Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,084 detections
Filters
Last updated
All Time
Detection languages
418
193
163
156
81
Contributors
381
251
92
71
40
Categories
498
271
255
135
123
Platforms
443
441
267
121
114
Products / Services
10,665
9,773
6,704
4,421
3,749
1,084
MITRE Techniques
278
229
180
177
151
CVEs
17
15
13
13
8
IDS Classtypes
4
IDS Protocols
4
This rule detects administrative changes (create, update, delete) to Cloudflare DNS records, load balancer pools, or origin pools specifically associated with 'registry.coder.com', as well as anomalous login and API token activity on the Cloudflare account. Such activity may indicate unauthorized configuration tampering, potential account compromise, or malicious modifications to critical infrastructure endpoints.
Detects the presence of a specific sentinel string 'data.external.telemetry' within Terraform provisioner job logs, which indicates the execution of unauthorized data-collection logic within a compromised or backdoored Terraform module.
Detects the presence of PHP code execution patterns (eval, base64_decode, system, shell_exec) injected into Magento log or report files (var/report/, var/log/system.log), indicative of log poisoning used for web shell staging.
Detects text/report artifacts (markdown, JSON, plain text) produced by an autonomous AI-driven vulnerability research pipeline that decompiles binaries, traces cross-references, hypothesizes memory-safety flaws, and generates/debugs proof-of-concept exploits
Detects high-velocity, automated web activity originating from a single source IP that simultaneously performs widespread endpoint enumeration, tests sensitive authentication flows, and attempts common injection attack payloads. This behavior is indicative of an automated scanner, crawler, or malicious botnet agent performing rapid discovery and exploitation attempts.
Detects high-velocity, automated web activity originating from a single source IP that simultaneously performs widespread endpoint enumeration, tests sensitive authentication flows, and attempts common injection attack payloads. This behavior is indicative of an automated scanner, crawler, or malicious botnet agent performing rapid discovery and exploitation attempts.
Detects high-velocity, automated web activity originating from a single source IP that simultaneously performs widespread endpoint enumeration, tests sensitive authentication flows, and attempts common injection attack payloads. This behavior is indicative of an automated scanner, crawler, or malicious botnet agent performing rapid discovery and exploitation attempts.
Detects high-frequency password reset or credential recovery attempts originating from a single source IP against multiple user accounts. This behavior is indicative of an automated enumeration or brute-force attack, potentially exploiting vulnerabilities such as the referenced CVE-2026-18963.
Detects high-frequency password reset or credential recovery attempts originating from a single source IP against multiple user accounts. This behavior is indicative of an automated enumeration or brute-force attack, potentially exploiting vulnerabilities such as the referenced CVE-2026-18963.
Detects a hardcoded PEM RSA public key embedded alongside JSCeal-specific compiled V8 bytecode obfuscation artifacts, used to encrypt exfiltrated data or C2 communications
Detects HTML content that mimics Cloudflare CAPTCHA challenges to perform social engineering (ClickFix). The rule specifically identifies the combination of fake CAPTCHA UI text, connection to suspicious domains (DDR patterns), and JavaScript snippets used to fetch and execute secondary payloads or redirects.
Detects anomalous unauthenticated password reset requests targeting the Keycloak reset-credentials endpoint. The rule monitors for high-volume password reset attempts from single source IP addresses, specifically flagging those that target common administrative usernames or attempt to reset passwords across multiple distinct user accounts, which may indicate exploitation attempts (e.g., CVE-2026-18963).
This rule detects instances where a user account performs a password update without any preceding or associated account verification events (such as email verification, reset requests, or action execution) within a short timeframe. This behavior can be indicative of account compromise where an adversary modifies credentials for a compromised user account.
This rule detects instances where a user account performs a password update without any preceding or associated account verification events (such as email verification, reset requests, or action execution) within a short timeframe. This behavior can be indicative of account compromise where an adversary modifies credentials for a compromised user account.
Detects forged NDA documents used in Phantom Deal M&A fraud campaign, requiring co-occurrence of impersonated advisory firm branding, secrecy-clause language restricting communication to personal channels, and M&A-fraud-specific wire/payment indicators rather than secrecy-clause phrasing alone
Detects forged NDA documents used in Phantom Deal M&A fraud campaign, requiring co-occurrence of impersonated advisory firm branding, secrecy-clause language restricting communication to personal channels, and M&A-fraud-specific wire/payment indicators rather than secrecy-clause phrasing alone
Detects unauthenticated execution of sensitive Grafana MCP tools (tools/call, grafana_api_request) by identifying session IDs that lack a corresponding authenticated handshake event. This behavior is indicative of potential session spoofing or abuse of the MCP protocol where an attacker attempts to interact with privileged tools without performing a valid authentication handshake.
Detects incoming Grafana API requests directed at vulnerable mcp-grafana server instances identified by an outdated version (pre-1.1.0). This rule correlates host-level version discovery with application-layer logs containing suspicious 'grafana_api_request' method calls, which may indicate an attempt to exploit Server-Side Request Forgery (SSRF) vulnerabilities.
Detects instances where unauthenticated users or sessions execute privileged 'tools/call' operations within the Grafana MCP dispatcher. This behavior is indicative of potential session spoofing attacks, specifically targeting vulnerabilities similar to CVE-2026-19516, where lack of an Authorization header allows unauthorized access to privileged tool functions.
Detects instances of an mcp-grafana server responding with an HTTP 200 status code to a 'tools/call' request without an Authorization header, indicating potential unauthenticated remote tool execution on a vulnerable or misconfigured server.
Detects Server-Side Request Forgery (SSRF) attempts targeting vulnerable versions of Grafana MCP Server (versions < 1.1.0). The rule identifies requests attempting to access sensitive internal or cloud-metadata endpoints (e.g., 169.254.169.254, localhost, internal subnets) via the X-Grafana-URL header.
Page 29 of 52