Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,670
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects high-volume SSH authentication failures from a single source IP address within a short time frame, which is indicative of credential spraying or brute force activity.
Detects unauthenticated HTTP requests directed at management or schema APIs for common vector databases (Milvus, Weaviate, Qdrant). These requests lack the required Authorization header, potentially indicating unauthorized reconnaissance or attempts to exploit public-facing database management interfaces.
This rule detects attempts to exploit a command injection vulnerability (CVE-2026-49869) in the Kestra workflow automation platform. The rule monitors HTTP POST requests to the '/api/v1/flows' endpoint, identifying payloads that define flow types involving shell or execution plugins and contain suspicious command sequences (e.g., shell operators combined with common system utilities like nc, bash, or curl).
Detects an exploitation attempt against a known SQL injection vulnerability (CVE-2026-62262) in the Piwigo photo gallery application, specifically targeting the 'pwg.images.filteredSearch.create' method via the 'ratings' parameter. The detection monitors inbound HTTP traffic for common SQL injection patterns like UNION SELECT, SLEEP commands, and boolean-based injection payloads.
Detects network traffic patterns associated with a specific Cobalt Strike Malleable C2 profile (jquery-cookie), characterized by GET requests to URIs starting with /jquery- with a specific Cookie header structure and the absence of an Accept header.
Detects HTTP POST requests with 'photo' in the URI and Gzip-compressed body content, which is a known C2 communication pattern used by the IcedID banking trojan.
Detects HTTP traffic patterns associated with the default staging URIs of the PowerShell Empire C2 framework. This rule identifies inbound requests to specific .php files (admin/get, news, login/process) with a 'session=' cookie, which are characteristic of Empire agent beaconing behavior.
Detects DNS tunneling attempts by identifying DNS queries with abnormally long subdomains (greater than 50 characters) that exhibit a high request rate (20 or more queries within 60 seconds). This behavior is characteristic of C2 communication tools such as iodine or dnscat2, which encode data within DNS query labels to bypass traditional network security controls.
Detects network traffic associated with the BotHelper RAT communicating with its C2 domain 'easyllms.xyz'. The rule monitors for TLS SNI connections to this domain and specific HTTP API paths (/api/v1/ping, /api/v1/connect, etc.) indicative of command-and-control heartbeats and task execution.
Detects network activity associated with the Psychedelic Stealer malware, including C2 check-ins, API-based tasking, and communication with known C2 infrastructure using specific URI patterns and headers like 'X-API-Key'.
This rule monitors outbound TLS traffic to detect communication between a potentially compromised internal host and the DeepSeek API. This behavior is associated with the 'CLOSEDQUORUM' malware family, which utilizes LLM-based voting mechanisms for command and control (C2) operations via third-party AI services.
Detects HTTP traffic originating from internal hosts to external destinations on port 8989, specifically targeting '/chat/completions' URI patterns. This activity is indicative of the CARBONATO/Hermes Agent leveraging LLM gateway infrastructure as a command-and-control (C2) channel.
Detects network activity associated with the NeedyMantis malware command and control (C2), including DNS queries for the domain corp.tripswithengine.com, TLS SNI identification, and specific HTTP beaconing patterns to /library/zip/ with a hardcoded user agent.
Detects HTTP traffic associated with the NeedyMantis malware, specifically identifying initial beacons to a known C2 domain using a specific User-Agent, followed by command-and-control response headers that suggest the exfiltration of reconnaissance data via the Set-Cookie field.
Detects network patterns associated with NeedyMantis-style command-and-control (C2) activity. This includes specific HTTP GET requests with hardcoded User-Agent strings, cookie-based binary data transfer in server responses, and WebSocket communication attempting to establish binary protocol channels.
Detects outbound network requests to known infrastructure associated with the ClickFix Traffic Direction System (TDS), specifically targeting domains 'fsputnik.com' and 'uasputnik.com'. The rules monitor for requests to specific lure pages, tracker files, and established IP connections used by this malicious campaign to deliver fraudulent prompts or lures to victims.
Experimental CommonSecurityLog template for sensor-reported attempts associated with Cisco advisory cisco-sa-ise-rce-se7bYU57: CVE-2026-20307, CVE-2026-20176 and CVE-2026-20211. Cisco links Snort SIDs 67114, 67115, 67116 and 67130-67132. Configure exact exporter event IDs, sensor vendor/product and confirmed ISE management IPs. A match does not prove successful exploitation or root compromise.
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
Detects anomalous outbound HTTP/TLS requests to rutracker.org that contain a GUID-like identifier in the URI or deviate from normal user traffic patterns, which is characteristic of the 'VPN-for-X' browser extension acting as a command-and-control beacon.
This rule detects outgoing HTTP POST requests to the '/api/credentials' endpoint, which is characteristic of the AMOS (Atomic macOS Stealer) malware family communicating with its command-and-control server to exfiltrate stolen sensitive information.
Detects HTTP beaconing patterns and TLS SNI traffic associated with the Sauron Loader malware. The rules identify specific URI structures (including versioned resources and various configuration/profile endpoints), specific URL parameters used for session management, and characteristic User-Agent strings. Additionally, it monitors for connections to known command-and-control infrastructure via TLS SNI filtering.
Page 14 of 124