Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,773
6,705
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
This rule detects attempts to exploit the Microsoft Support Diagnostic Tool (MSDT) vulnerability CVE-2022-30190, known as 'Follina'. The rules monitor for malicious HTTP traffic and payloads that leverage the 'ms-msdt' URI scheme to execute arbitrary commands, often delivered via weaponized documents or external references to remote malicious HTML files.
Detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by identifying JNDI lookups (ldap, rmi, dns) via malicious strings within HTTP URI and request headers, a common attack vector for remote code execution.
Detects Heartbleed (CVE-2014-0160) exploitation attempts by monitoring for malformed TLS heartbeat requests (undersized payload) followed by oversized responses from the server that indicate potential memory disclosure.
Detects anomalous network traffic patterns characteristic of SectopRAT, specifically utilizing Binance Smart Chain (BSC) RPC nodes to facilitate fallback Command and Control (C2) communication. The rule monitors for POST requests to known BSC data seed domains containing 'eth_call' in the body, specifically looking for START and FINISH markers in the response body.
Detects network activity associated with the RatHat Android malware, specifically tracking device registration, log uploads to '/api/node/', and subsequent WebSocket protocol upgrades used for command-and-control communications.
Detects network exploitation attempts targeting Fortinet FortiOS and FortiProxy vulnerabilities (CVE-2024-55591, CVE-2025-24472) involving authentication bypass via HTTP header manipulation (Forwarded, X-Forwarded-For) and unauthorized access to the /jsconsole endpoint.
Detects outbound HTTP requests or TLS traffic to known C2 domains associated with APT28/UAC-0001 related to the CVE-2026-21509 campaign.
Detects browser-side malicious activity involving communication with Cloudflare Workers (workers.dev) endpoints typically associated with C2 beaconing (relays, ICE, socket) or the retrieval of trojanized JavaScript dependencies like 'jquery.mousewheel' which often precede second-stage agent execution.
Detects network activity associated with the APT36 threat group, specifically HTTP requests for PowerShell stagers (irm/iex) from 'indiatodays.org' and TLS connections to that same domain, which is identified as a typosquat used for command and control or ingress tool transfer.
Detects incoming HTTP GET requests containing a specific URI path '/favorite_list_2x_m500_ico.jpg' associated with the Ted Backdoor, commonly used by North Korean state-sponsored threat actors including APT37, Lazarus Group, and Kimsuky for Command and Control (C2) beaconing.
Detects HTTP GET requests to raw.githubusercontent.com that include an 'Authorization: token' header, indicating the potential use of a GitHub Personal Access Token (PAT) for command and control or data exfiltration by the Kimsuky threat group.
Detects outbound HTTP GET requests to Pastebin.com with a path starting with /raw/. This pattern is commonly used by threat actors, including the Kimsuky APT group, to retrieve secondary payloads, configuration files, or malicious scripts from a public repository.
Detects anomalous HTTP GET requests to the Microsoft Teams trap-exp/tokens endpoint that do not carry the expected 'Teams' user-agent string. This pattern is indicative of the DragonForce backdoor attempting to illicitly request Skype authentication tokens.
Detects anomalous HTTP GET requests to the Microsoft Teams trap-exp/tokens endpoint that do not carry the expected 'Teams' user-agent string. This pattern is indicative of the DragonForce backdoor attempting to illicitly request Skype authentication tokens.
Detects anomalous HTTP GET requests to the Microsoft Teams trap-exp/tokens endpoint that do not carry the expected 'Teams' user-agent string. This pattern is indicative of the DragonForce backdoor attempting to illicitly request Skype authentication tokens.
Detects specific markers in UDP traffic on ports 3478, 5349, and 443 that are associated with the DragonForce malware's TRN1 C2 beaconing protocol. The rules identify session initiation, task polling, task acknowledgment, and result uploading behaviors.
Detects specific markers in UDP traffic on ports 3478, 5349, and 443 that are associated with the DragonForce malware's TRN1 C2 beaconing protocol. The rules identify session initiation, task polling, task acknowledgment, and result uploading behaviors.
Detects network activity associated with the DragonForce backdoor, specifically the use of MQTT for command and control. The rules monitor for unique 16-character client IDs used during registration on non-standard ports, subsequent command retrieval structures containing 'cmdnum', and DNS queries for the hardcoded broker 'broker.emqx.io'.
Detects network activity associated with the DragonForce backdoor, specifically the use of MQTT for command and control. The rules monitor for unique 16-character client IDs used during registration on non-standard ports, subsequent command retrieval structures containing 'cmdnum', and DNS queries for the hardcoded broker 'broker.emqx.io'.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Page 10 of 124