Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,773
6,705
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects successful exploitation attempts targeting Vite development servers via chained access-control bypass vulnerabilities (CVE-2025-30208, CVE-2025-31125, CVE-2024-45811). The rule identifies malicious GET requests using the /@fs/ endpoint with specific query parameters, resulting in a successful HTTP 200 response, while originating from non-internal IP addresses.
Detects successful exploitation attempts targeting Vite development servers via chained access-control bypass vulnerabilities (CVE-2025-30208, CVE-2025-31125, CVE-2024-45811). The rule identifies malicious GET requests using the /@fs/ endpoint with specific query parameters, resulting in a successful HTTP 200 response, while originating from non-internal IP addresses.
Detects incoming HTTP GET requests targeting Vite development server environments that utilize suspicious query parameters typically associated with vulnerability exploitation (e.g., directory traversal or sensitive file access). The rule specifically flags requests where the User-Agent string contains bot keywords but excludes verified IP ranges, suggesting an attempt to bypass security filters by spoofing crawler identities.
Detects incoming HTTP GET requests targeting Vite development server environments that utilize suspicious query parameters typically associated with vulnerability exploitation (e.g., directory traversal or sensitive file access). The rule specifically flags requests where the User-Agent string contains bot keywords but excludes verified IP ranges, suggesting an attempt to bypass security filters by spoofing crawler identities.
Detects an exploitation attempt against the Vite Development Server (CVE-2026-39364) where an attacker uses specific query parameters to bypass file access restrictions and disclose sensitive files. The rule triggers on GET requests containing suspicious import-related query parameters and checks the resulting response to ensure a successful 200/206 status code and non-HTML content type.
Detects an exploitation attempt against the Vite Development Server (CVE-2026-39364) where an attacker uses specific query parameters to bypass file access restrictions and disclose sensitive files. The rule triggers on GET requests containing suspicious import-related query parameters and checks the resulting response to ensure a successful 200/206 status code and non-HTML content type.
Detects high-volume bursts of HTTP GET requests against specific paths associated with a Vite development server (/@vite/client, /@fs/, /src/) on port 5173. This pattern is indicative of automated reconnaissance or vulnerability scanning targeting an exposed development environment.
Detects outbound network traffic (HTTPS and TLS) directed at the specific S3-compatible object storage host 'ams1.vultrobjects.com'. This pattern is associated with 'HEAVYGRAM', a threat actor or toolkit using Vultr S3 buckets for potential data exfiltration.
Detects outbound network traffic (HTTPS and TLS) directed at the specific S3-compatible object storage host 'ams1.vultrobjects.com'. This pattern is associated with 'HEAVYGRAM', a threat actor or toolkit using Vultr S3 buckets for potential data exfiltration.
Detects network activity (DNS lookups, TLS SNI, and HTTP Host headers) associated with proxy infrastructure (iproyal.com and lightningproxies.net) known to be used by the HEAVYGRAM/CHOSEN BRICK threat actors to mask Telegram-based command and control traffic.
Detects incoming HTTP requests attempting to exploit a path traversal vulnerability in the GitLab Commits API (CVE-2026-85706). The rule looks for URI patterns containing directory traversal sequences (e.g., ../) targeting the repository commits endpoint.
Detects network communication with known Command and Control (C2) IP addresses associated with Phantom Stealer malware. This rule monitors both outbound connections from the internal network and inbound traffic from the identified malicious infrastructure.
Detects network traffic associated with the GhostCode phishing kit, specifically identifying API requests to a harvester service and subsequent responses indicating the activation of FlashProxy residential proxy services. These indicators suggest an attacker is leveraging proxy infrastructure to manage command-and-control communications and mask the source of malicious activity.
Detects incoming HTTP GET requests targeting known API endpoints associated with the GhostCode phishing kit. These endpoints (/api/harvester) are used by the phishing kit to poll for session details, device codes, or flow identifiers, characteristic of credential harvesting operations.
Detects DNS queries and TLS SNI traffic directed towards known typosquatted domains associated with the SilkParasite campaign. These domains are designed to impersonate Central Asian government, energy, and telecommunications entities to facilitate malicious activity.
Detects periodic outbound network connections (beaconing) from internal hosts to external networks that exhibit patterns consistent with BabylonRAT malware. This rule monitors for a specific threshold of connection attempts over time, which is characteristic of a C2 heartbeat.
Detects HTTP POST requests to the Telegram Bot API (/sendPhoto) containing structured string patterns typical of exfiltrated Dahua camera credentials, including login, password, port, location, and channel information. This indicates an automated exfiltration attempt where stolen device credentials are sent to an adversary-controlled Telegram bot.
Detects outbound connections to and inbound responses from known command-and-control infrastructure associated with the SpiceRAT malware, as part of the SilkParasite campaign. This rule monitors established TCP traffic on ports 80 and 443.
Detects network activity, including DNS queries and TLS certificate usage, related to the impersonation of the Uzbekistan state railway authority through the domain 'uzrailwaystax.com' and associated SSL/TLS certificates.
Detects outbound network traffic from internal devices interacting with Dahua Easy4IP cloud relay services, specifically identifying device resolution requests, probe actions, and the submission of WSSE authentication headers (UsernameToken and PasswordDigest) to the cloud relay host.
Detects anomalous STUN bind-requests containing 'PTCP' headers directed at the loopback interface, commonly associated with the exploitation of Dahua P2P relay services for traffic redirection or unauthorized access.
Page 64 of 124