Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This detection rule identifies network activity associated with the Torg Grabber infostealer. It specifically looks for connections to known command and control (C2) domains and specific URL paths used by the malware for authentication, data upload, or core functionality. The rule leverages network proxy, firewall, or Zeek HTTP logs to extract and analyze URLs. A match indicates a strong reason to investigate the affected host and user, check for expected access, and review nearby activity for further compromise.
Detects HTTP GET requests to the vulnerable Citrix NetScaler /wsfed/passive?wctx endpoint, specifically looking for the malformed query string used in CVE-2026-3055 exploitation where 'wctx' is present without an associated value or '=' symbol. This rule combines common network appliance and web server logs to identify potential exploit attempts.
Detects Palo Alto Networks firewall traffic that was allowed despite the destination/source IP being flagged as malicious by Google Cloud Threat Intelligence (GCTI).
This detection rule identifies network traffic associated with the Powercat malware campaign by looking for specific URL patterns or domains mentioned in threat intelligence. It focuses on high-confidence indicators such as 'powercat.dog/(cool|watermelon5)' or 'ce953a0eb08246617b7f849486c4b26a7af37e9d2e8f0e13b3ae1bf0da8a70a.xyz' within network proxy, traffic, or HTTP logs. A match indicates potential communication with Powercat command and control infrastructure or distribution points, warranting further investigation into the source and destination IPs, URLs, and surrounding network activity.
Detects suspicious WebLogic HTTP requests with command execution indicators, specifically targeting known WebLogic endpoints and looking for patterns indicative of Remote Code Execution (RCE) payloads. The rule also correlates this activity with external IP addresses.
Detects exploitation attempts against Oracle WebLogic via suspicious HTTP requests and command execution patterns. The rule identifies WebLogic-specific endpoints combined with RCE payload indicators such as cmd, bash, powershell, wget, curl, or encoded payloads within the URI query.
Detects HTTP POST requests targeting the Langflow public flow build endpoint, which is vulnerable to unauthenticated Remote Code Execution (CVE-2026-33017).
Detects web requests to Cloudflare workers.dev subdomains containing specific keywords commonly used in the EvilTokens device code phishing campaign. The rule specifically looks for a pattern like '[lure-type]-[3char-id].[username]-[domain]...workers.dev' to identify malicious URLs.
Identifies web requests to commonly abused PaaS platforms (Cloudflare Workers, Vercel, AWS Amplify) or the Microsoft device login endpoint.
This rule acts as a base to identify specific events for downstream correlation. To properly detect a device code phishing sequence (such as EvilTokens), correlate a PaaS access event followed by a device login event from the same Source IP within a 5-minute window.
This rule acts as a base to identify specific events for downstream correlation. To properly detect a device code phishing sequence (such as EvilTokens), correlate a PaaS access event followed by a device login event from the same Source IP within a 5-minute window.
Detects outbound HTTP POST requests containing the specific custom header 'X-Filename: tpcp.tar.gz'. This custom header is used by the TeamPCP credential harvester to exfiltrate collected sensitive credentials (cloud, database, SSH, Kubernetes) to an attacker-controlled server following the compromise of the litellm PyPI package.
This rule detects network communication (DNS queries, HTTP requests, or network connections) to the command and control (C2) domain 'checkmarx.zone', which is associated with the TeamPCP threat group. This activity indicates potential compromise or communication with adversary infrastructure.
This rule detects network connections to suspicious domains or IP addresses associated with potentially compromised or malicious VPN infrastructure. Specifically, it looks for connections to 'vpn-fortinet.com', 'ivanti-vpn.org', 'forticlient-vpn.de', or the IP address '194.76.226.93'. These indicators may suggest attempts to establish command and control, exfiltrate data, or engage in other malicious activities via compromised VPN services.
Identifies suspicious URI request patterns potentially indicative of CVE-2026-4681 exploitation attempts against PTC PLM solutions. This rule looks for these specific patterns within web traffic logs from various sources (access logs, IIS, Apache).
This rule detects network connections or DNS queries to a specific Internet Computer Protocol (ICP) domain and canister ID (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io or tdtqy-oyaaa-aaaae-af2dq-cai). This pattern is associated with command and control (C2) activity, where compromised systems communicate with an adversary-controlled server.
This rule detects an inbound HTTP POST request targeting the Langflow AI pipeline application, specifically looking for attempts to exploit CVE-2026-33017. The detection logic focuses on specific URI paths and keywords within the HTTP request body that indicate an attempt to inject code, such as 'import '.
Detects User-Agent rotation behavior from a single Source IP (c-ip) associated with more than 3 distinct
User-Agent (c-useragent) values within a 5-minute window. This behavior is characteristic of the Nuclei
'-random-agent' flag, which allows the scanner to bypass WAF (Web Application Firewall) detections by
using a different, valid browser User-Agent string for each request.
User-Agent (c-useragent) values within a 5-minute window. This behavior is characteristic of the Nuclei
'-random-agent' flag, which allows the scanner to bypass WAF (Web Application Firewall) detections by
using a different, valid browser User-Agent string for each request.
This rule detects an inbound HTTP POST request targeting the Langflow AI pipeline application, specifically looking for attempts to exploit CVE-2026-33017. The detection logic focuses on specific URI paths and keywords within the HTTP request body that indicate an attempt to inject code, such as 'import '.
Detects outbound network connections to the known typosquatted C2 domain (`scan.aquasecurtiy.org`) or associated IP address (`45.148.10.212`) used by the TeamPCP threat actor. This infrastructure was utilized during the Trivy supply chain attack for exfiltrating stolen SSH keys, cloud credentials, and CI/CD secrets.
Detects HTTP POST requests targeting the Langflow public flow build endpoint, which is vulnerable to unauthenticated Remote Code Execution (CVE-2026-33017).
Detects outbound web requests to the Anthropic API containing the specific beta header required to upload files. This can be abused by attackers to exfiltrate sensitive data from the Claude sandbox to an attacker-controlled Anthropic account.
Detects access to the claude.com open redirect endpoint pointing to external domains. Attackers can abuse this trusted domain to bypass ad validation and email filters to deliver malicious payloads, such as prompt injections.
Page 257 of 312