Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,146 detections
Filters
Last updated
All Time
Detection languages
679
377
340
230
173
Contributors
630
378
354
143
119
Categories
835
831
746
387
348
Platforms
1,580
584
492
263
118
Products / Services
10,680
9,761
6,694
4,418
3,744
2,146
MITRE Techniques
655
561
377
331
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
Detects exploitation attempts against Citrix Netscaler, Application Delivery Controller, and Citrix Gateway devices targeting CVE-2019-19781. The rule looks for specific URI query patterns indicative of directory traversal or direct access to vulnerable scripts.
Detects potential command and control (C2) beaconing activity to domains identified as being used in the 'Operation Triangulation' attacks, which targeted iOS devices. These domains were revealed by Kaspersky and the FSB.
Detects Server-Side Template Injection (SSTI) attempts made via GET requests. The rule looks for common SSTI payload strings within the request, specifically excluding requests that result in a 404 Not Found status code to reduce false positives.
This rule detects attempts to inject Cross-Site Scripting (XSS) payloads via GET requests in web access logs. It specifically looks for common XSS strings and encoded variations within the request URL, such as '<script>', '<iframe>', '<svg>', 'document.cookie', 'document.domain', 'onerror=', 'onresize=', 'onload=', 'onmouseover=', '${alert', 'javascript:alert', and their URL-encoded forms. The rule filters out requests that result in a 404 HTTP status code to reduce false positives.
This rule detects DNS queries for specific domains associated with the WannaCry ransomware killswitch. The presence of these queries indicates a potential WannaCry infection attempting to resolve its killswitch domain. If the domain resolves, the ransomware may cease its encryption activities.
This rule detects suspicious network requests to the Telegram API (api.telegram.org) that do not include a standard 'Telegram' or 'Bot' user-agent string. This behavior is often indicative of malware or custom tools attempting to use Telegram's API for command and control or data exfiltration without revealing their identity as a legitimate Telegram client or bot.
This rule detects HTTP requests where the User-Agent header contains ' WindowsPowerShell/'. This pattern is indicative of PowerShell making web requests, potentially for downloading files, interacting with web services, or command and control activities. This can be a legitimate administrative activity but is also frequently abused by adversaries.
Detects outbound network connections to known cryptocurrency mining pool domains. This activity is often indicative of resource hijacking (cryptojacking) where an attacker uses a compromised system's resources to mine cryptocurrency without the owner's consent. The rule specifically targets a comprehensive list of domains associated with various mining pools, primarily for Monero (XMR) and other cryptocurrencies.
Detects the default communication pattern used by the BabyShark C2 framework, specifically looking for the 'momyshark?key=' string within the URI of proxy requests. This pattern is indicative of BabyShark malware attempting to communicate with its command and control server.
Detects the use of rclone, a command-line program to manage files on cloud storage, by identifying its default user-agent string in proxy logs. This activity can indicate data exfiltration to cloud storage services.
This rule detects instances where the 'winlogon.exe' process initiates outbound network connections to public IP addresses. Winlogon.exe is a critical Windows component responsible for user logon/logoff and the secure attention sequence. Typically, winlogon.exe should not be making outbound network connections to public IPs. Such activity could indicate compromise, potentially by malware like BlackLotus, which has been observed to leverage winlogon.exe for malicious purposes, including command and control or data exfiltration.
Detects exploitation attempts targeting Pulse Secure VPN appliances via CVE-2019-11510. Specifically, it looks for requests to a URI path containing '/dana/html5acc/guacamole/', which is indicative of an attacker attempting to access the Guacamole component of the Pulse Secure appliance.
Detects the exploitation of the VMware vSphere Remote Code Execution vulnerability (CVE-2021-21972) by identifying HTTP POST requests to the '/ui/vropspluginui/rest/services/uploadova' endpoint. This specific URI indicates an attempt to upload a malicious OVA file, which is the vector for the RCE.
Detects a unique URL marker '/MSHTML_C7/' used in GET requests, which has been associated with RomCom exploitation attempts, potentially leveraging CVE-2023-36884. This marker is indicative of command and control communication or initial access related to the exploit.
Detects potential C2 communication related to Devil Bait malware by identifying specific URI patterns in GET requests. The rule looks for URIs containing '/cross.php?op=', '&dt=', and '&uid=' which are indicative of Devil Bait's communication with its command and control server.
Detects a potential exploitation attempt of CVE-2023-25717, a Remote Code Execution vulnerability via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin. The rule looks for specific URI query parameters including '/forms/doLogin', 'login_username', 'password', and the presence of '$(' or its URL-encoded version '%24%28', which are indicative of command injection.
Detects potential malicious .ICO files downloaded from a compromised 3CXDesktopApp via web requests to a malicious GitHub repository, indicative of the SmoothOperator campaign.
Detects downloads of potentially malicious file types (executables, scripts, documents, archives) from domains that are not common Top-Level Domains (TLDs). This rule aims to identify suspicious file transfers that bypass typical, trusted sources.
This rule detects suspicious Windows file path strings (e.g., 'C:/Users', 'C:/Windows', 'C:/Program Files') within the URI query component of web requests. The presence of such strings in a URI could indicate an attempt to exfiltrate data from a Windows system or communicate with a webshell that is attempting to access local files or directories. The rule looks for both standard and URL-encoded variations of these paths.
Detects exploitation attempts of the SonicWall SSL/VPN Jarrewrite vulnerability. The rule looks for requests to '/cgi-bin/jarrewrite.sh' combined with specific patterns in the 'cs-user-agent' header that indicate command injection attempts, such as ':;', '() {', or '/bin/bash -c'. This targets a known vulnerability allowing attackers to execute arbitrary commands.
This rule detects a specific HTTP GET request pattern associated with potential exploitation of CVE-2023-36884 by the RomCom threat group. The pattern involves a URI containing '/MSHTML_C7/' and a query parameter 'd' followed by an IPv4 address.
Page 101 of 103