Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,535 detections
Filters
Last updated
All Time
Detection languages
3,970
998
596
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,931
2,196
2,017
1,857
1,411
Platforms
39,934
7,265
6,535
3,866
3,645
Products / Services
4,107
2,418
1,585
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
ET WEB_SPECIFIC_APPS IPFire firewalllogip.dat pienumber Parameter Cross Site Scripting Attempt (CVE-2025-34307)
ET WEB_SPECIFIC_APPS Tenda VirtualSer page Parameter Buffer Overflow Attempt (CVE-2025-12265)
ET WEB_SPECIFIC_APPS ASMAX CGI script system Parameter Command Injection Attempt (CVE-2009-5156)
ET WEB_SPECIFIC_APPS TVT queryDevInfo Information Disclosure (CVE-2024-7339)
ET WEB_SPECIFIC_APPS Tenda SetFirewallCfg firewallEn Parameter Buffer Overflow Attempt (CVE-2025-8810, CVE-2025-29358, CVE-2025-1851, CVE-2024-2809)
ET WEB_SPECIFIC_APPS D-Link SetWifiDownSettings Multiple XML Tags Buffer Overflow Attempt (CVE-2023-43235)
ET WEB_SPECIFIC_APPS Tenda addressNat Multiple Parameters Buffer Overflow Attempt (CVE-2025-12272)
ET MALWARE TA569 Gholoader CnC Domain in TLS SNI (secure .kasindramaharaj .com)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (sessionstorexint .com)
ET MALWARE TA569 Middleware Server Domain in TLS SNI (parserapiprocess .com)
ET MALWARE Observed DNS Query to Malicious Domain (significant-adopted-bearing-own .trycloudflare .com)
ET INFO Observed RMM Domain (meshcentral .com in TLS SNI)
ET INFO DYNAMIC_DNS HTTP Request to a *.freeddns .tokyo domain
ET INFO DYNAMIC_DNS HTTP Request to a *.itafricagroup .com domain
ET INFO DYNAMIC_DNS HTTP Request to a *.3trust .com domain
ET INFO Blockchain RPC Domain in DNS Lookup (rpc .ftm .tools)
ET INFO Blockchain RPC Domain in DNS Lookup (arbitrum .one)
ET ATTACK_RESPONSE ClickFix Related Payload Inbound
ET ATTACK_RESPONSE ClickFix Webpage Inbound
ET ATTACK_RESPONSE Koi Loader/Stealer Payload Inbound
ET ATTACK_RESPONSE PowerShell String Base64 Encoded Text.Encoding (ZXh0LkVuY29k) in DNS TXT Reponse
Page 276 of 312