Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects DNS lookups and subsequent HTTP requests to known domains associated with the Exvicy pop-under/loader malware. These domains are identified as malicious lures often used to initiate payload downloads.
Detects network indicators associated with the Exvicy ClickFix campaign, including HTTP callbacks to embed endpoints, DNS queries for the 'cloudflare-check.net' domain, direct connections to the identified C2 IP address (94.26.90.126), and HTTP responses containing fake 'Security Check' iframe content.
Detects malicious HTML pages commonly used in ClickFix-style phishing campaigns that intercept keyboard events (specifically blocking devtools and view-source shortcuts) and display fraudulent verification prompts to lure users into executing malicious actions.
Detects HTTP POST exfiltration patterns characteristic of the RevStealer malware. The rule identifies suspicious POST requests to a /cdn/ URI path with specific internal file naming, utilizing a spoofed Chrome 147 User-Agent and specific header indicators (_fbp, _sid).
This rule detects HTTP GET requests containing specific URI parameters (OKey, Who, Areyou=cake) indicative of communication patterns associated with the Konni and VelvetCake malware families during exfiltration or command-and-control operations.
Detects a specific raw TCP handshake sequence used by the VelvetCake downloader malware to authenticate with its Command and Control (C2) server. The rule monitors for a 'PASSWORD ' string followed by a 'GET qqq' command in the initiation of an established outbound TCP connection.
Detects HTTP POST requests to gapidriver.com/api/rest.php containing stager-specific status messages like 'build started', 'launch error', or 'all builds loaded', indicating NeedleStealer malware command-and-control activity.
Detects HTTP traffic from internal hosts to the 'gapidriver.com' domain, specifically identifying the GapiUpdate stager behavior. The rule looks for authenticated GET requests to '/api/get.php' using a specific Bearer token and User-Agent, as well as status reporting to '/api/rest.php'.
Detects an attempt to exploit CVE-2026-24858 in FortiCloud SSO by sending a crafted SAML authentication request that lacks a signature. This vulnerability allows an attacker to bypass authentication by providing an unsigned SAML response.
This rule detects network traffic indicative of N0va Phishkit verification or session initialization. It looks for specific GET request URI parameters (/api/verification/init?session=, flow=, prompt_profile=) that align with the initial handshake phase of this phishing kit, which is often used for credential and session cookie theft.
Detects outbound network traffic consistent with the Chisel proxy/tunneling tool establishing a connection to an external VPS associated with the Miku threat actor. The rule monitors for established TCP connections to a specific remote IP address on port 443, utilizing a threshold to reduce noise by ensuring multiple connection attempts occur.
Detects successful exploitation attempts targeting Vite development servers via chained access-control bypass vulnerabilities (CVE-2025-30208, CVE-2025-31125, CVE-2024-45811). The rule identifies malicious GET requests using the /@fs/ endpoint with specific query parameters, resulting in a successful HTTP 200 response, while originating from non-internal IP addresses.
This rule detects potential command and control (C2) communication related to the GhostContainer malware. It inspects HTTP POST requests directed at Microsoft Outlook Web Access (OWA) paths containing a suspicious 'x-owa-urlpostdata' header. The presence of this specific header, followed by a base64-encoded string of significant length, indicates an attempt to deliver C2 commands or exfiltrate data through OWA infrastructure.
This rule detects potential command and control (C2) communication related to the GhostContainer malware. It inspects HTTP POST requests directed at Microsoft Outlook Web Access (OWA) paths containing a suspicious 'x-owa-urlpostdata' header. The presence of this specific header, followed by a base64-encoded string of significant length, indicates an attempt to deliver C2 commands or exfiltrate data through OWA infrastructure.
This rule detects HTTP requests directed at Microsoft Exchange Outlook Web Access (OWA) that contain suspicious 'fakePath' and 'fakePageName' parameters in the URI. These parameters are indicators of the 'GhostContainer' malware attempting to establish a socket forwarding proxy through the web server to facilitate command and control communications.
Detects anomalous MS_T120 channel binding and MCS handshake patterns characteristic of the BlueKeep (CVE-2019-0708) remote code execution vulnerability in Microsoft RDP services.
Detection rules identifying malformed RDP MCS Connect Initial PDUs and unusual service crashes following RDP connection attempts, both indicative of exploitation attempts against the CVE-2019-0708 (BlueKeep) vulnerability.
Detects unauthorized exfiltration of sensitive information, such as camera credentials or location data, directed to the Telegram Bot API as part of the 'Operation CameraSwarm' campaign.
Detects unauthorized exfiltration of sensitive information, such as camera credentials or location data, directed to the Telegram Bot API as part of the 'Operation CameraSwarm' campaign.
This rule detects attempts to exploit CVE-2021-33044, a vulnerability in Dahua hardware that allows an attacker to bypass authentication by sending a specially crafted request to the global.login endpoint.
This rule detects attempts to exploit CVE-2021-33044, a vulnerability in Dahua hardware that allows an attacker to bypass authentication by sending a specially crafted request to the global.login endpoint.
Page 58 of 124