Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects DNS lookups and outbound network connections to known command and control (C2) and staging domains associated with the STAC4924 campaign. The rule performs strict matching on domain names to ensure that subdomains are identified while avoiding false positives from partial string matches within URLs.
Detects network connection attempts by known AI agent or development-related runtime processes (python, node, etc.) to external endpoints that are not contained within a defined allowlist of LLM and infrastructure providers. This is intended to identify potential data exfiltration or unauthorized command and control communication originating from LLM-powered applications.
This rule detects known malicious activity including network connections to a specific C2 IP address (69.48.229.140), downloading files from specific C2 URLs, the presence of known malicious file hashes (SHA256), and communications involving specific actor-associated email addresses.
Detects a specific multi-stage exfiltration pattern characterized by initial reconnaissance/fingerprinting probes against sensitive service endpoints (/health, /docs, /openapi.json) followed by unauthorized access to artifact storage endpoints (/files or /file?name=) from the same device against the same host within a short timeframe.
Detects a potential web shell deployment by identifying a web server process creating or modifying a file in common web directory locations, followed shortly (within 10 minutes) by the execution of that same file.
Detects execution of shell commands containing obfuscated patterns (such as base64 decoding, hex character sequences, or piped commands) when spawned by core Citrix NetScaler service processes (nsppe, httpd, or nsaaad). This behavior is often indicative of exploitation attempts or post-exploitation activities on network appliances.
Detects unauthorized access to or generation of Citrix NetScaler core dump files, trace outputs, or memory diagnostic artifacts. These artifacts are high-value targets for attackers, such as those exploiting CVE-2026-88772, who attempt to extract session tokens, credentials, and sensitive data residing in memory via these diagnostic mechanisms.
Detects command-line activity attempting to disable, unbind, or remove NetScaler AppFW (Web Application Firewall) profiles, signatures, or security policies. This activity is indicative of defense evasion following the exploitation of CVE-2026-88771 or CVE-2026-88772 to suppress security alerting on follow-on malicious activity.
Detects high volumes of DTLS/UDP session-initiation traffic targeting NetScaler VPN virtual servers that are immediately followed by appliance-level error logs or crashes. This behavior is indicative of active probing or exploitation attempts, such as those associated with CVE-2026-88772, where malicious payloads cause service instability.
Detects web server processes (e.g., IIS w3wp.exe, Apache, Nginx, PHP-FPM) spawning suspicious child processes such as command shells (cmd, powershell, bash, sh), network utilities (curl, wget), or interpreters (python, perl). This behavior is strongly indicative of exploitation of a public-facing web application and the subsequent execution of a webshell or post-exploitation command activity.
Detects DNS resolution attempts for newly registered or suspicious top-level domains (e.g., .xyz, .top, .live) that mimic corporate Identity Provider (IdP) or Single Sign-On (SSO) login portals. This behavior is characteristic of Adversary-in-the-Middle (AiTM) phishing kits like EvilProxy or Tycoon2FA, intended to capture user session tokens. Note: This rule monitors for initial domain contact and should be correlated with subsequent authentication logs to identify potential session hijacking.
Detects git checkout of a bare 40-hex commit SHA or the literal FETCH_HEAD ref, executed by a recognized AI coding-agent process. Narrowed to the Plugin4Shell exploitation fingerprint (checkout of a pinned-SHA-shaped or FETCH_HEAD ref) rather than ordinary branch/tag checkouts, which these agents perform constantly during normal plugin installs.
This rule detects a high frequency of SMB (port 445) connection attempts from a single internal source host to a large number of distinct internal destination hosts within a short timespan. This activity is indicative of internal network scanning, host discovery, or automated lateral movement attempts using SMB.
Detects unauthorized attempts to access the Ray Dashboard Job Submission API, which is vulnerable to remote code execution (CVE-2023-48022). Attackers can leverage this API endpoint to execute arbitrary commands on the Ray cluster.
Detects unauthorized or external access attempts to the Ollama LLM API service (TCP port 11434). The rule specifically flags POST requests targeting the /api/generate or /api/chat endpoints, which are commonly exposed via misconfiguration or lack of authentication, potentially allowing remote command execution or model exploitation.
This rule identifies installations of TeamViewer software that are vulnerable to specific CVEs (CVE-2026-19743, CVE-2026-92368, CVE-2026-92369, CVE-2026-92370, CVE-2026-92371) by analyzing the 'DeviceTvmSoftwareInventory' dataset. It checks for versioning patterns against known vulnerable build numbers across Windows, Linux, and macOS platforms to pinpoint systems requiring patching.
Detects the PoeLLM ELF payload (masquerading as libgcrypt) via Italian-language poem/agent log strings and embedded LiteLLM MCP exploit strings
This rule monitors network traffic, DNS queries, and user web clicks to detect interactions with known malicious domains associated with credential harvesting and phishing campaigns, specifically those impersonating security or SSO portals.
Detects command-line activity attempting to disable, unbind, or remove NetScaler AppFW (Web Application Firewall) profiles, signatures, or security policies. This activity is indicative of defense evasion following the exploitation of CVE-2026-88771 or CVE-2026-88772 to suppress security alerting on follow-on malicious activity.
Detects anomalous lateral movement behavior where a successful NetScaler VPN or gateway session is followed immediately by internal remote service logons (RDP, SSH, WinRM) or network connections from the same source IP. This pattern is indicative of potential exploitation of Citrix NetScaler vulnerabilities (e.g., CVE-2026-88771, CVE-2026-88772) or credential abuse to move laterally into the internal environment.
Detects the installation or execution of known MALFEX malicious packages via npm or Node.js, which are used as entry points for polyglot or disguised payload delivery.
Page 25 of 347