Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,960
7,270
6,537
3,867
3,651
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule detects DNS queries for domains that resemble update servers used in the SolarWinds supply chain attack. Specifically, it looks for DNS queries containing 'update' followed by 'solarwinds', 'orion', 'avupdate', or 'antivirus' in the domain name. This pattern was associated with the SUNBURST backdoor's communication with its command and control infrastructure.
This rule detects attempts to download typosquatted NPM packages from registry.npmjs.org. It specifically looks for HTTP requests to the NPM registry where the URI contains common typos of popular packages like 'lodash', 'requests', 'express', 'mongoose', and 'momentjs'. This indicates a potential supply chain attack where developers might accidentally download malicious packages due to a typo.
This rule detects HTTP responses containing JavaScript that attempts to redirect the user's browser to another page and executes code using 'eval()'. This combination is often used in malicious web pages to redirect users to exploit kits or phishing sites, and to obfuscate malicious JavaScript.
This rule detects HTTP responses from a web server to a client that contain JavaScript code attempting to redirect the user's browser. Specifically, it looks for the string "window.location.replace" within the HTTP response body (file.data) when the HTTP referer header indicates the request originated from Google or Bing search results. This pattern is often associated with content injection attacks where malicious code is injected into legitimate search results to redirect users to malicious sites.
This rule detects potential phishing attempts delivered via Slack messages. It triggers when HTTP traffic to 'slack.com' contains '/messages/' in the URI, indicating a Slack message context, and has a threshold of 5 occurrences within 60 seconds from the same source.
This rule detects Address Resolution Protocol (ARP) announcements from new or unknown devices on the network. Specifically, it looks for ARP packets with an opcode of '2', which signifies an ARP reply. The rule uses a threshold to trigger an alert if a new ARP reply is observed from a source within a 5-second window, indicating a potential new device joining the network or an attempt at ARP spoofing.
Detects exploitation attempts of the PAN-OS GlobalProtect authentication bypass vulnerability (CVE-2026-0257) by monitoring for specific Indicators of Compromise (IOCs) including source IPs, machine names, and MAC addresses.
This rule detects network connections to suspicious domains or IP addresses associated with potentially compromised or malicious VPN infrastructure. Specifically, it looks for connections to 'vpn-fortinet.com', 'ivanti-vpn.org', 'forticlient-vpn.de', or the IP address '194.76.226.93'. These indicators may suggest attempts to establish command and control, exfiltrate data, or engage in other malicious activities via compromised VPN services.
This rule detects a high volume of network connection retries (more than 500 within a one-minute window) to a distinct remote IP address. This behavior can be indicative of a network denial-of-service (DoS) attack, where an attacker attempts to overwhelm a target by repeatedly trying to establish connections.
Detects unusually large HTTP POST requests which may indicate data exfiltration activity over web protocols. The rule specifically looks for HTTP POST methods and is designed for Suricata, a network intrusion detection system.
This rule detects unusually long DNS queries (40 characters or more) which can be indicative of DNS tunneling. DNS tunneling is a technique used by adversaries for command and control (C2) communication or data exfiltration, where data is encoded within DNS queries and responses to bypass network security controls.
Detects possible TCP SYN port scanning activity by identifying a high volume of SYN packets from a single source within a short time window, which is commonly associated with reconnaissance tools like Nmap.
This rule detects outbound TCP connections on port 9050, which is commonly used by the Tor anonymity network. The rule is configured to trigger an alert if there are at least 3 such connections from the same source within a 60-second window, indicating potential use of Tor. The message suggests this activity is related to accessing an Initial Access Broker market.
This rule detects HTTP requests to known dedicated server rental providers (ovh.com, leaseweb.com, servermania.com) where the URI contains the word 'order'. This activity could indicate an adversary attempting to rent infrastructure for attack purposes, such as command and control servers, phishing sites, or other malicious operations.
This rule detects a drive-by download attempt initiated via a malicious advertisement. It specifically looks for HTTP responses to clients where the HTTP referer header contains common advertisement-related keywords (ad., ads., advert) and the response body contains the 'MZ' magic bytes, indicating an executable file download. This combination suggests a user was redirected from an advertisement to a site that then attempted to download an executable.
This rule detects Fast Flux DNS activity, characterized by rapid changes in IP addresses associated with the same domain within a short period. Specifically, it triggers an alert if 30 or more distinct IP addresses are observed for a single domain within a 10-second window, based on DNS queries. This behavior is often indicative of malware using fast flux techniques to evade detection and make takedowns more difficult.
This rule detects potential use of a compromised Virtual Private Server (VPS) as a proxy relay. It specifically looks for HTTP CONNECT requests, which are commonly used for tunneling traffic through a proxy. A threshold of 10 CONNECT requests within 60 seconds from a single source IP is set to identify suspicious activity, indicating a high volume of proxy usage.
This rule detects potential command and control (C2) communication originating from a compromised serverless function. It specifically looks for HTTP POST requests with a body size greater than 500 bytes, targeting domains associated with serverless platforms like Vercel (.vercel.app), Netlify (.netlify.app), and Cloudflare Pages (.pages.dev). A threshold of 10 such requests within 60 seconds from the same source IP triggers the alert, indicating a possible high-volume data exfiltration or C2 activity.
This rule detects a potential account takeover attempt via a credential stuffing attack. It specifically looks for HTTP POST requests to a URI containing 'login' (case-insensitive) from a single destination IP address, with a high frequency (50 requests within 60 seconds). This pattern suggests an automated attempt to try multiple credentials against a login endpoint.
This rule detects multiple login attempts to social media platforms (Twitter, X, Instagram, Facebook) from a single source IP address within a short timeframe. It specifically looks for HTTP POST requests to URIs containing 'login' on these domains. A threshold of 10 attempts within 30 seconds triggers the alert, indicating a potential brute-force or credential stuffing attack aimed at hijacking social media accounts.
This rule detects a brute-force attack against an IMAP email account. It triggers when a source IP attempts to connect to the IMAP port (993) on the home network 20 or more times within a 30-second window. This behavior is indicative of an attacker repeatedly trying different credentials to gain unauthorized access to an email account.
Page 236 of 312