Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,084 detections
Filters
Last updated
All Time
Detection languages
418
193
163
156
81
Contributors
381
251
92
71
40
Categories
498
271
255
135
123
Platforms
443
441
267
121
114
Products / Services
10,665
9,758
6,692
4,418
3,749
1,084
MITRE Techniques
278
229
180
177
151
CVEs
17
15
13
13
8
IDS Classtypes
4
IDS Protocols
4
This rule detects Salesforce Agentforce or similar AI-driven chat responses that contain external URLs with non-standard Top-Level Domains (TLDs). It identifies cases where the organization's redactor failed to strip a URL due to unexpected TLDs or unusual trailing termination characters (e.g., brackets) that are still rendered as clickable links in the interface. Such links may facilitate phishing, credential harvesting, or redirection to malicious sites.
This rule detects Salesforce Agentforce or similar AI-driven chat responses that contain external URLs with non-standard Top-Level Domains (TLDs). It identifies cases where the organization's redactor failed to strip a URL due to unexpected TLDs or unusual trailing termination characters (e.g., brackets) that are still rendered as clickable links in the interface. Such links may facilitate phishing, credential harvesting, or redirection to malicious sites.
Detects unauthenticated access attempts or requests originating from system/service accounts targeting the PaperCut NG/MF administrative interface, which may indicate exploitation of authentication bypass vulnerabilities (e.g., CVE-2026-81578).
Detects the installation or configuration of a browser extension that combines 'declarativeNetRequest' (network manipulation) and 'content_scripts' (DOM injection) capabilities while targeting sensitive AI-assistant domains such as gemini.google.com, perplexity.ai, opera.com, or claude.ai. This configuration is indicative of potential AI agent hijacking, allowing unauthorized code execution and traffic interception on trusted vendor websites.
Detects HTTP requests that use URL-encoded backslash traversal sequences
("..%5C") to walk out of a Next.js dynamic route and request the
"server-reference-manifest" file, which discloses the Server Action
encryption key. This is the reconnaissance/priming stage of CVE-2026-75604
RCE exploitation, observed against both the App Router and the Pages
Router ("/_next/data/<buildId>/.../server-reference-manifest.json").
("..%5C") to walk out of a Next.js dynamic route and request the
"server-reference-manifest" file, which discloses the Server Action
encryption key. This is the reconnaissance/priming stage of CVE-2026-75604
RCE exploitation, observed against both the App Router and the Pages
Router ("/_next/data/<buildId>/.../server-reference-manifest.json").
This rule detects potential unauthorized access to sensitive information by correlating the execution of command-line tools (sed, bash, sh) with secret-related flags or file references, followed shortly by execution of cloud CLI commands that enumerate or retrieve secrets. This behavior is indicative of an attacker attempting to parse or extract sensitive data stored in local configuration files or memory, and then fetching specific secret values from a cloud secret manager.
Detects outbound SMTP communication to Gmail servers containing specific indicators of compromise (sender, recipient, or subject line) associated with the LucidKnight (LucidRook) malware campaign, indicating potential reconnaissance data exfiltration.
Detects PHP web shells dropped into wp-content/uploads or plugin directories following WordPress plugin exploitation, characterized by host detail reporting and a browser-based file upload form
Detects successful API requests to sensitive administrative endpoints on WSO2 systems that lack a corresponding legitimate authentication event (session) from the same SourceIP and user pair, which may indicate the use of forged JWTs or authentication bypass exploitation (e.g., CVE-2026-5430).
Detects the creation of a Git branch where the branch name matches the pattern of a 40-character hexadecimal SHA-1 hash. This behavior is associated with the 'Plugin4Shell' technique, which exploits how some git implementations prioritize matching ref names over target commit objects, enabling an attacker to manipulate or swap code in automated systems or AI coding agents that rely on SHA-pinning.
Detects high-value wire transfer approvals within payment and ERP systems that exhibit indicators of business process compromise, specifically those bypassing standard dual-authorization controls in the immediate aftermath of an out-of-band verification event, suggesting potential deepfake or social engineering impersonation attacks.
Detects unauthorized or potentially malicious file transfer activity within ScreenConnect sessions. The rule flags file transfers occurring on vulnerable versions of ScreenConnect (prior to 26.6.5), transfers that bypass user confirmation prompts, or instances where files are transferred and subsequently executed.
This rule monitors IT asset inventory data for instances of ConnectWise (ScreenConnect) software running outdated versions prior to 26.6.5, which are known to be vulnerable to CVE-2026-84869. Identifying these assets is critical for preventing potential exploitation of public-facing remote administration tools.
This rule detects potential exploitation attempts against PaperCut servers by identifying high-frequency, consistent-interval network requests directed at PaperCut-specific URI patterns and ports, or associated with known vulnerability identifiers (CVE-2026-81578, CVE-2026-82078). The rule employs statistical analysis to identify potential automated scanning or exploitation activity, filtering out known geographic regions associated with lower-risk or irrelevant traffic.
Detects potential JWT algorithm-confusion or authentication-bypass attempts
targeting WSO2 API Manager components through JWTs specifying unsupported,
downgraded, or unexpected signing algorithms such as "none" or HS256 where
asymmetric signing is expected. Matching events should be investigated to
determine whether the request represents exploitation of CVE-2026-5430.
targeting WSO2 API Manager components through JWTs specifying unsupported,
downgraded, or unexpected signing algorithms such as "none" or HS256 where
asymmetric signing is expected. Matching events should be investigated to
determine whether the request represents exploitation of CVE-2026-5430.
Detects camera or microphone access events triggered by Chrome browser processes associated with AI agent contexts (e.g., Gemini, assistant, side panels, or extensions) where no user gesture or active video conferencing application is detected. This behavior is indicative of unauthorized or surreptitious media device usage by browser-based AI integrations.
Detects the creation or modification of scheduled tasks (cron jobs) located within web application log directories (e.g., JBoss, Tomcat, Wildfly) that exhibit behavior consistent with malicious file reinjection. This rule correlates suspicious cron activity with recurring modifications to sensitive web files (e.g., JS bundles, checkout pages), indicating persistent skimmer activity that survives redeployment.
This rule detects scenarios where an AI agent executes shell commands or system-level tools immediately after receiving a prompt injection attack from an untrusted source. It correlates agent audit logs—specifically identifying tool calls flagged for prompt injection—with actual endpoint process creation events. It flags process execution as 'High' severity if the command line matches common malicious patterns like encoded commands, IEX, or attempts to access credential material (e.g., lsass, mimikatz).
This rule detects scenarios where an AI agent executes shell commands or system-level tools immediately after receiving a prompt injection attack from an untrusted source. It correlates agent audit logs—specifically identifying tool calls flagged for prompt injection—with actual endpoint process creation events. It flags process execution as 'High' severity if the command line matches common malicious patterns like encoded commands, IEX, or attempts to access credential material (e.g., lsass, mimikatz).
Detects malformed HEIF/HEIC image files with anomalous ftyp/box structure consistent with the libheif memory corruption exploit (CVE-2026-32882) used against Discourse forum image upload endpoints
Detects malformed HEIF/HEIC image files with anomalous ftyp/box structure consistent with the libheif memory corruption exploit (CVE-2026-32882) used against Discourse forum image upload endpoints
Page 19 of 52