Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,773
6,705
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects TLS connections to a specific, potentially adversary-controlled ScreenConnect relay infrastructure endpoint. Adversaries frequently abuse legitimate remote access tools like ScreenConnect for command and control purposes.
This rule detects potentially malformed or truncated DTLS records on NetScaler appliances, specifically on port 443. The rule looks for packets with a specific record length configuration that may indicate a buffer overflow or other exploitation attempt targeting CVE-2026-88772. The detection logic relies on analyzing the DTLS handshake sequence and packet sizing, and the rule authors recommend correlating these events with SSL_HANDSHAKE_FAILURE (DTLSv1.0, Handshake failure-Internal Error) and appliance crash log entries to confirm potential exploitation.
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
This rule monitors network traffic for TLS SNI and HTTP URI indicators associated with known typo-squatted or spoofed Google Drive and Google Meet phishing domains. It also detects the download of a specific ZIP archive used as a phishing lure.
Detects DNS queries and TLS SNI traffic associated with known lookalike domains used by the threat actor TA419 for organization impersonation, which are commonly utilized in spearphishing campaigns.
This rule detects outbound network connections directed at a known IP address associated with Akira ransomware infrastructure. The rule specifically monitors for communication with 64.227.4.134, which has been identified as a C2 node utilizing GOST tunnels. This behavior is indicative of established C2 connectivity by Akira ransomware actors.
Detects exploitation attempts against Microsoft SharePoint leveraging the ToolShell exploit chain, as well as subsequent post-exploitation webshell activity involving anomalous 'layoutNsp.aspx' naming conventions. This covers initial exploitation of vulnerabilities such as CVE-2025-49704 and associated variants, followed by the deployment of webshells associated with the ToolShell campaign.
Detects TLS connections to a specific, potentially adversary-controlled ScreenConnect relay infrastructure endpoint. Adversaries frequently abuse legitimate remote access tools like ScreenConnect for command and control purposes.
Detects incoming HTTP POST requests with unusually large payloads or malformed URI structures directed at Citrix NetScaler Gateway authentication endpoints, which are characteristic of exploitation attempts against CVE-2026-88771.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Detects exploitation attempts against Microsoft SharePoint leveraging the ToolShell exploit chain, as well as subsequent post-exploitation webshell activity involving anomalous 'layoutNsp.aspx' naming conventions. This covers initial exploitation of vulnerabilities such as CVE-2025-49704 and associated variants, followed by the deployment of webshells associated with the ToolShell campaign.
Detects exploitation attempts against Microsoft SharePoint leveraging the ToolShell exploit chain, as well as subsequent post-exploitation webshell activity involving anomalous 'layoutNsp.aspx' naming conventions. This covers initial exploitation of vulnerabilities such as CVE-2025-49704 and associated variants, followed by the deployment of webshells associated with the ToolShell campaign.
Detects TLS connections to a specific, potentially adversary-controlled ScreenConnect relay infrastructure endpoint. Adversaries frequently abuse legitimate remote access tools like ScreenConnect for command and control purposes.
Detects outbound TCP traffic on port 443 destined for a hardcoded IP address associated with ValleyRAT C2 activity. The rule specifically monitors for established connections with a small payload size (5 bytes) that lack standard TLS handshake characteristics (no SNI), and applies a threshold to mitigate noise. This behavior is indicative of C2 heartbeats from malicious implants using DLL side-loading techniques.
Detects outbound HTTP GET requests to specific GitHub repository paths hosted on raw.githubusercontent.com, which are associated with the Kimsuky threat actor's 'Operation GitPower'. These paths indicate the retrieval of malicious payloads or scripts from adversary-controlled repositories.
Detects network activity associated with DPRK-affiliated threat actors, specifically connections to known hardcoded C2 IP addresses and DNS queries for malicious o-r.kr subdomains utilized for command and control.
Detects outbound HTTP POST requests that contain a JPEG file signature ('FF D8 FF') in the body but lack a 'Content-Type' header. This pattern is indicative of potential C2 communication from a loader or malware family attempting to exfiltrate or receive data disguised as an image file while bypassing basic header-based inspection.
Detects network traffic associated with Wazza phishkit anti-bot gates, including beacon communications, TLS SNI patterns, fingerprint iframe URIs, and challenge-platform requests.
Detects network traffic (DNS, TLS SNI, and HTTP) associated with Wazza phishkit infrastructure, specifically looking for malicious domains like boegl-krysl.eu and coppietersrecherche.eu, as well as Cloudflare workers.dev domains used for beaconing and lures.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Page 6 of 124