Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
Detects attempts to exploit an authentication bypass vulnerability in the Inetutils Telnet daemon. Attackers inject the '-f' flag into the 'USER' environment variable during Telnet negotiation to gain unauthorized shell access.
Detects ICMP Echo Request packets where the Identification field is set to the specific magic value 0xC0DE (49374). This value is used by the VoidLink rootkit as a trigger for its covert, out-of-band C2 channel, which can bypass standard firewall rules.
This rule detects an attempt to exploit an XML External Entity (XXE) vulnerability in GeoServer's Web Map Service (WMS) GetMap function. The detection logic looks for HTTP POST requests to the '/wms?' endpoint containing 'request=GetMap' in the URI, and specific XML elements like '<StyledLayerDescriptor>', '<!DOCTYPE', '<!ENTITY', and 'SYSTEM' within the request body, along with a URL-like pattern '://' indicating an attempt to fetch external content.
Detects specific User-Agent strings associated with the DDoSia malware, which is used by the NoName057(16) hacktivist group for DDoS attacks. The rule looks for two distinct User-Agent patterns in HTTP traffic.
This rule detects patterns indicative of an Evilginx-style Adversary-in-the-Middle (AiTM) phishing attack. It specifically looks for HTTP requests to hostnames ending in suspicious top-level domains (TLDs) such as .click, .online, .cloud, or .shop, combined with specific URI paths like /wlc/, /load/, or /success/. These patterns are commonly used by AiTM redirectors to capture credentials and session tokens.
This rule detects WebSocket C2 authentication attempts by the Frogblight mobile banking malware. It specifically looks for the hardcoded login key '{"login_key":"fg_a1b2c3d4e5f6"}' within TCP traffic destined for external networks.
This rule detects Command and Control (C2) communication associated with the Mythic C2 framework utilizing Server Message Block (SMB) for peer-to-peer (P2P) beaconing. It specifically looks for SMB_COM_WRITE_ANDX commands with a data size greater than 360 bytes, containing a specific null byte pattern at offset 86, and a PCRE match for a GUID-like string, which are indicators of Mythic C2 SMB P2P beacon traffic.
This rule detects command and control (C2) beaconing activity associated with the SHADOW-VOID-042 malware family. Specifically, it looks for HTTP POST requests containing the string "get_module_hello" in the request body, which is indicative of a C2 communication pattern used by this malware.
This rule detects DNS Command and Control (C2) activity associated with the Linux/BPFDoor malware. It specifically looks for DNS queries containing a magic value "X:" followed by a dot "." at the beginning of the query, indicating a potential C2 communication channel used by BPFDoor. The rule also includes a byte test to ensure the query length is greater than 20 bytes and a threshold to limit alerts to 3 occurrences within 300 seconds from the same source.
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
This rule detects a possible Remote Code Execution (RCE) attempt targeting a React application, specifically exploiting CVE-2025-55182. It looks for inbound HTTP POST requests containing 'child_process' and 'response' and 'Sync' in the request body, along with specific HTTP headers ('Next-Action', 'rsc-action-id', or 'text/x-component'). The presence of 'child_process' suggests an attempt to execute system commands.
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
This rule detects the download of Android Application Package (APK) files from Amazon S3 buckets, where the HTTP URI contains keywords related to gambling (slot, bet, play, jackpot). This activity is indicative of potential malware distribution, specifically targeting Android devices with gambling-themed applications, as observed in Indonesian gambling ecosystems.
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
This rule detects potential Browser-in-the-Browser (BITB) phishing attacks, specifically targeting the 'Sneaky2FA' technique. It looks for HTTP responses containing an iframe, base64 encoded image data, and the string ';base64,', which are indicators of a malicious page attempting to mimic a legitimate login portal within an iframe to steal credentials.
This rule detects HTTP GET requests containing specific URL patterns associated with Calisto phishing campaigns. The patterns include '/vendor/plugx/', '/wp-content/plugins/(bungs|areada|leykos)/', '/prueba/phantomrise/', or '/plugins/unite/', combined with the 'utm_refferer=' parameter in the URI. This indicates an attempt to redirect users to malicious content, likely as part of a phishing attack.
Detects HTTP requests attempting to exploit several IoT device vulnerabilities leveraged by the ShadowV2 botnet to spread. This rule looks for specific URI paths and command injection payloads associated with known CVEs.
This rule detects outbound HTTP traffic where the User-Agent header contains the string 'Internet Explorer'. This has been seen used by malware, and the legitimate Internet Explorer browser uses the User-Agent string "MSIE". The MSIE browser was end-of-lifed in 2022. The rule specifically looks for this pattern in established, to_server HTTP flows.
This rule detects command and control (C2) communication associated with the Lazarus Group's ScoringMathTea Remote Access Trojan (RAT). It specifically looks for HTTP traffic where the User-Agent header matches a known string used by this malware: 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/107.0.0.0 Safari/537.36 Edg/107.0.1418.42'. This User-Agent string attempts to masquerade as a legitimate Microsoft Edge browser.
Page 191 of 211