Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects outbound TCP traffic from the internal network to external destinations that match characteristics of Gorilla RAT registration beacons. This includes established sessions with small packet sizes (<64 bytes) and frequent, repeated attempts as defined by the threshold.
Detects high-volume HTTP GET requests containing the 'SetupCompleted' URI pattern directed at PaperCut servers, which is indicative of automated exploitation attempts targeting authentication bypass vulnerabilities.
Detects network traffic consistent with automated penetration testing frameworks such as Nuclei, ffuf, or sqlmap. This rule monitors HTTP user-agent strings and triggers an alert if high-frequency scanning activity from a single source is observed within a 60-second window, which is indicative of automated reconnaissance or vulnerability scanning.
Detects attempts to exploit the Langflow 'validate/code' endpoint, which is associated with CVE-2025-3248. The rule monitors HTTP POST requests to this endpoint for specific character patterns within the request body, indicative of malicious payloads attempting to achieve code execution.
Detects repeated HTTP POST requests containing 'ScreenConnect' in the URI, originating from external networks. This pattern is indicative of automated scanning activity attempting to exploit potential authentication bypass or session hijacking vulnerabilities (such as CVE-2026-84869) in ConnectWise ScreenConnect instances.
Detects an attempt to exploit CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow. The rule identifies POST requests to the '/api/v1/validate/code' endpoint that contain base64 encoded strings in the request body, which are characteristic of malicious Python payloads designed to execute arbitrary code.
This rule detects network traffic indicative of N0va Phishkit verification or session initialization. It looks for specific GET request URI parameters (/api/verification/init?session=, flow=, prompt_profile=) that align with the initial handshake phase of this phishing kit, which is often used for credential and session cookie theft.
This rule detects network traffic indicative of N0va Phishkit verification or session initialization. It looks for specific GET request URI parameters (/api/verification/init?session=, flow=, prompt_profile=) that align with the initial handshake phase of this phishing kit, which is often used for credential and session cookie theft.
Detects anomalous MS_T120 channel binding and MCS handshake patterns characteristic of the BlueKeep (CVE-2019-0708) remote code execution vulnerability in Microsoft RDP services.
Detection rules identifying malformed RDP MCS Connect Initial PDUs and unusual service crashes following RDP connection attempts, both indicative of exploitation attempts against the CVE-2019-0708 (BlueKeep) vulnerability.
Detection rules identifying malformed RDP MCS Connect Initial PDUs and unusual service crashes following RDP connection attempts, both indicative of exploitation attempts against the CVE-2019-0708 (BlueKeep) vulnerability.
Detects specific malformed HTTP request patterns associated with the Casbaneiro (Metamorfo) banking trojan. The rules identify suspicious beaconing attempts, including specific URI structures ('/$p', '/$or?u=') and malformed headers (missing Host header combined with specific Content-Length anomalies).
Detects network communication associated with the Casbaneiro (Metamorfo) banking trojan, specifically identifying DNS queries, TLS SNI headers, HTTP Host headers, and direct IP connections to known malicious C2 infrastructure.
Detects network communication associated with the Casbaneiro (Metamorfo) banking trojan, specifically identifying DNS queries, TLS SNI headers, HTTP Host headers, and direct IP connections to known malicious C2 infrastructure.
This rule detects network traffic originating from potential Casbaneiro or Ousaban malware that uses HTTP 302 redirects to redirect non-targeted IP addresses to Google or YouTube. This behavior is used as a geofencing and sandbox evasion technique to prevent security analysts and automated systems from seeing the actual malicious payload.
This rule detects network traffic patterns associated with the Koktevrat Android RAT, specifically identifying periodic TLS beacons (heartbeats) destined for known C2 domains (streams-tv.lol and stream-plus.lat). The behavior suggests the use of Android's AlarmManager to schedule recurring callbacks to the C2 infrastructure.
This rule detects potential command and control (C2) activity associated with the Koktevrat malware, specifically looking for WebSocket handshake requests (HTTP GET with 'Upgrade' header) to domain names that follow a generated pattern (8-27 alphanumeric characters ending in .icu or .cfd).
Detects specific command strings ('proxy_open', 'proxy_data', 'proxy_close') associated with the Koktevrat Android RAT's tunneling functionality. The rule monitors outbound TCP traffic to identify the initiation, data transfer, and termination phases of a proxy connection, leveraging Suricata flowbits to track the state of the C2 tunnel.
Detects repeated authentication attempts over PPTP (port 1723) or L2TP (port 1701) protocols originating from an external network, indicative of potential brute-force activity against remote access services.
Detects anomalous TLS traffic characterized by an empty Server Name Indication (SNI) field in the TLS handshake, combined with a high frequency of such connections. This behavior is indicative of certain proxy protocols like Xray VLESS with REALITY, which are often used to evade Deep Packet Inspection (DPI) and traffic shaping policies by disguising C2 or tunneling traffic as legitimate-looking TLS connections.
Detects anomalous TLS traffic characterized by an empty Server Name Indication (SNI) field in the TLS handshake, combined with a high frequency of such connections. This behavior is indicative of certain proxy protocols like Xray VLESS with REALITY, which are often used to evade Deep Packet Inspection (DPI) and traffic shaping policies by disguising C2 or tunneling traffic as legitimate-looking TLS connections.
Page 54 of 124