Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects Server-Side Request Forgery (SSRF) attempts exploiting URL parser differentials. Attackers append a double-slash sequence to a legitimate github.com blob URL to trick the backend into resolving an absolute local filesystem path. The rule specifically targets sensitive paths such as /proc/self/environ, /var/task/, and application source files to perform Local File Read (LFR) or access internal cloud metadata services.
This rule detects outbound network traffic from an instance or container to the Google Cloud metadata service (metadata.google.internal or 169.254.169.254). Such activity is highly indicative of Server-Side Request Forgery (SSRF) exploitation, where an attacker attempts to retrieve service account credentials or instance metadata from an internal service.
Detects attempts to bypass URL validation and access sensitive GCP metadata endpoints (169.254.169.254 or metadata.google.internal) using a double-slash (//) prefix injection pattern within URL parameters. This technique is often used in Server-Side Request Forgery (SSRF) attacks to read local resources or metadata credentials from Cloud Run or other GCP compute services.
Detects SMTP traffic containing XLSX file attachments, specifically looking for base64 encoded content that matches the criteria for CVE-2025-60727. This rule monitors network traffic for the delivery of potential malicious Office documents.
Detects CI/CD package manager traffic (e.g., pip, npm) attempting to connect to domains that mimic legitimate PyPI or npm registry domains. This behavior is indicative of a dependency confusion or supply chain attack where an adversary uses typosquatted or phantom-squatted domains to intercept or redirect package requests.
Detects HTTP POST requests to known phishing kit endpoints 'panel_track.php' or 'verify_api.php', which are associated with the Montana Empire credential harvesting campaign.
Detects SMTP traffic containing XLSX file attachments, specifically looking for base64 encoded content that matches the criteria for CVE-2025-60727. This rule monitors network traffic for the delivery of potential malicious Office documents.
Detects inbound HTTP requests containing JNDI lookup strings commonly used to exploit the Log4Shell vulnerability (CVE-2021-44228). The rule specifically monitors for JNDI lookups over ldap, rmi, or dns protocols within HTTP traffic, which can lead to remote code execution.
Detects attempts to exploit Microsoft Exchange vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), collectively known as ProxyShell. The rule monitors inbound HTTP requests targeting the /autodiscover/ endpoint with specific path traversal patterns and malicious components used to stage web shells or execute arbitrary commands.
Detects attempts to perform Local File Inclusion (LFI) via path traversal sequences (../) in HTTP URIs, specifically targeting sensitive files like /etc/passwd or windows/win.ini.
Detects network connections from common browser processes and script execution engines to the known Payroll Pirate (Storm-2755 / Storm-2657) phishing domain 'bluegraintours.com', which is associated with Adversary-in-the-Middle (AiTM) session cookie and OAuth token harvesting.
This rule detects when Microsoft Office applications (Word, Excel, PowerPoint) create INI files within the `C:\ProgramData\` directory. This behavior can be indicative of malicious activity, such as macro-enabled documents dropping configuration files or payloads, or other forms of malware attempting to establish persistence or store data in a less scrutinized location.
This rule detects suspicious sign-in attempts to Microsoft services (login.microsoftonline.com, graph.microsoft.com, outlook.office365.com) that occur within 30 minutes of a user clicking on a URL associated with these services. The sign-in is considered suspicious if it originates from a user agent commonly used by automated tools (e.g., axios, curl, python-requests, httpclient, Go-http-client) and is flagged with a 'atRisk' or 'high' risk level by Azure AD. This combination suggests a potential credential compromise following a phishing attempt, where an attacker might be using automated tools to leverage stolen credentials.
Detects when a web browser (Chrome, Edge, Firefox, Brave, Opera) initiates a process that is not another instance of itself. This could indicate a drive-by download, execution of malicious code, or other suspicious activity originating from a browser.
This rule detects when users access or download suspicious file types (specifically .xlsm, .docm, or .ics) from Microsoft SharePoint, Teams, or Exchange, where the filenames contain keywords associated with common phishing lures such as credentials, invoices, payroll, or password resets. This monitors for indicators of potential spearphishing attempts involving malicious documents or calendar invites within the M365 environment.
Detects FortiBleed related credential abuse activity against Fortinet SSL VPN by identifying high volume failed login attempts or password spraying from the same source IP. The rule also checks whether the same source IP later had a successful SSL VPN login
Detects a PDF, SVG, HTML, or presentation attachment containing a QR code or extracted URL that leads into an enterprise authentication workflow. This rule is designed to identify phishing attempts where adversaries embed QR codes or malicious URLs within common document types to direct users to fake enterprise login pages for credential harvesting.
Detects the execution of the 'curl' utility with parameters configured to interact with an SMTP server using 'EXPN' or 'VRFY' commands while loading a configuration file via the '-K' flag. This pattern is indicative of an attempt to exploit CVEs or software vulnerabilities that are susceptible to CRLF injection within SMTP recipient fields, potentially leading to unauthorized mail relaying or protocol manipulation.
This rule detects potentially malicious activity related to the 'node-gyp' build tool used by npm. It monitors for two patterns: 1) npm spawning node-gyp, which can be an automated trigger for malicious binding.gyp files, and 2) node-gyp spawning node.exe with command-line arguments indicative of obfuscated JavaScript (e.g., base64 encoding, eval, AES-GCM patterns), a technique often seen in malicious Node.js packages.
Detects the exploitation of CVE-2026-20253, where the Flowise application fails to correctly sanitize or validate environment variables. By using a case-insensitive bypass (e.g., lowercase 'node_options'), an attacker can cause a spawned Node.js child process to honor the variable and execute unauthorized JavaScript files via the '--require' command-line argument.
Detects web proxy traffic containing links to lookalike recruitment portals using specific typosquatting suffixes (e.g., .com.de) and URL paths (/careers/auth). These patterns are linked to UNC1549, an adversary identified as targeting aerospace and defense organizations with fake React-based recruitment lures.
Page 34 of 235