Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
JadeProx proxy/tunnel binary retrieval from Alibaba OSS bucket dlrz-web with known binary naming pattern
This rule detects network traffic patterns associated with BlueNoroff ClickFix C2 communications. It specifically identifies GET requests to endpoints containing an 'ft?id=' parameter followed by a base64-encoded string, which indicates the delivery of encrypted tasking parameters to an infected system.
Detects network activity associated with BlueNoroff ClickFix campaigns, specifically targeting the download of suspicious Windows PE files from typosquatted CDN/payload URIs. The rule uses session tracking to correlate the initial URI request with the subsequent retrieval of executable content.
Detects an outbound HTTP GET request containing a .jpg extension in the URI, initiated by a user agent string containing 'PowerShell'. This pattern is commonly associated with attackers downloading images intended to serve as carriers for steganographic payloads, which are then parsed or executed by malicious PowerShell scripts.
This rule detects network traffic patterns where an internal host initiates an HTTP connection to a specific Steam Community profile, which is used as a dead-drop resolver by the TELEPUZ malware (associated with the CLICKFIX-VIDAR campaign) to retrieve secondary command-and-control infrastructure information.
Detects HTTP requests to the WordPress REST API batch endpoint carrying User-Agent strings associated with public wp2shell exploitation tooling (wp2shell, cve-2026-63030/1.0, rezwp2shell).
Detects high-volume, threshold-based scanning/exploitation attempts against the WordPress REST API batch endpoint from a single source, consistent with mass wp2shell PoC-driven exploitation.
This rule detects outbound HTTP requests using the WebDAV protocol that target specific directory paths associated with the Stealth Falcon campaign staging activity. Such traffic may indicate a compromised host attempting to download tools or payloads from an adversary-controlled infrastructure.
Detects unauthenticated HTTP POST requests targeting the /api/v1/validate/code endpoint in Langflow, which is indicative of an exploitation attempt associated with CVE-2025-3248.
Detects outbound HTTP POST requests containing JSON-RPC 'eth_call' methods, which are indicative of EtherHiding activity where blockchain infrastructure is abused for command and control or data retrieval.
Detects outbound HTTP POST requests destined for 'webhook.site' containing the string 'secret' in the request body. This is a common pattern used by attackers to exfiltrate small amounts of sensitive data or credentials to a public web service for collection.
Detects outbound HTTP POST requests containing the word 'secret' in the request body directed to the external service 'webhook.site', which is often used by adversaries for quick data exfiltration or testing during post-exploitation activities.
Detects sequential HTTP GET requests for specific SVG assets (barr.svg followed by lg.svg) associated with the Kratos V1 phishing kit landing page, indicating potential interaction with a phishing site.
This rule monitors for a high volume of WebDAV PROPFIND HTTP requests directed toward a specific domain associated with malware staging activities. The detection threshold is set to 50 requests within a 300-second window, which is indicative of automated attempts to enumerate or download malicious content using the WebDAV protocol.
Detects HTTP POST requests directed at known Kratos Phishing-as-a-Service (PhaaS) URI paths, specifically 'PTT', 'SOft', or 'mini.php'. These paths are commonly associated with credential exfiltration activities.
This rule detects unauthorized or suspicious access to the Komari remote administration panel over unencrypted HTTP. Detecting such access is critical as it indicates potential management interface exposure or unauthorized administrative activity within the network.
Detects HTTP POST requests indicative of credential exfiltration associated with the Kratos phishing kit. The rule monitors for specific endpoint patterns (e.g., next.php, nex.php, n3xt.php, or officers*eur.php) commonly utilized by this kit to receive stolen credentials.
Detects HTTP GET requests for specific static assets (dsa.svg, sid.gif, imag.jpg) known to be associated with the Kratos V2 phishing kit, which is often used in credential harvesting campaigns.
Detects HTTP traffic originating from external sources that contains response body patterns associated with a DEBULL-themed phishing lure. This rule specifically identifies content indicators related to device-code broker phishing, where a user is tricked into navigating to a malicious URL (debull.app) to authorize access or provide credentials.
Detects network traffic characterized by a specific rotating domain generation algorithm (DGA) pattern using .xyz TLD with a 10-digit timestamp, in combination with a specific URI structure containing 'script?id=' and the suspicious 'tag=WinUpdateHelper' parameter. This behavior is indicative of C2 communication.
Detects incoming HTTP requests directed at the Nacos server application path that contain specific identifiers indicative of an exploitation attempt for CVE-2021-29441. This vulnerability allows an attacker to bypass authentication mechanisms.
Page 58 of 116