Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,535 detections
Filters
Last updated
All Time
Detection languages
3,970
998
596
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,931
2,196
2,017
1,857
1,411
Platforms
39,934
7,265
6,535
3,865
3,645
Products / Services
4,107
2,418
1,585
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule detects communication with known malicious domains and IP addresses, as well as the presence or execution of files with known malicious MD5 or SHA256 hashes. It correlates threat intelligence with network and endpoint telemetry to identify compromised devices or accounts.
This rule detects GlobalProtect VPN login attempts originating from outside of Canada. This can help identify potential unauthorized access or policy violations where users are expected to connect from specific geographic regions.
This rule detects attempts to exploit known CVEs on the network where the targeted device is identified as vulnerable to that specific CVE. It correlates network inspection signatures with vulnerability management data to identify high-confidence exploitation attempts.
This analytic detects activity associated with "Static Tundra" threat actor abuse of the Cisco Smart Install (SMI) protocol using Cisco Secure Firewall Intrusion Events. It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify occurrences of Smart Install exploitation and protocol abuse, including denial-of-service and buffer overflow attempts. The detection triggers when multiple Cisco Smart Install-related Snort signatures are observed in a short period from the same source, which is indicative of active exploitation or reconnaissance against Cisco devices that expose SMI.
This detection rule identifies potential exploitation attempts of CVE-2024-36401, a JXPath injection vulnerability in GeoServer. Attackers can send malicious WFS, WMS, or WPS requests to achieve remote code execution. The rule looks for common GeoServer service paths and request types combined with Java code execution strings in web server or network logs.
This analytic identifies instances where an internal host has attempted to communicate with 250 or more destination IP addresses using the same port and protocol. Horizontal port scans from internal hosts can indicate reconnaissance or scanning activities, potentially signaling malicious intent or misconfiguration. By monitoring network traffic logs, this detection helps detect and respond to such behavior promptly, enhancing network security and preventing potential threats.
This analytic identifies instances where an internal host has attempted to communicate with 250 or more destination IP addresses using one of the NMAP top 20 ports. Horizontal port scans from internal hosts can indicate reconnaissance or scanning activities, potentially signaling malicious intent or misconfiguration. By monitoring network traffic logs, this detection helps detect and respond to such behavior promptly, enhancing network security and preventing potential threats.
Detects potential Remote Code Execution (RCE) on a FortiWeb device, possibly related to CVE-2025-25257. The rule correlates a suspicious web request to a potential 'fabric' endpoint with a subsequent shell or utility process launch by the web server process on the same device.
Detects attempts to exploit FortiWeb Pre-Auth SQL Injection leading to Remote Code Execution (CVE-2025-25257) via the /api/fabric/device/status endpoint. The rule specifically looks for SQL injection payloads, including boolean-based and INTO OUTFILE techniques, within the Authorization header of HTTP requests.
Detects attempts to exploit a remote code execution vulnerability (CVE-2024-36401) in GeoServer. Attackers leverage crafted JXPath queries in WFS, WMS, or WPS requests to execute arbitrary commands via Java's getRuntime().exec() method.
Detects potential exploitation attempts against Ivanti Connect Secure devices for vulnerability CVE-2025-22457. This vulnerability is actively exploited in the wild. Attackers can send an abnormally long string composed of digits and periods in the 'X-Forwarded-For' HTTP header to trigger a stack-based buffer overflow, which can lead to remote code execution.
Detects potential exploitation of FortiWeb CVE-2025-25257, a pre-authentication SQL injection vulnerability. This rule identifies an SQL injection attempt against the '/api/fabric/device/status' endpoint, followed by either a suspicious Python file drop in a library directory or a request to a specific CGI script used to trigger the payload.
Detects various Indicators of Compromise (IOCs) associated with UAT-7237 activity, including file hashes, IP addresses, domains, and URLs. This rule identifies suspicious process executions based on known malicious file hashes and network connections to malicious IP addresses or URLs.
Detects network traffic associated with the Tycoon and ODx phishing kits, which are used in Attacker-in-the-Middle (AiTM) phishing campaigns to bypass MFA. The rule identifies connections to known malicious domains, IP addresses, and specific URLs used by these kits.
This rule detects successful network connections from external (internet) IP addresses to common Industrial Control System (ICS) ports, such as Modbus (502) and EtherNet/IP (44818). This activity could indicate unauthorized access attempts, reconnaissance, or exploitation of internet-exposed ICS assets. The rule specifically filters for allowed/accepted/permitted connections and excludes connections from RFC 1918 private IP addresses and a configurable list of authorized external IPs.
Detects attempts to modify Programmable Logic Controller (PLC) ladder logic or firmware. Such modifications can indicate a high-impact attack aimed at disrupting physical processes, damaging equipment, or establishing persistence within the Operational Technology (OT) network.
This rule consolidates multiple detections related to a widespread malspam campaign delivering the Nova infostealer. It hunts for activity across email, network, DNS, and firewall logs associated with known malicious domains, IPs, and specific TTPs like suspicious archive attachments from impersonated brands.
Detects network traffic to an ERMAC banking trojan exfiltration server by identifying a unique 'WWW-Authenticate' header in the HTTP response. This indicates a client device is communicating with a known ERMAC command and control server for data exfiltration.
This rule identifies a source IP address that is triggering a variety of Akamai WAF rules across multiple hosts, which is indicative of broad scanning or reconnaissance activity. It aggregates events by source IP within 30-minute windows, counting distinct WAF rules and hosts targeted. The rule then applies thresholds to identify suspicious behavior, specifically looking for an IP that triggers more than 5 distinct WAF rules, targets more than 2 distinct hosts, and generates over 10 denied events.
Detects attempts to exploit CVE-2025-32433, a remote code execution vulnerability in the Erlang/OTP SSH daemon. The exploit involves sending SSH connection protocol messages (codes >= 80) before authentication is complete.
Detects DNS queries for domains known to be used by the DarkCloud campaign for payload delivery and C2 communication. This rule specifically targets domains used for initial payload download, final payload delivery, and public IP address determination.
Page 291 of 312