Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
Detects potential exploitation of Apache bRPC command injection vulnerability (CVE-2025-60021) via the /pprof/heap endpoint.
Detects an unusual exfiltration technique where a URL, typically from temp.sh, is embedded within the User-Agent string of an HTTP request. This TTP was observed in the Notepad++ supply chain attack in 2025 for exfiltrating system information.
ET PHISHING Microsoft ClickFix Landing Domain
Detects when a Network Attached Storage (NAS) or Internet of Things (IoT) device establishes multiple or high-volume outbound SSH/SFTP connections to an external IP address. This behavior can indicate that the device has been compromised and is being used as an 'Operational Relay Box' (ORB) to proxy malicious traffic, mask C2 communications, or exfiltrate data.
Detects network traffic on TCP port 18789, the default gateway port for OpenClaw. Monitoring for unauthorized external access to this port helps identify exposed admin dashboards or exploitation.
ET PHISHING Microsoft ClickFix Landing Domain
Detects HTTP requests containing the specific parameter 'k0f53cf964d387' in the query string or POST body. This parameter is the unique trigger used to activate the dormant 'base.Info' in-memory loader on vulnerable Ivanti EPMM instances.
Detects network connections to or from a known malicious Command and Control (C2) IP address (91.92.242.30) associated with malicious OpenClaw/ClawdBot skills.
This detection monitors for web requests to the specific URI path "/mifs/403.jsp". This path is known to be used by attackers to deploy a dormant Java-based webshell ("sleeper shell") on vulnerable Ivanti Endpoint Manager Mobile (EPMM) instances as part of an initial access campaign.
Detects network traffic matching patterns associated with ModeloRAT C2 communication, such as connections to known C2 IPs or the use of a specific beaconing URI.
Detects network connections to the typosquatted domain nexsnield.com, which is used by the malicious uBlock Origin Lite extension to track installations and correlate activity.
Detects potential exploitation of CVE-2026-25253, a 1-click RCE in OpenClaw, by identifying the 'gatewayUrl' query parameter in HTTP traffic. This parameter is used to hijack authentication tokens.
Detects network connections to known Command and Control (C2) infrastructure (domain or IP) associated with the Chrysalis backdoor, used in the Notepad++ supply chain attack.
Detects HTTP POST requests to n8n webhook endpoints containing patterns associated with CVE-2026-25049, a type confusion vulnerability leading to Remote Code Execution. The detection looks for specific JavaScript destructuring or property access patterns used to bypass sanitization.
This rule detects configuration changes to Fortinet FortiGate firewall policies that occur outside of standard business hours (before 8 AM or after 5 PM NZDT). It specifically looks for actions like 'Move', 'Add', 'Enable', 'Delete', or 'Edit' on firewall policies. This can indicate unauthorized access or malicious activity, as legitimate changes are typically performed during business hours.
The rule is designed to detect suspicious activities associated with Remote Monitoring and Management (RMM) tools by analyzing processes, file signatures, network connections, and firewall logs linked to known RMM tools and domains. The rule is valid.
Detects the download of a file with a double extension (e.g., invoice.pdf.exe). This is a common technique used to disguise malicious files and trick users into executing them.
Detects the DKnife gateway-monitoring framework, a toolset used by China-nexus actors for adversary-in-the-middle (AitM) attacks, based on specific file, network, and persistence artifacts.
Silver Fox C2 Domains
YARA-L
Detects network connections to command-and-control (C2) domains associated with the Silver Fox APT group. These domains are used for initial payload delivery and ongoing C2 communication by the Valley RAT.
Detects HTTP requests where the User-Agent string contains a full URL pointing to 'temp.sh'. This technique was observed in the Notepad++ supply chain attack where attackers passed the URL of exfiltrated data back to their C2 server within the User-Agent header.
Apt28 Cloud Storage C2
YARA-L
Detects outbound network traffic to legitimate cloud storage domains (filen.io, icedrive.net, koofr.net) known to be abused by APT28 for Command and Control (C2) and data exfiltration as part of Operation Phantom Net Voxel.
Page 263 of 312