Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
This rule detects an attempt to exploit CVE-2021-33045, an authentication bypass vulnerability in certain Dahua products. An attacker can bypass authentication by sending a crafted HTTP POST request to the application, specifically using a loopback authentication type with a local IP address (127.0.0.1) in the login payload.
Detects DNS queries to known malicious subdomains and direct TCP connections to an IP address associated with the SilkParasite, NodeEdgeRAT, and NomadRAT malware infrastructure. The rule specifically monitors for communication with identified C2 infrastructure hosts and legacy domain registration points.
Detects high-concurrency brute-force attempts against Dahua Easy4IP-enabled devices targeting port 37777, identified by specific binary patterns (opcode 0xA0) in the packet payload. This indicates an automated attempt to compromise device authentication.
This rule detects an attempted authentication bypass vulnerability (CVE-2021-33045) targeting Dahua NetKeyboard devices. The exploit involves a specific HTTP request structure to the 'global.login' endpoint, where the 'loginType' parameter is set to 'Loopback' and the 'ipAddr' is set to '127.0.0.1', attempting to leverage internal loopback logic to circumvent authentication mechanisms.
Detects outbound network traffic attempting to interact with a specific Polygon smart contract address using eth_call. This behavior is indicative of the EtherHiding technique, where adversaries leverage blockchain infrastructure as a dead-drop resolver for command-and-control (C2) operations to bypass traditional network defenses.
Detects rapid TCP connection attempts to port 445 (SMB) from a single source IP address, indicative of network scanning or reconnaissance activities typically used by the DragonForce ransomware or similar automated threats for lateral movement.
Detects outbound HTTP requests to 'relay.php' that include the 'X-Captcha-Track: 1' header, which serves as a telemetry beacon for the CRPx0 ClickFix social engineering campaign. This activity is indicative of a user interacting with a malicious webpage designed to trick them into executing harmful commands via copy-paste actions.
Detects outbound HTTP requests to the Telegram Bot API (/sendMessage) which are often used by malware (such as 'Exvicy' or 'Small Sieve') for command and control or exfiltration notification, utilizing the Telegram bot token structure in the URI.
Detects outbound network traffic from internal hosts directed toward identified Exvicy command-and-control (C2) infrastructure IP addresses. This includes both general beaconing attempts and established TLS handshake sessions potentially linked to post-ClickFix malicious activity.
Detects an attempt to exploit a directive injection vulnerability in the SharePoint 'WebPartPages.asmx' SOAP web service, specifically targeting the 'GetWebPartPageConnectionInfo' method. The rule looks for suspicious 'Register' directives in the request body, which could lead to unauthorized code execution or configuration manipulation.
Detects specific Cloudflare name server pairs ('randy.ns.cloudflare' and 'stevie.ns.cloudflare') in DNS responses. This pattern is associated with Exvicy domain management infrastructure, which has been identified as a component in adversary C2 and domain staging operations.
These rules detect various exploitation attempts targeting SharePoint to bypass SafeControls, an security mechanism used to restrict the types of controls allowed in web parts. The patterns match suspicious Register directives and markup injection techniques often associated with remote code execution or privilege escalation, as identified in CVE-2026-65660.
Detects HTTP POST requests directed to the '/api.php' endpoint with specific patterns characteristic of Exvicy/ClickFix malware C2 communication. The rule identifies suspicious action parameters (check, dl, or cb) and a specific 48-character hexadecimal 'k' parameter used for identifying infected state.
This rule detects a raw TCP authentication handshake associated with the VelvetCake malware family. It specifically monitors for established connections to a known malicious C2 IP address (111.92.246.145) over port 12345 containing the specific hardcoded 'PASSWORD' string used for initial communication.
Detects outbound network traffic from internal hosts to a domain associated with the VelvetCake fileless malware variant. The rule specifically looks for HTTP requests to 'p1o2i3u4y5t6r7e8w9q0.medianewsonline.com' using specific login parameters ('Areyou=cake', 'OKey=', 'Who='), which is indicative of command and control activity linked to the Konni actor group.
Detects outbound HTTP POST requests to the 'vpugy.vcqi' domain, which is associated with RevStealer malware exfiltration. The rule specifically looks for traffic using a spoofed Chrome/147 user-agent and specific cookie artifacts used for session tracking in the exfiltration communication.
Detects HTTP POST requests directed at etherscan.io containing 'eth_call' in the request body. This pattern is indicative of the GHAPPIER / PolinRider malware family utilizing the Ethereum blockchain's public JSON-RPC interface as a dead-drop resolver for command-and-control communication.
Detects PIVOTPIPE malware beaconing activity indicative of peer-to-peer (P2P) lateral movement between internal hosts. The rule monitors for sustained established TCP traffic with specific small packet size characteristics, suggesting command-and-control heartbeats or tunneled traffic within the internal network.
Detects HTTP responses containing keywords associated with ClearFake campaigns hosted on Cloudflare Workers. These pages are typically designed to trick users into downloading malicious files by displaying fake browser verification or captcha pages.
Detects outbound network traffic from internal hosts to known PIVOTPIPE-associated infrastructure, including attempts to access open directories for payload distribution and suspected Cobalt Strike command-and-control communications.
Detects network traffic associated with the GHAPPIER campaign using specific Vercel-hosted staging infrastructure. The rule monitors for requests to known malicious Vercel subdomains and identifying URI parameters often used for campaign tagging during beaconing or payload delivery.
Page 37 of 124