Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,084 detections
Filters
Last updated
All Time
Detection languages
418
193
163
156
81
Contributors
381
251
92
71
40
Categories
498
271
255
135
123
Platforms
443
441
267
121
114
Products / Services
10,665
9,758
6,692
4,418
3,749
1,084
MITRE Techniques
278
229
180
177
151
CVEs
17
15
13
13
8
IDS Classtypes
4
IDS Protocols
4
This rule detects potential prompt injection and jailbreak attempts targeting internal Generative AI applications by monitoring prompt content for known adversarial patterns (e.g., DAN roleplay, hypothetical bypasses, and explicit disregard for safety instructions). The rule tracks repeat offenders or successful bypass attempts (where the application did not block the request).
Detects evidence of indirect prompt injection (IPI) attempts within email and document content processed by enterprise AI assistants. The rule flags instruction-hijack phrases, hidden obfuscation characters (e.g., zero-width, white-on-white text), and encoded blocks specifically targeting AI model behavior.
Detects malformed HEIF/HEIC image files with anomalous ftyp/box structure consistent with the libheif memory corruption exploit (CVE-2026-32882) used against Discourse forum image upload endpoints
This rule monitors for the presence of a specific, known malicious package (@dforge-core/dforge-mcp version 0.2.21) being referenced in file paths, indicative of a software supply chain compromise or the distribution of malicious dependency artifacts.
This rule detects a potential vishing attack by correlating suspicious IT helpdesk requests (e.g., password or MFA reset without manager approval or verified callback) with subsequent sensitive Entra ID identity changes (e.g., self-service password resets, MFA device registration, or new device registration) occurring for the same user within a short time window. This activity is indicative of an attacker attempting to social-engineer helpdesk staff to bypass authentication controls and compromise a user account.
Detects potential exploitation of CVE-2025-3248 in Langflow by identifying suspicious inbound network traffic targeting the /api/v1/validate/code endpoint, correlated with subsequent python child processes containing base64 decoding and execution primitives such as eval, exec, or subprocess.
Detects unauthorized usage of the Android Accessibility Service to navigate system settings, specifically targeting the toggling of developer options and the extraction of 6-digit ADB pairing codes, as observed in the RatHat Android malware.
This rule detects potential unauthorized access to sensitive information by correlating the execution of command-line tools (sed, bash, sh) with secret-related flags or file references, followed shortly by execution of cloud CLI commands that enumerate or retrieve secrets. This behavior is indicative of an attacker attempting to parse or extract sensitive data stored in local configuration files or memory, and then fetching specific secret values from a cloud secret manager.
Detects instances where browser extensions, potentially AI-assisted (e.g., Claude, Gemini), trigger automated mail actions (send, forward, summarize) to non-standard, external domains. This behavior may indicate an unauthorized agent attempting to exfiltrate or manipulate email content.
Detects the creation or unauthorized usage of the 'p2pwn' backdoor account and associated 'p2password' credentials on Dahua devices. This indicator is linked to exploitation of CVE-2024-39943, which allows for persistent unauthorized access that survives device factory resets.
Detects adversarial conversational reconnaissance patterns where a user queries an AI agent to enumerate its capabilities, such as available plugins, functions, or parameter schemas. The disclosure of this internal information by the agent facilitates the construction of targeted prompt-injection payloads, a known precursor to exploitation of AI agent vulnerabilities.
Detects the presence of known adversarial LLM jailbreak or prompt injection patterns embedded within source code comments. These patterns are designed to bypass safety filters or security controls of AI models when the source code is processed or analyzed by such systems.
Detects potential JWT algorithm-confusion or authentication-bypass attempts
targeting WSO2 API Manager components through JWTs specifying unsupported,
downgraded, or unexpected signing algorithms such as "none" or HS256 where
asymmetric signing is expected. Matching events should be investigated to
determine whether the request represents exploitation of CVE-2026-5430.
targeting WSO2 API Manager components through JWTs specifying unsupported,
downgraded, or unexpected signing algorithms such as "none" or HS256 where
asymmetric signing is expected. Matching events should be investigated to
determine whether the request represents exploitation of CVE-2026-5430.
Detects anomalous process execution originating from the PaperCut application server process, specifically targeting the SetupCompleted servlet endpoint. This pattern is indicative of an exploitation attempt, such as CVE-2026-81578, where unauthenticated requests trigger backend server actions before proper access validation.
Detects unauthenticated attempts to exploit CVE-2025-3248 in the Langflow 'validate/code' endpoint, characterized by missing authentication headers and the presence of suspicious Base64-encoded payloads or command execution keywords. Additionally, it identifies potential post-exploitation activity where Langflow processes spawn Python subprocesses.
Detects the use of the 'getevent' debugging utility within an Android shell context (UID 2000) to monitor raw touch input events from /dev/input. This technique, often referred to as 'AdbTouchCapture', can be used to capture coordinate data from touchscreens, potentially bypassing system-level security controls like FLAG_SECURE to reconstruct user input, gestures, or PIN/pattern credentials.
Detects instances where an Android application, installed from a non-standard source (sideloaded via ADB or unknown sources), requests the BIND_ACCESSIBILITY_SERVICE permission for a service named 'SystemHelper'. This behavior is characteristic of mobile malware like Rathat that leverages accessibility services to gain unauthorized control over user credentials and bank accounts.
Detects mobile malware, specifically the RatHat Android malware, attempting to display unauthorized overlay windows over legitimate banking and financial applications to harvest user credentials via WebView components.
Detects potential exploitation of CVE-2025-3248 in Langflow by identifying suspicious inbound network traffic targeting the /api/v1/validate/code endpoint, correlated with subsequent python child processes containing base64 decoding and execution primitives such as eval, exec, or subprocess.
This rule detects a multi-stage attack chain targeting a single user within a 2-hour window. It identifies the combination of email bombing (a distraction technique), an incoming external or anonymous Teams call (social engineering channel), and the installation of common remote access tools (e.g., AnyDesk, TeamViewer) on the same host.
This rule detects the installation or presence of ten identified malicious npm packages associated with the indexed-btree/sorted-btree typosquatting campaign. It monitors command-line activity for 'npm install' commands, package name resolution, and entries within 'package.json' files.
Page 16 of 52