Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects HTTP traffic patterns associated with the Turla STOCKSTAY malware establishing a WebSocket connection to the known C2 domain 'wool-basalt-clock.glitch.me'. The rule monitors for a GET request containing specific HTTP headers (Upgrade: websocket) required for protocol switching to WebSocket, which is a common technique for establishing persistent C2 channels.
This rule detects attempts to exploit a path traversal vulnerability (CVE-2026-49506) in the Dell Wyse Management Suite API. The rule inspects HTTP requests for directory traversal sequences such as '..' or URL-encoded equivalents, which could allow an unauthorized attacker to access files or directories outside the intended scope on the web server.
Detects HTTP GET requests for specific malicious archives (calculator.rar, EditorToolsPdf.zip) originating from suspected compromised Ukrainian domains (basecon.com.ua, online.zp.ua). This behavior is associated with the STOCKSTAY malware used by the threat actor Turla.
This rule detects HTTP POST requests containing the specific string 'GEMINI_TRUST_WORKSPACE', which is associated with environment variable injection attacks targeting CI/CD pipeline configurations.
Detects HTTP traffic patterns associated with the Turla STOCKSTAY malware establishing a WebSocket connection to the known C2 domain 'wool-basalt-clock.glitch.me'. The rule monitors for a GET request containing specific HTTP headers (Upgrade: websocket) required for protocol switching to WebSocket, which is a common technique for establishing persistent C2 channels.
This rule detects potential Remote Code Execution (RCE) exploitation attempts targeting Dell Wyse Management Suite (WMS) by identifying abnormally large POST requests containing JSON payloads directed at specific management paths (/WMS/ or /wyse/). This behavior is indicative of an exploit attempt against CVE-2026-41120.
Detects HTTP traffic attempting to upgrade a connection to a WebSocket protocol directed towards the known Turla-associated command-and-control infrastructure 'driverx86-adobe.onrender.com'. This pattern is characteristic of the STOCKBROKER component within the STOCKSTAY malware framework, observed in recent phishing campaigns.
Detects anomalous HTTP GET requests targeting the ClawHub API for 'skills' that match known patterns of malicious file downloads, specifically identifying poc.py scripts or skill.md files which are indicative of the ClawHavoc campaign activity.
Detects HTTP response bodies containing common PE/Shellcode magic headers (MZ, PE, or NOP sleds) which are associated with the delivery of payloads designed to exploit or utilize the Windows KernelCallbackTable for process injection. The detection focuses on suspicious content delivered over HTTP connections.
This rule detects potential lateral movement attempts using Windows Remote Management (WinRM) by monitoring for specific WSMan SOAP protocol headers in HTTP traffic. It specifically looks for POST requests to the WSMan endpoint that contain suspicious keywords like 'winrs', 'MSRPC', or 's:Envelope', which are commonly associated with remote command execution via winrs or PSSession.
Detects HTTP traffic where the User-Agent header references Regasm or Regsvcs, which are trusted Windows utilities often abused by attackers to proxy execution of malicious code (Living-off-the-Land Binary technique).
Detects HTTP traffic patterns consistent with data exfiltration to major cloud storage providers (AWS S3, Azure Blob Storage, Google Cloud Storage) using common command-line interface tools like rclone, aws-cli, and AzCopy.
Detects outbound HTTP POST requests characterized by a specific URL pattern consisting of two segments of 4-16 alphanumeric characters, typically observed in Emotet C2 traffic. The rule specifically matches requests with a Content-Type header set to application/octet-stream, which is indicative of malicious binary payload transfer or communication.
This rule detects network traffic originating from internal hosts to external destinations consistent with default Cobalt Strike HTTP Beacon communication patterns. It specifically looks for GET requests containing URI paths commonly associated with default Cobalt Strike profiles (ca, submit.php, updates.rss) combined with a specific, hardcoded User-Agent string associated with Cobalt Strike's default configuration.
Detects outbound HTTP POST requests where the Content-Length header indicates a data transfer of 5MB or greater. This pattern is indicative of potential unauthorized data exfiltration over the web protocol.
Detects the transmission of a Metasploit Meterpreter stage over HTTP, identified by an application/octet-stream response containing the DOS MZ header signature.
This rule monitors for HTTP POST requests containing 'class.module.classLoader', which is a characteristic payload component used to exploit the Spring4Shell vulnerability (CVE-2022-22965) in Spring Framework applications. This vulnerability allows for remote code execution (RCE) by manipulating class loader properties.
Detects HTTP requests containing a UNION SELECT pattern in the URI query string, which is a common indicator of a SQL injection attempt aimed at exfiltrating data or manipulating database queries.
Detects inbound HTTP requests containing common Cross-Site Scripting (XSS) patterns, such as the <script> HTML tag or the 'javascript:' URI scheme, which are indicative of attempts to execute arbitrary client-side code.
Detects network traffic consistent with the default Cobalt Strike Malleable C2 jQuery profile. The rule monitors for GET requests to the URI '/jquery-3.3.1.min.js' accompanied by a specific 'Accept' HTTP header, which is a known indicator of default Cobalt Strike beacon activity.
This rule detects attempts to perform directory traversal attacks by monitoring incoming HTTP requests for repetitive directory navigation sequences (e.g., ../, .., %2F, %5C). Such sequences are often used to bypass security controls and access unauthorized files or directories on the web server.
Page 66 of 116