Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects an attempt to exploit CVE-2021-33045 in Dahua devices, where an attacker sends a malicious JSON-RPC request to bypass authentication by leveraging the 'Loopback' login type and targeting the '127.0.0.1' address in the 'ipAddr' parameter.
Detects TLS connections using suspicious certificates identified as belonging to the SilkParasite threat actor. The rule monitors for specific certificate issuer strings paired with either malicious subject domain patterns (targeting Central Asian entities) or specific JA4X fingerprints associated with known malicious activity.
This rule detects periodic network beaconing patterns consistent with BabylonRAT malware. It flags established TCP connections to external networks that occur at a frequency exceeding 5 connections within a 300-second window, which may indicate a C2 check-in mechanism. Due to the heuristic nature of this detection, it is recommended to tune the threshold and correlate with payload analysis or entropy inspection to reduce noise.
This rule detects periodic network beaconing patterns consistent with BabylonRAT malware. It flags established TCP connections to external networks that occur at a frequency exceeding 5 connections within a 300-second window, which may indicate a C2 check-in mechanism. Due to the heuristic nature of this detection, it is recommended to tune the threshold and correlate with payload analysis or entropy inspection to reduce noise.
Detection of specific indicators associated with the GhostCode phishing kit, including scripts utilizing PBKDF2/AES-GCM for redirection decryption and a characteristic URL path pattern (/scanna/).
This rule detects established outbound network connections to 'devtunnels.ms', which is a legitimate service often abused by adversaries to tunnel RDP traffic and bypass network security controls or firewall restrictions. This behavior is indicative of unauthorized remote access setup.
Detects incoming HTTP requests attempting to exploit a path traversal vulnerability in the GitLab Commits API (CVE-2026-85706). The rule looks for URI patterns containing directory traversal sequences (e.g., ../) targeting the repository commits endpoint.
Detects network traffic directed to the Telegram Bot API (api.telegram.org) characterized by TLS SNI indicators or specific HTTP URI structures (e.g., /bot). This behavior is indicative of malware or automated tools using the Telegram platform as a command-and-control (C2) channel for beaconing, command delivery, or data exfiltration.
Detects TLS connections to known CHOSEN BRICK cloud object-storage exfiltration endpoints (VultrObjects, StorjShare, Backblaze B2) and repeated Telegram Bot API document-upload calls consistent with data exfiltration. An earlier revision attempted to chain a Telegram-session flowbit to a later cloud-storage upload, but Suricata flowbits are scoped to a single flow and cannot correlate across the two separate connections involved here, so that cross-flow pair was removed as not functionally valid; each remaining rule fires independently on direct traffic to a known exfil channel.
Detects incoming HTTP requests to the WSO2 admin API endpoint that utilize a JSON Web Token (JWT) with the 'alg=none' algorithm, indicating an attempt to bypass authentication via JWT token forgery (CVE-2026-5430).
Detects incoming HTTP requests to the WSO2 admin API endpoint that utilize a JSON Web Token (JWT) with the 'alg=none' algorithm, indicating an attempt to bypass authentication via JWT token forgery (CVE-2026-5430).
Detects attempts to exploit a vulnerability in WSO2 API Manager and Traffic Manager that allows for authentication bypass by utilizing a malformed JWT with the 'alg=none' header. Attackers can leverage this to impersonate users or bypass security controls by providing a crafted Bearer token in the Authorization header.
Detects attempts to exploit a vulnerability in WSO2 API Manager and Traffic Manager that allows for authentication bypass by utilizing a malformed JWT with the 'alg=none' header. Attackers can leverage this to impersonate users or bypass security controls by providing a crafted Bearer token in the Authorization header.
Detects high-frequency outbound TCP connection attempts from a WSO2 API Gateway or Traffic Manager host to multiple sensitive internal management and administrative ports (22, 445, 3389, 5985, 5986). This behavior is indicative of a compromised gateway being used for lateral movement across the network.
This rule detects HTTP GET requests to a specific URI path ('/wp-content/uploads/init/') on the domain 'wasmer.app', which is associated with Kimsuky (APT43) C2 beaconing activity. The presence of a token parameter in the URI and the structure of the request indicates an established connection for command and control purposes.
Detects HTTP POST requests to the Dropbox API endpoint (/2/files/upload) that appear to be unauthorized file uploads, specifically identifying patterns associated with the Kimsuky threat group. The rule triggers on both the presence of suspicious directory naming conventions (_lns/) in the Dropbox-API-Arg header and the use of hardcoded Authorization bearer tokens, both characteristic of Kimsuky's data exfiltration techniques.
Detects HTTP POST requests to the Dropbox API endpoint (/2/files/upload) that appear to be unauthorized file uploads, specifically identifying patterns associated with the Kimsuky threat group. The rule triggers on both the presence of suspicious directory naming conventions (_lns/) in the Dropbox-API-Arg header and the use of hardcoded Authorization bearer tokens, both characteristic of Kimsuky's data exfiltration techniques.
Detects DNS queries and established TLS connections to free.pinggy.io, a service often used to establish unauthorized reverse tunnels to internal networks, bypassing perimeter security controls.
This rule monitors network traffic to detect a specific 'Client Hello' beaconing behavior associated with the RMRLX Remote Access Trojan (RAT), identifying potential command-and-control communication directed at a known malicious IP address over TCP port 4561.
Detects established outbound TCP connections to a known AsyncRAT C2 IP address on port 4944. This rule identifies infected internal hosts communicating with a malicious server typically used for remote access and control.
Detects specific malformed HTTP request patterns associated with the Casbaneiro (Metamorfo) banking trojan. The rules identify suspicious beaconing attempts, including specific URI structures ('/$p', '/$or?u=') and malformed headers (missing Host header combined with specific Content-Length anomalies).
Page 59 of 124