Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects specific URI patterns associated with the DEBULL (also known as CloakGuard) Phishing-as-a-Service (PhaaS) platform. These URI paths are commonly used by attackers managing phishing campaigns, including administrative authentication or deployment script execution on compromised infrastructure acting as a phishing panel.
Detects HTTP POST requests containing 'poll_auth_broker_token' and 'device_code' parameters, which are characteristic of malicious OAuth 2.0 device authorization grant flows commonly used in phishing campaigns.
This rule detects HTTP POST requests to known phishing domains (frenksv.sbs, debull.app) which include specific parameters indicative of an attempt to initiate the OAuth 2.0 device authorization grant flow ('get_auth_broker_device_code'). This pattern is associated with phishing campaigns aiming to hijack a user's session by tricking them into authorizing a malicious application, eventually leading to the theft of application access tokens.
Detects unauthenticated HTTP POST requests targeting the /api/v1/validate/code endpoint in Langflow, which is indicative of an exploitation attempt associated with CVE-2025-3248.
Detects HTTP POST requests directed at a '/save.php' URI, a common signature associated with the Kratos phishing kit used for capturing and exfiltrating user credentials.
Detects HTTP traffic identified as MarkiRAT command and control beaconing, characterized by a specific multipart POST request structure directed at a known malicious URI and domain.
Detects HTTP POST requests directed to the 'avenger-sync.live' domain by the PamStealer malware. The rule identifies specific C2 or exfiltration traffic patterns, including the '/api/sync' URI and a specific JSON-formatted data envelope in the request body, commonly used by the malware for communication.
This Suricata rule detects potential exfiltration of stolen data by the StealC or Amadey malware families. It specifically looks for an HTTP POST request to a .php URI containing a 'PK' header (the magic bytes for a ZIP file), suggesting the transmission of compressed stolen logs to a C2 server.
This rule detects attempts to exploit the Nacos CVE-2021-29441 authentication bypass vulnerability. The vulnerability allows an attacker to bypass authentication by leveraging default or forged JWT tokens, specifically targeting the /nacos/ path with an Authorization header containing a Bearer token starting with 'eyJ'.
Detects network traffic associated with Cavern Manticore command-and-control communication. The rule identifies a specific HTTP request pattern characterized by a static User-Agent string resembling a Chrome/Edge browser on Windows and the inclusion of a specific 'X-User-token' header in the HTTP request.
This rule detects HTTP GET requests for specific file paths associated with known malicious lure archives (e.g., YEPlayer.rar, Pis2rayVPN.zip, YEMPlayer.msi). These files are typically used in social engineering campaigns to trick users into downloading and executing malware.
Detects the download of a Mach-O executable file over unencrypted HTTP. The rule identifies the Mach-O magic byte header ('CF FA ED FE') within the first few bytes of the HTTP response body, indicating a file download originating from an external network source.
Detects HTTP GET requests to the URI '/beacon' destined for a known JadePuffer command-and-control server IP address (45.131.66.106) on port 4444. This signature identifies potential beaconing activity, which is a common communication pattern for malware implants communicating with an adversary-controlled server.
Detects unauthorized access attempts to MinIO object storage using the default 'minioadmin' credentials. The rule specifically flags attempts to access sensitive files like 'terraform-state' or 'credentials.json' via HTTP GET requests.
This rule detects attempts to exploit an unauthenticated administration API vulnerability (CVE-2026-35616) in FortiClient EMS versions 7.4.5 and 7.4.6, commonly referred to as FortiBleed. This vulnerability could allow an unauthenticated attacker to gain unauthorized access to the administration interface.
Detects incoming HTTP POST requests to the /PSEMHUB/hub endpoint on Oracle PeopleSoft servers, which is indicative of exploitation attempts related to the Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2026-35273.
This rule detects suspicious Google OAuth authorization requests directed at accounts.google.com that utilize a local redirect URI (http://localhost) and are missing mandatory security parameters such as code_challenge, state, and login_hint. These characteristics are often associated with OAuth-based phishing or credential theft campaigns where an adversary attempts to intercept authorization codes.
Detects HTTP GET requests to signindat.com for suspected malicious payloads, including executables (.exe) and scripts (.ps1), as well as a decoy PDF document. The rule identifies communication with an external host using generic User-Agent strings, characteristic of the CrySome RAT multi-stage download process.
Detects HTTP traffic containing a User-Agent string associated with the NetSupport Manager remote access tool. This activity is indicative of the tool being used for unauthorized remote access or as a C2 channel, often seen in the context of the ClickFix campaign.
This rule detects attempts to exploit a Server-Side Request Forgery (SSRF) vulnerability in Oracle PeopleSoft by targeting the '/PSIGW/HttpListeningConnector' endpoint. The detection looks for malicious URI patterns and request bodies containing internal-only network indicators such as loopback addresses (127.0.0.1, localhost), link-local addresses (169.254.169.254), or local file access attempts (file://), which are indicative of SSRF exploitation attempts.
Detects outbound HTTP POST requests to a /gallery URI endpoint, which is associated with Cavern Manticore C2 beacons. The detection logic inspects the HTTP request body for a specific Base64-encoded pattern following XOR 0x48 encoding, indicating potential command-and-control communication.
Page 59 of 116