Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,146 detections
Filters
Last updated
All Time
Detection languages
679
377
340
230
173
Contributors
630
378
354
143
119
Categories
835
831
746
387
348
Platforms
1,580
584
492
263
118
Products / Services
10,650
9,755
6,688
4,418
3,745
2,146
MITRE Techniques
655
561
377
331
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
Detects unauthorized access attempts to sensitive SD-WAN control plane endpoints via REST API or the presence of suspicious 'evil_tenant.csv' artifacts, which may indicate reconnaissance or staging activities.
This rule detects potential Bluekit malware activity by identifying specific CSS filter function combinations (saturate, hue-rotate, brightness, and contrast) within HTTP header data. These functions are used by Bluekit to generate unique pixel hashes for page loads, intended to bypass screenshot-based detection. The rule also flags instances where these headers co-occur with content-length and javascript identifiers.
Detects SSH network connections initiated by common administrative service accounts 'vmanage-admin' or 'troot' using the ssh or sshd process. This pattern may indicate unauthorized use of these service accounts or anomalous remote access behavior.
This rule detects network connections or DNS queries originating from an endpoint towards domains or IP addresses associated with BlueKit command-and-control (C2) infrastructure, including TLDs (pk, ws, cc, su) and onion-based addresses. This activity is indicative of potential malware communication or C2 beacons.
This rule monitors DNS query logs for attempts to resolve domains associated with 'rrweb' or 'rrweb-snapshot'. These libraries are legitimate tools for session recording and DOM snapshotting but have been increasingly observed in malicious activity, specifically in web-based credential theft, automated session hijacking, or exfiltration of sensitive user activity via session recording.
Detects HTTP GET requests to api.adblock-for-youtube.com to retrieve scriptlet rules. This endpoint is used by various browser extensions to fetch dynamic configuration updates, which can potentially facilitate MAIN-world JavaScript injection.
This rule monitors network logs (proxy, web gateway, and DNS) to detect connections to a curated list of known malicious domains associated with phishing, credential harvesting, and malware delivery infrastructure.
Detects suspicious authentication and management events associated with SD-WAN devices, specifically targeting indicators of CVE-2026-20245 exploitation. The rule monitors for unauthorized SSH access, usage of tenant-upload commands, execution of rogue scripts like vconfd_script_upload_tenant_list, and anomalous peering activity indicative of device injection.
This rule detects potentially malicious web content by identifying the use of randomized or specific combinations of CSS filters (saturate, hue-rotate, brightness, contrast) within HTML responses. These techniques are often used by attackers to obfuscate malicious content, such as phishing pages, from automated scanners and security filters. The rule also incorporates a check for unusually large JavaScript bundle sizes, which may indicate the presence of injected malicious scripts.
This rule monitors network and email gateway logs to detect activity related to the Bluekit Phishing-as-a-Service (PhaaS) platform. It identifies traffic to known Bluekit command-and-control or phishing domains, detects the presence of rrweb scripts often associated with session recording on phishing pages, alerts on brand-impersonation phishing pages using specific keyword combinations, and flags the presence of FortiBleed campaign lures.
Detects exploitation attempts against LB-LINK routers via parameter injection in the 'set_LimitClient_cfg' endpoint (CVE-2023-26801) and subsequent command-and-control behavior, including outbound connections to known RondoDox staging IPs and DNS queries for associated malicious domains.
Detects a web session that proxies an enterprise authorisation endpoint while also handling session-cookie names associated with authenticated access. This rule identifies suspicious activity indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker proxies authentication requests and steals session cookies.
Detects stealth port scan techniques for reconnaissance evasion
This rule detects WebSocket upgrade requests targeting Multi-Context Protocol (MCP) endpoints on AutoGen Studio default ports (8080/8081). It specifically flags connections originating from non-loopback addresses where the HTTP Origin header does not contain expected local indicators ('localhost', '127.0.0.1', '::1'), which may indicate unauthorized cross-origin access or remote exploitation attempts against the local development environment.
This rule detects network traffic indicative of command and control (C2) activity using the WebSocket protocol targeting a specific suspicious destination IP (38.60.253.35). The rule identifies WebSocket connections or traffic containing specific URL parameters ('a=w64', 't=ws_') commonly associated with malicious tooling or C2 communication patterns.
Detects HTTP requests to the SaaS platforms 'holabrief.com' or 'loopedin.io' that contain common URL redirection parameters, characteristic of an open-redirect abuse tactic used in phishing campaigns. These platforms are leveraged as intermediate hops to obfuscate the final destination of phishing links. The rule identifies the initial request and suggests correlation with subsequent traffic to unknown destinations to confirm a two-hop redirection chain.
Detects phishing emails that spoof specific healthcare domains (nhs.uk, mayoclinic.org, clevelandclinic.org) using invoice or payment-related subjects, characterized by DMARC/DKIM/SPF authentication failures. The detection correlates these emails with a subsequent user network request to known open-redirect or intermediary SaaS platforms (holabrief.com, loopedin.io) within a 10-minute window, indicating a likely credential harvesting or malware delivery sequence.
Detects unauthorized inbound WebSocket connections from external (non-private) IP addresses to the AutoGen Studio MCP API endpoint at /api/mcp/ws/ on port 8081, followed by the execution of interpreter processes (autogenstudio, uvicorn, or python) on the same host, indicating a potential exploitation of an origin validation bypass for remote code execution.
Detects anomalous outbound TCP network connections on port 8084 originating from non-browser processes to known CDN providers (Akamai, Microsoft). This behavior is characteristic of VSHELL RAT C2 beaconing using domain blending techniques to mask communications within expected network noise.
This rule detects a high frequency of successful network connections from a single device to multiple unique destination IP addresses within a one-hour window. The targeted ports (445, 139, 3389, 22, 21) are commonly used for remote administrative access, file transfers, and remote shell services, which are frequently leveraged by adversaries for lateral movement. The threshold of 3 unique targets in an hour may indicate automated scanning or credential brute-forcing activity across the network.
Detects network flows to RustDesk relay server ports (21115, 21116, 21117) characterized by anomalous connection patterns. The rule identifies hosts exhibiting rapid, repeated connection attempts or connections to multiple distinct relay IP addresses within a short timeframe. This behavior is consistent with the 'rustdesk-session-permission-pocs' technique, which may indicate an attacker attempting to establish a remote session while bypassing the standard permission handshake exchange required by the application.
Page 66 of 103