Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,277 detections
Filters
Last updated
All Time
Detection languages
3,349
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,035
2,546
1,076
1,051
932
Platforms
39,971
7,277
6,539
3,868
3,652
Products / Services
1,332
1,114
993
658
494
MITRE Techniques
2,274
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
This rule detects outbound network connections to the specific IP address 38.60.253.35 on port 8084. Such traffic is highly suspicious and indicative of potential communication with a Command and Control (C2) server.
This rule detects network connections or DNS requests to the domain 'mitarchive.info', which is associated with known malicious activity. Monitoring for traffic to this domain can help identify hosts that may be compromised or attempting to communicate with an attacker-controlled infrastructure.
Detects reconnaissance activities targeting binaries or modules containing libssh2 library references or specific PHP symbol offsets (e.g., zend_execute_internal, zif_system). This rule monitors for common administrative and debugging tools like ldd, strings, readelf, and nm being used to scan files for sensitive symbols or version information, as well as specific PHP enumeration patterns and validation script executions, which are commonly associated with the triage process for CVE-2026-55200.
Detects the execution of the VSCode npm infostealer campaign, specifically identifying the usage of a fake eslint loader named 'vscode-eioesocxetd.js'. This malware performs sandbox and environment checks for CI/CD, cloud, and containerized environments (AWS, Azure, GCP, GitHub Codespaces, etc.) to evade analysis before proceeding to deploy infostealers or backdoors.
Detects unauthorized attempts to escalate privileges within the MyBB Administrative Control Panel (ACP). The rule identifies malicious activity such as creating an administrator user by assigning usergroup 4, or accessing restricted configuration settings via HTTP POST/GET requests directed at the admin index script.
Detects suspicious activities indicative of a MyBB limited ACP user escalating privileges to full administrator. This includes web server processes (php, httpd, nginx) spawning command shells, interacting with database management tools, creating suspicious session files, or writing executable files to critical directories (cache, templates, uploads, inc).
Detects post-exploitation activities related to the PHP 8.5.7 CVE-2025-15661 StreamBucket SOAP vulnerability. This rule monitors for PHP worker processes spawning shells, writing executable files to suspicious directories, executing system binaries on Windows, or initiating outbound network connections on non-standard ports, including specific proof-of-concept markers.
This rule monitors Linux-based SD-WAN infrastructure (vManage, vSmart, vBond) for suspicious persistence mechanisms, unauthorized account creation, unauthorized SSH key modifications, credential file tampering, and rogue configuration changes related to OMP/IPSec peering and unauthorized tenant-list uploads.
This rule detects the exploitation of CVE-2026-20245 on Cisco SD-WAN Manager (vManage). It monitors for two distinct phases: 1) The suspicious upload of a tenant-list CSV file via CLI using a malicious filename, and 2) A subsequent privilege escalation attempt where the 'admin' user executes 'su' to switch to a 'troot' user, which is indicative of a backdoor account creation following successful exploitation.
Detects remote code execution (RCE) attempts targeting PHP 8.5.7 StreamBucket SOAP vulnerability. The rule monitors for suspicious child process creation originating from web server processes (php-fpm, php, apache, httpd) including shells, scripting engines (python, perl, ruby), or network utilities (nc, curl, wget).
Detects unauthorized persistence mechanisms on Cisco SD-WAN Manager, vSmart, and vBond nodes by monitoring for local account creation (e.g., useradd), modification of sensitive authentication files (/etc/passwd, /etc/shadow), and illicit SSH key placement in authorized_keys. This rule specifically monitors for known exploit paths involving the 'troot' account and related command-line activity indicative of unauthorized administrative access.
Detects LampoRAT malware based on known file hash execution.
This rule detects outbound network connections to URLs associated with common file sharing services (e.g., Dropbox, Mega, Gofile) or temporary email providers (e.g., Temp-Mail). Such connections can indicate data exfiltration attempts, use of unsanctioned services, or communication with command and control infrastructure.
Detects processes making HTTP/HTTPS requests to localhost on ports 40341 or 40342 for '/metadata'. This pattern can indicate local service discovery, inter-process communication, or potentially malicious activity attempting to interact with local services, possibly for credential access or privilege escalation.
This rule detects network connections to specific deep link patterns associated with messaging applications like Telegram, WhatsApp, and Signal. Such deep links can be used in phishing attempts or to initiate actions on a user's device through these applications.
This rule detects attempts to authenticate to SSH using GSSAPI (Generic Security Service Application Programming Interface). While GSSAPI can be used for legitimate authentication, its presence in logs might indicate an attacker attempting to use alternative authentication methods, potentially for lateral movement or privilege escalation, especially if unexpected in the environment.
This rule detects successful SSH authentications using the GSSAPI-with-MIC mechanism. This can indicate legitimate user logins or, in some cases, an adversary using valid credentials to access a system via SSH.
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
Detects Log4Shell JNDI exploitation attempts by scanning incoming network request data for JNDI patterns and simultaneously monitors for suspicious shell child processes (cmd, powershell, bash, sh) spawned by java.exe, indicating post-exploitation activity.
This rule detects network connections made to specific non-standard ports (7777, 8080, 8443) where the remote URL contains substrings associated with proxy or tunneling activities ('proxy', 'tunnel', 'hide'). This behavior is commonly associated with malware attempting to evade security controls by routing traffic through unauthorized intermediaries or obfuscated tunnels.
Detects unauthenticated Engine.IO WebSocket handshake attempts targeting the Peyara Remote Mouse service on TCP port 1313. These requests, characterized by specific URI query parameters, are often used as an initial phase for exploitation against vulnerable instances of the application.
Page 188 of 347