Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,919 detections
Filters
Last updated
All Time
Detection languages
2,238
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
808
765
577
Platforms
1,844
1,022
856
814
659
Products / Services
988
596
477
456
383
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
4,919
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects HTTP requests attempting to exploit several IoT device vulnerabilities leveraged by the ShadowV2 botnet to spread. This rule looks for specific URI paths and command injection payloads associated with known CVEs.
Detects the creation of image files on endpoints that match the characteristics of the LANDFALL Android spyware delivery mechanism. LANDFALL is delivered via malformed DNG/JPEG files, often through WhatsApp. This activity could represent a user downloading or staging the malicious file on a corporate endpoint before transferring it to a mobile device. The rule looks for specific filename patterns associated with WhatsApp and known malicious file hashes.
Detects the execution of a command pattern associated with malicious .lnk files used in the SERPENTINE#CLOUD campaign. The threat actor uses a .lnk file to launch cmd.exe, which then uses robocopy to download a .wsf script from a WebDAV share hosted on a Cloudflare Tunnel, and finally executes it with cscript.exe.
Detects curl command downloading payloads to /var/tmp, indicating potential initial delivery stage of FlexibleFerret malware.
Detects DNS or HTTP communication to known FlexibleFerret malware infrastructure domains.
Detect when System Manager successfully executes commands against an instance.
Detects the Tsundere botnet infection chain where msiexec.exe launches a hidden, encoded PowerShell process, which in turn executes a Node.js spawner script.
Detects the execution of rundll32.exe with davclnt.dll to establish a WebDAV connection, a technique used by APT42 in the SpearSpecter campaign for initial access via malicious search-ms links. Specifically, it looks for rundll32.exe executing the DavSetCookie function from davclnt.dll and captures the WebDAV server from the command line argument.
Detects potential command injection attempts against Citrix NetScaler ADC and Gateway devices. This detection is based on the patterns described in a hypothetical proof-of-concept for CVE-2025-7775, which involves injecting shell commands and referencing sensitive system paths in HTTP requests.
Detects when a user account is added to a local privileged group (sudo or wheel) on a Linux endpoint using the 'usermod' utility. This action grants the user administrative privileges and could be indicative of privilege escalation.
Detects exploitation attempts targeting a code injection vulnerability in XWiki's SolrSearch macro (CVE-2025-24893). Attackers can inject malicious Groovy code through specially crafted requests to the SolrSearch endpoint, leading to unauthenticated remote code execution.
This rule detects TLS connections to domains associated with Gh0st RAT impersonation campaigns, specifically 'Campaign Trio' and 'Campaign Chorus'. It looks for specific strings ('i4tools', 'youdao', 'deepseek') in the TLS Server Name Indication (SNI) field, combined with top-level domains like '.top' or '.vip'. This pattern indicates potential command and control (C2) communication from Gh0st RAT malware.
Detects the execution of rundll32.exe with command-line arguments used to connect to a remote WebDAV share. This technique was observed in the SpearSpecter campaign where APT42 abused the 'search-ms' URI handler to deliver a malicious LNK file from an attacker-controlled WebDAV server.
Detects the creation of malicious disk images (.dmg) or a dropper file (.msi) associated with the DigitStealer macOS infostealer campaign.
This rule detects network connections to external hosts exhibiting a specific JARM fingerprint (27d40d40d00040d00042d43d00041df04c41293ba84f6efe3a613b22f983e6) that has been associated with a phishing campaign, specifically targeting Harbor Freight. JARM fingerprints are used to identify unique TLS server configurations, and this particular hash indicates a known malicious infrastructure.
Thu rule focus in identity suspicious powershell commands execuded from the the windows "EXECUTE" box (WIN+R)
Detects the RedTail cryptominer targeting exposed Docker APIs by looking for specific HTTP request patterns, including the 'libredtail-http' user agent and 'docker.selfrep' parameter in the request body.
This rule detects emails or URL click events containing a specific pattern associated with 'quantum.php' within the URL. This pattern is often indicative of phishing attempts, particularly those designed to harvest credentials or deliver malware.
This rule detects network traffic indicative of Kraken Ransomware activity, specifically looking for connections to Cloudflared tunnels. It identifies TLS SNI (Server Name Indication) containing '.trycloudflare.com', which is a domain used by Cloudflare for its tunnel services. This behavior is often leveraged by adversaries for command and control or data exfiltration, as it can help bypass traditional firewall rules and obscure the true destination of the traffic.
Detects FileFix campaigns that use clipboard manipulation functions in web pages to deliver malicious PowerShell commands. These campaigns often trick users into copying and executing payloads, sometimes involving steganography with image files.
Detects phishing emails with malicious HTML attachments designed to harvest credentials and exfiltrate them via the Telegram Bot API. The detection looks for specific attachment filenames (e.g., RFQ, INQUIRY) or content patterns indicative of this threat.
Page 141 of 235