Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
483 detections
Filters
Last updated
All Time
Detection languages
151
134
74
42
39
Contributors
103
95
90
56
41
Categories
88
80
76
66
63
Platforms
210
208
108
108
71
Products / Services
10,651
9,755
6,688
4,418
3,745
483
MITRE Techniques
100
93
87
62
54
CVEs
6
6
5
4
4
Detects instances where command-line arguments contain sensitive patterns such as cloud provider API keys, secret access keys, environment variable files, or cryptographic seed phrases. The rule specifically flags hosts where multiple such suspicious commands are executed, indicating potential reconnaissance or credential theft activity.
Detects the LEASHTEST MIPS-compiled test binary linked to UAT-7810 ORB network R&D activity; presence indicates device compromise
Detects a highly relevant Antivirus alert that reports a remote access tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This rule detects a multi-stage process indicative of Server-Side Request Forgery (SSRF) leveraging Bing's Search-by-Image service. Stage 1 captures browsers submitting arbitrary URLs (via the imgurl= parameter) to Bing. Stage 2 detects subsequent inbound requests to an external, attacker-controlled server originating from Bing's infrastructure, suggesting that Bing performed an unauthorized fetch of a resource and delivered it to the attacker, potentially exfiltrating sensitive data.
Detects a highly relevant Antivirus alert that reports APT malware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports an exploitation framework.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports a hack tool or other attack tool.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects a highly relevant Antivirus alert that reports ransomware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
This rule detects processes running from non-standard locations (specifically within application data directories) that perform both file system write operations for media or image formats (indicative of screen, audio, or video capture) and simultaneously initiate outbound network connections to non-private IP addresses. This behavior is often characteristic of spyware, unauthorized remote access tools, or malware attempting to capture and exfiltrate user activity.
Detects a highly relevant Antivirus alert that reports password dumpers and stealers.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place and check if passwords need to be reset.
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Ransomware group exploiting edge devices and managed file transfer software
Detects indicators of the BUMSRAKETE exploit targeting a FreeBSD kernel page-cache corruption vulnerability (CVE-2026-45257). The rule triggers on the execution of the exploit binary, creation of specific staging files in /tmp, unauthorized access to SUID binaries, configuration of kTLS socket options (TCP_RXTLS_ENABLE/TCP_TXTLS_ENABLE) by unprivileged users, and pre-exploit reconnaissance using sysctl.
Detects a suspected exploitation of CVE-2026-35616 on edge/SOHO devices, followed within 5 minutes by the download of an architecture-specific MIPS dropper via curl or wget, a behavior consistent with known threat activity such as the Volt Typhoon/JDY Botnet.
This rule detects network connections or process command lines referencing 'easyupload.io' and 'limewire.com', as well as searches for 'eayupload'. These indicators are often associated with unauthorized file transfers or potentially malicious activity involving known file sharing platforms.
Detects a highly relevant Antivirus alert that reports a web shell.
It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
It's highly recommended to tune this rule to the specific strings used by your anti virus solution by downloading a big WebShell repository from e.g. github and checking the matches.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Detects exploitation attempts against GeoServer targeting CVE-2024-36401, a vulnerability involving unsafe OGC filter property name evaluation. The rule monitors for malicious HTTP patterns in incoming requests to OGC endpoints (ows, wfs, wms, wcs) and identifies subsequent suspicious process spawning by the GeoServer JVM instance that indicate successful remote code execution.
This rule detects exploitation attempts targeting CVE-2026-0300 in Palo Alto Networks PAN-OS. It identifies suspicious network connections to User-ID Authentication Portal ports (6081, 6082) from external IP addresses, excluding RFC1918 and loopback ranges. Additionally, it looks for a specific anomalous User-Agent string associated with the CL-STA-1132 threat actor, which has been observed during exploitation of this vulnerability.
USB worm and loader leveraging living-off-the-land binaries
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Cloud extortion group exploiting exposed credentials and storage
Page 13 of 23