Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects DNS, TLS SNI, and HTTP Host header requests to known phishing domains mimicking Passkey or Single Sign-On (SSO) authentication services. These domains attempt to deceive users into providing credentials or performing unauthorized authentication actions.
Detects DNS queries and HTTP Host header traffic to known SilverFox malware impersonation domains. These domains utilize .com.cn TLDs and typosquatting techniques to masquerade as legitimate software or service providers.
This rule detects malformed SCTP packets that trigger a protocol decoding error ('pkt_too_small'). This behavior is associated with the 'DiagSpill' vulnerability (CVE-2026-74469), where specially crafted chunk sequences in the SCTP stream can cause a remote service crash or potential instability. The rule includes a threshold to mitigate noise from non-malicious malformed packets.
This rule detects malformed SCTP packets that trigger a protocol decoding error ('pkt_too_small'). This behavior is associated with the 'DiagSpill' vulnerability (CVE-2026-74469), where specially crafted chunk sequences in the SCTP stream can cause a remote service crash or potential instability. The rule includes a threshold to mitigate noise from non-malicious malformed packets.
This rule detects network activity associated with the SilverFox malware, specifically targeting communication patterns between the compromised host and identified relay infrastructure. The detection focuses on unique URL query patterns for relay discovery and dispatcher requests, as well as the identification of staging/download links within server responses.
Detects network activity associated with the Rapuncel malware, including raw TCP exfiltration of files via POST requests to /upload, connections to known malicious C2 infrastructure, and repeated exfiltration retry patterns.
This rule detects repeated HTTP POST requests to a Polygon blockchain endpoint ('eth_call') containing specific contract address and method identifiers. This behavior is indicative of 'EtherHiding', a technique where attackers use blockchain smart contracts to host malicious C2 configurations or update C2 infrastructure, allowing for stealthy dynamic command and control rotation.
This rule detects network traffic indicative of N0va Phishkit verification or session initialization. It looks for specific GET request URI parameters (/api/verification/init?session=, flow=, prompt_profile=) that align with the initial handshake phase of this phishing kit, which is often used for credential and session cookie theft.
Detects outbound network traffic and subsequent inbound responses associated with AsyncRAT command and control (C2) communication. This rule monitors connections directed toward a specific hardcoded IP address known to be associated with AsyncRAT activity.
This rule monitors network traffic to detect a specific 'Client Hello' beaconing behavior associated with the RMRLX Remote Access Trojan (RAT), identifying potential command-and-control communication directed at a known malicious IP address over TCP port 4561.
Detects outbound TCP traffic containing system reconnaissance data, such as OS information, computer name, and location, being sent to a known C2 server address. The rule monitors for specific content patterns indicative of an infected host checking in or exfiltrating host configuration details.
Detects network activity associated with the QUICAgent backdoor, including QUIC C2 traffic using a self-signed 'RAT System' certificate, direct connections to a known C2 IP address (104.64.211.22), and DNS queries for the hardcoded C2 domain 'register.mediumser.com'.
Detects attempts to exploit a path traversal vulnerability in the GitLab commits API, specifically targeting the /api/v4/projects/ repository/commits path. The rule monitors for directory traversal patterns such as .. or url-encoded variations in conjunction with file paths, which could allow unauthorized access to files outside the intended directory.
This rule detects attempts to exploit a path traversal vulnerability (CVE-2024-21762) in FortiOS SSL-VPN by monitoring for malformed GET requests targeting the /remote/fgt_lang endpoint. The rule also tracks successful exploitation by identifying HTTP 200 responses containing Linux password file patterns (root:x:0:0:), indicating potential remote file disclosure.
Detects HTTP responses containing JavaScript-based anti-bot challenge pages consistent with the GhostCode toolkit, and subsequent HTTP requests containing tracking tokens used for victim verification after passing the challenge.
This rule detects potential credential stuffing attempts against a Fortinet FortiGate SSL VPN portal. It triggers when an external source performs multiple HTTP POST requests to the /remote/login endpoint within a short period, accompanied by the FortiGate-specific header, which is indicative of automated brute-force or credential stuffing activity associated with the 'FortiBleed' campaign pattern.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects outbound HTTP POST requests directed at a known StealC command-and-control IP address. The rule identifies suspicious beaconing behavior by looking for POST requests that lack a standard User-Agent, do not utilize common HTTP content types, and contain a request body exceeding 16 bytes, suggesting custom binary protocol usage.
Detects outbound HTTP POST requests directed at a known StealC command-and-control IP address. The rule identifies suspicious beaconing behavior by looking for POST requests that lack a standard User-Agent, do not utilize common HTTP content types, and contain a request body exceeding 16 bytes, suggesting custom binary protocol usage.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting DNS queries, TLS SNI, HTTP Host headers, and direct IP connections to known malicious infrastructure domains (cdnsuicaches.com, mnl.ac) and exfiltration endpoints (23.227.198.199).
Page 50 of 124