Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects HTTP traffic containing a specific session cookie pattern characteristic of PowerShell Empire C2 agent communication, utilizing regex to identify base64-encoded session identifiers.
Detects classic SQL injection attack patterns within incoming HTTP requests, such as UNION SELECT statements, boolean-based tautologies (1=1), table dropping commands, or common URL-encoded quote characters.
This rule detects HTTP POST requests containing a Content-Length header value indicating a body size exceeding 10MB. Large POST requests may indicate data exfiltration, large file uploads, or misuse of HTTP channels for data transfer to external destinations.
Detects HTTP GET requests to a specific self-hosted GitLab domain 'gitlab.bzctoons.net' that attempt to download a file named 'protected.zip', which is associated with the retrieval of StealC information-stealing malware by the Amadey loader.
Detects HTTP traffic patterns associated with LokiBot malware beaconing to a hardcoded command and control (C2) endpoint. The rule specifically looks for established network connections to identified malicious domains or IP addresses using the /fre.php URI path.
This rule detects outgoing HTTP POST requests that contain a payload matching the signature of Ousaban malware's custom XOR-encoded command-and-control (C2) traffic, characterized by a specific hexadecimal structure.
This rule detects a specific typosquatting pattern used by the EvilTokens phishing kit. It looks for HTTP traffic where the host contains 'workers.dev' and matches a regular expression for 'viewdoc[a-z0-9\-]+\.workers\.dev'. This indicates an attempt to mimic legitimate Cloudflare Workers domains for phishing purposes, specifically targeting the 'viewdoc' pattern often seen in document-sharing lures.
This rule detects network traffic indicative of the 'EvilTokens' phishing kit, specifically targeting Microsoft OAuth Device Code flow. It looks for HTTP POST requests to the '/api/device/start' URI on domains hosted on Cloudflare Workers ('.workers.dev'). This pattern suggests an attempt to initiate a device code phishing attack, where adversaries trick users into entering credentials or codes to grant access to malicious applications.
This rule detects high-volume HTTP POST requests to the FortiGate SSL VPN logincheck URI, specifically '/remote/logincheck', over common HTTPS ports (443, 4433, 8443, 9443, 10443). It uses a threshold of 5 requests from the same source IP within 30 seconds to identify potential credential stuffing or password spraying attacks against FortiGate devices, often associated with the 'FortiBleed' campaign.
Detects HTTP response bodies containing specific strings associated with the 'Montana Empire' phishing kit. This rule monitors for indicators that a web server is serving a phishing credential harvesting page.
This rule detects command and control (C2) communication associated with the 'easy-day-js' backdoor, which is part of the Mastra npm supply chain attack. It specifically looks for HTTP POST requests to the IP address 23.254.164.123 with a spoofed Internet Explorer 8 User-Agent string.
Detects outbound HTTP PUT requests to 'filen.io', which has been associated with command-and-control (C2) communication for the PRISMEX malware used by the threat actor APT28 (also known as Pawn Storm/Fancy Bear).
Detects outbound HTTP POST requests to file.io originating from a Go-based HTTP client, consistent with the GopherWhisper APT C2 or exfiltration activity.
Detects outbound HTTP POST requests containing keywords indicative of credential and data theft associated with VBV Stealer malware, specifically looking for fields related to passwords, cookies, or wallets in the request body.
Detects outbound network traffic to the ScreenConnect service specifically targeting the /Relay/ path, which is commonly abused by ransomware operators (e.g., Interlock, RansomHub) for establishing unauthorized remote access and command-and-control channels.
Detects outbound HTTP POST requests to file.io originating from a Go-based HTTP client, consistent with the GopherWhisper APT C2 or exfiltration activity.
Detects outbound HTTP POST requests containing keywords indicative of credential and data theft associated with VBV Stealer malware, specifically looking for fields related to passwords, cookies, or wallets in the request body.
Detects outbound network traffic to the ScreenConnect service specifically targeting the /Relay/ path, which is commonly abused by ransomware operators (e.g., Interlock, RansomHub) for establishing unauthorized remote access and command-and-control channels.
This rule detects HTTP POST requests containing the specific string 'GEMINI_TRUST_WORKSPACE', which is associated with environment variable injection attacks targeting CI/CD pipeline configurations.
Detects attempts to exploit CVE-2026-12537 in the Google Gemini CLI, which allows for unauthorized manipulation of the .gemini/.env configuration file. The rule triggers on GET or POST requests attempting to access or modify this specific environment file, potentially enabling malicious environment variable injection.
This rule detects network traffic patterns associated with the Turla group's STOCKSTAY malware, specifically identifying WebSocket upgrade requests directed at the external domain 'canal1zac1a.onrender.com'. This pattern is indicative of a Command and Control (C2) channel initiation.
Page 68 of 116