Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,276 detections
Filters
Last updated
All Time
Detection languages
3,348
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,034
2,545
1,076
1,051
932
Platforms
39,970
7,276
6,539
3,868
3,652
Products / Services
1,331
1,114
992
658
494
MITRE Techniques
2,273
1,337
1,319
905
886
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects Jellyfin's automated ffprobe media scan pipeline spawning suspicious network-related shell commands. This indicates active exploitation of the PixelSmash vulnerability (CVE-2026-8461) via zero-click library scans.
This rule detects crashes in Nginx worker processes, specifically looking for messages indicating a 'signal 11' or 'SIGSEGV' error. This could be indicative of a vulnerability being exploited (e.g., CVE-2026-42945) or other critical software malfunctions.
Detects Jellyfin's automatic library scan invoking ffprobe with the characteristic command-line fingerprint associated with CVE-2026-8461 exploitation. The MagicYUV heap OOB write fires during metadata extraction of crafted AVI/MKV/MOV files, potentially achieving RCE as the jellyfin service user (uid=115).
This rule detects potentially malicious Wi-Fi network enumeration or profile creation using 'netsh' or 'nmcli', as well as the loading of 'wlanapi.dll' by non-standard, unauthorized processes. Such activities can indicate an attempt by an adversary to discover, connect to, or exfiltrate data via nearby wireless networks.
Detects high-volume SSH or network logon failures from a single source IP address within a short time window, indicative of a brute force attack. The rule specifically mentions consistency with 'mpbrute2.bin' tooling used in the 'FortiBleed' campaign.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
IoT botnet malware family used for DDoS and proxy infrastructure
Loader used in click-hijacking traffic distribution scheme
Infostealer distributed via fake open-source tool impersonation sites
Infostealer distributed via fake open-source tool impersonation sites
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
IoT botnet malware family used for DDoS and proxy infrastructure
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
MINIRAT C2Beacon
YARA
Lightweight remote access trojan deployed in recruiter-themed social engineering
Photo-themed ZIP phishing campaign dropping a Node.js implant
IoT botnet malware family used for DDoS and proxy infrastructure
Photo-themed ZIP phishing campaign dropping a Node.js implant
IoT botnet malware family used for DDoS and proxy infrastructure
Cloud extortion group exploiting exposed credentials and storage
Fraud framework powering scam domains for crypto and gambling schemes
AI-powered phishing-as-a-service abusing device-code authentication
Page 228 of 347