Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,421 detections
Filters
Last updated
All Time
Detection languages
4,217
105
40
25
13
Contributors
1,327
1,003
725
627
332
Categories
2,253
2,239
1,434
1,144
973
Platforms
4,107
453
295
83
82
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
886
774
552
505
456
CVEs
18
12
12
12
10
IDS Classtypes
1,868
466
446
362
230
IDS Protocols
2,366
846
388
301
93
This rule detects HTTP traffic originating from a client within the home network to an external Cloudflare tunneling service (specifically, domains ending in '.trycloudflare.com') where the User-Agent header indicates 'Microsoft-WebDAV-MiniRedir'. This combination suggests potential command and control activity or data exfiltration using WebDAV over a Cloudflare tunnel, often employed by adversaries to bypass network restrictions and obscure their infrastructure.
This rule detects attempts to retrieve PowerShell scripts (.ps1) from an external server using WebDAV (PROPFIND method) with a 'Microsoft-WebDAV-MiniRedir/' user agent. This activity is often associated with adversaries attempting to transfer tools or malicious scripts into a compromised environment.
ET MALWARE TA569 Gholoader CnC Domain in DNS Lookup (secure .kasindramaharaj .com)
This rule detects attempts to exploit CVE-2021-20021, an unauthenticated arbitrary user creation vulnerability in SonicWall Email Security. The rule specifically looks for HTTP POST requests to the '/createou' URI with 'data=' in the request body, indicating an attempt to create a new organizational unit or user.
ET INFO Observed RMM Domain in DNS Lookup (meshcentral .com)
ET INFO Remote Monitoring and Management (RMM) Tool in DNS Lookup (gorelo .tech)
This rule detects the 'Get-ScheduledTask' PowerShell cmdlet within the HTTP response body, specifically when the HTTP status code is 200. This could indicate an attacker enumerating scheduled tasks on a compromised system via a web-based command and control channel or data exfiltration.
ET MOBILE_MALWARE Android/TrickMo.Banker GET Config Request
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (virtvan .com)
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (V4dC5FbmNvZ) in DNS TXT Reponse
This rule detects HTTP POST requests to github.com's /login/device/code endpoint containing a 'client_id=' parameter in the request body. This pattern is indicative of a device code authentication flow, which could be leveraged in phishing attacks (device code phishing) to steal application access tokens or facilitate unauthorized access to GitHub accounts.
ET WEB_SPECIFIC_APPS Django Privilege Escalation via SQLi (CVE-2025-64459)
ET WEB_SPECIFIC_APPS Django Authentication Bypass via SQLi (CVE-2025-64459)
ET WEB_SPECIFIC_APPS Wordpress Post SMTP Plugin Unauthenticated Account Takeover via Email Log Disclosure (CVE-2025-11833)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (sessionstorexint .com)
ET ATTACK_RESPONSE ClickFix MSHTA Command Inbound
ET WEB_SPECIFIC_APPS Django Data Exfiltration via SQLi (CVE-2025-64459)
ET WEB_SPECIFIC_APPS Nagios Log Server API Unauthorized Access to Elasticsearch Service (CVE-2025-44824)
ET MALWARE TA569 Middleware Server Domain in DNS Lookup (taskrunnersrvmod .com)
ET INFO Remote Monitoring and Management (RMM) Tool in TLS SNI (gorelo-rmm .azurewebsites .net)
This rule detects attempts to exploit a deserialization vulnerability (CVE-2018-8421) in Microsoft SharePoint via a crafted workflow. The detection specifically looks for HTTP POST requests to the `/_vti_bin/webpartpages.asmx` endpoint containing `ValidateWorkflowMarkupAndCreateSupportObjects` and `workflowMarkupText` with CDATA, indicating an attempt to inject malicious XML.
Page 194 of 211