Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule set detects various stages of the OysterLoader malware activity, including its registration and login attempts to a command and control (C2) server, specific C2 communication patterns via HTTP URIs, and connections to known OysterLoader C2 domains and IP addresses. The rules look for specific HTTP URI paths like "/reg" and "/login" combined with distinct User-Agent strings ("WordPressAgent" and "FingerPrint"), as well as specific API paths under "/api/" and hardcoded C2 domains and IP addresses.
This detection identifies network connections from non-browser processes to known Large Language Model (LLM) API endpoints. While some connections may be legitimate developer or application traffic, unexpected processes connecting to these services could indicate unauthorized data exfiltration, corporate espionage, or misuse of AI services.
Identifies network connections or DNS queries to known phishing domains mimicking Windows 11 update sites, which are used to distribute infostealer malware. These domains are highly specific to this campaign.
Detects HTTP requests to vulnerable Ivanti EPMM endpoints containing URI patterns associated with active exploitation of CVE-2026-1281 and CVE-2026-1340. The rule looks for specific URI paths and the presence of a 'gPath' parameter, which is indicative of an exploitation attempt.
Detects outbound network connections to known Command and Control (C2) domains and IPs associated with the TrustConnect and DocConnect malware infrastructure.
This rule detects inbound SSH connections originating from external IP addresses to systems running SSH services. It specifically looks for successful incoming network connections where the destination port is commonly associated with SSH (22, 222, 2222, 8022) or the source process name is an SSH daemon (sshd, dropbear). The rule explicitly excludes connections from private IP ranges and certain common web server processes on standard web ports to reduce false positives. The threat model includes unauthorized external SSH access, brute-force/credential-stuffing attacks, backdoor SSH daemons, compromised servers accepting attacker sessions, and reverse shell callbacks.
This rule detects HTTP network connections to the Telegram bot API (api.telegram.org/bot). This pattern is often associated with infostealers exfiltrating data to attacker-controlled Telegram bots. The rule specifically looks for the 'NETWORK_HTTP' event type and a URL containing '/api.telegram.org/bot' (case-insensitive).
Detects potential reverse shell activity originating from a Grandstream VoIP device. This is a high-fidelity indicator of compromise following the successful exploitation of CVE-2026-2329. This version uses DeviceNetworkEvents.
Detects exploitation attempts of CVE-2026-22769 by identifying PUT requests directed at the Tomcat Manager application deployment endpoint. This is used by UNC6201 to deploy malicious WAR files containing the SLAYSTYLE webshell.
This rule detects attempts to exploit Ivanti EPMM vulnerabilities CVE-2025-4427 and CVE-2025-4428. The first signature identifies requests to the '/api/v2/featureusage' endpoint containing patterns indicative of remote code execution (e.g., '${', 'Runtime', 'getRuntime', 'exec'). The second signature detects requests for a '.jsp' file named '403', which could indicate a backdoor or web shell deployment post-exploitation.
Detects HTTP GET requests to Ivanti EPMM endpoints containing the 'gPath' parameter, which is indicative of exploitation attempts against CVE-2026-1281 and CVE-2026-1340.
Detects outgoing network connections using the User-Agent 'ArkanixStealer/1.0', which is hardcoded in the C++ variant of the Arkanix Stealer.
This rule detects HTTP requests for 'install.sh' from the domains 'clawd.bot' or 'openclaw.ai'. These domains are associated with the OpenClaw/Clawd malware, indicating an attempt to download a malicious installation script.
Automate daily manual monitoring of Firewall changes that are performed by the Security Engineer. Additionally, this can be fine-tuned (more on that on next upcoming queries) into an automated rule such as Custom Detection Rule in Defender, Analytics Rule in Sentinel, or Saved Search with Alert Actions within Splunk (SPL) to detect potential changes by unknown authorized individual.
Detects a potential attempt to downgrade a password manager client's encryption to a legacy, non-authenticated mode (e.g., AES-CBC). A malicious or compromised server can send a specially crafted response during login or synchronization that forces the client to use weaker cryptography. This can compromise the integrity and confidentiality of the user's vault, enabling further attacks like vault modification or padding oracles.
Detects network connections or DNS queries to domains and IP addresses identified as payload delivery and C2 infrastructure for a JWrapper/SimpleHelp RAT campaign. Monitoring these indicators can help detect initial compromise or ongoing C2 communication.
There are operation activities that requires me to daily check whether the firewall backup happened as it should have every night after-hours. The issue is that this is a manual task, requires me to go to a specific directory, find the XML files that are by the firewall and open it up to see if the file will have content. We can also check by the file size without actually opening the file since sometimes the backup fails.
This rule set detects network communication associated with macOS infostealers, including C2 infrastructure, SHub stealer heartbeat and exfiltration, and ClickFix staging and landing pages. It identifies specific hostnames and URI paths used by these malicious campaigns.
ET TROJAN Microsoft ClickFix IOC IP
Detects a sequence of HTTP requests where the User-Agent shifts from 'WordPressAgent' to 'FingerPrint' within a short time window, a behavior associated with OysterLoader C2 registration and payload retrieval.
Detects successful VPN connections from various common security devices logging to CommonSecurityLog. Monitoring successful VPN logins is crucial for tracking remote access and identifying potential unauthorized access, especially when correlated with other events like logins from unusual locations or impossible travel scenarios.
Page 262 of 312