Eagle (APT-C-36) campaign JC-46, specifically targeting GitHub for payload delivery and fetching dropper files (such as .vbs, .bat, .js, or .pif) from known command-and-control staging infrastructure.
Detects multiple repeated web requests targeting WordPress 'author_exclude' or '/wp/v2/batch' endpoints that contain suspicious time-based SQL injection payloads. The rule specifically looks for patterns attempting to leverage SLEEP() functions to infer database information.
Detects the WordPress REST API batch-route confusion technique (CVE-2026-63030) via a malformed nested sub-request path combined with the co-occurring parse_path_failed/block_cannot_read/rest_batch_not_allowed error marker pattern.
Detects network traffic indicating msaRAT behavior where a host initiates a STUN/TURN token request to a Cloudflare Workers (.workers.dev) domain. The rule identifies suspicious characteristics including spoofed Microsoft-related Origin or Referer headers and a HeadlessChrome User-Agent, commonly used by automated C2 communication.
Detects HTTP response bodies containing specific combinations of advertising tracking markers (Google gtag, Meta fbq, and Twitter twq) alongside known path indicators like '/config' or 'sw.js', which are characteristic of SourTrade malvertising landing pages.
Detects SQL injection syntax smuggled into the author_exclude parameter via the WordPress REST API batch endpoint desync (CVE-2026-60137/CVE-2026-63030).
Detects UNION-based blind SQL injection against the WordPress REST posts item route exploiting the split_the_query bypass (CVE-2026-60137) to exfiltrate database contents.
Detects requests to WordPress plugin-install/upload or privileged user REST endpoints occurring shortly after anomalous WordPress REST API batch activity, consistent with post-exploitation follow-through in the wp2shell chain.
Detects unauthenticated POST requests to the WordPress REST API batch endpoint (/wp-json/batch/v1 or ?rest_route=/batch/v1) containing a nested requests array or an anomalous sub-request method pattern, the network entry point for the wp2shell CVE-2026-63030/CVE-2026-60137 exploit chain.
Detects the HTTP POST exfiltration pattern used by the mrmustard stealer to send harvested credentials/host data to its C2 endpoint at metrics.femboy.energy/v1/collect.
Detects outbound HTTP POST requests to a Polygon blockchain JSON-RPC endpoint containing the eth_call method and a specific hardcoded smart contract address and function selector associated with the TELEPUZ malware command-and-control communication.
This rule detects a specific WebSocket handshake pattern associated with the NodeSnake RAT. It specifically identifies an HTTP GET request containing a 'Sec-WebSocket-Key' header and a specific URI query parameter '?v=4|3b|', which indicates beaconing activity characteristic of this RAT's communication channel.
Detects outbound HTTP requests to a specific Telegram channel (chanadarkpart) commonly associated with the TELEPUZ malware (used by SCMBANKER), indicating a potential command-and-control (C2) dead-drop resolver communication attempt.
This rule detects a specific HTTP request pattern targeting the WordPress REST API batch endpoint. It identifies a malformed sub-request path containing a path string formatted as 'http://:', which is indicative of a 'route confusion' attempt, potentially leading to unauthorized operations or SSRF (Server-Side Request Forgery) within the WordPress environment.
Possible EtherHiding - outbound eth_call JSON-RPC request to blockchain RPC endpoint
PowerShell Downloading JPEG Image Possible Steganographic Payload Carrier
Page 57 of 116