Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,773
6,705
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Detects a multi-stage Wazza phishkit communication chain over HTTP, involving initial configuration retrieval, token minting, token firing, and subsequent redirection with signed tokens.
Detects unauthorized attempts to access the Ray Dashboard Job Submission API, which is vulnerable to remote code execution (CVE-2023-48022). Attackers can leverage this API endpoint to execute arbitrary commands on the Ray cluster.
This rule detects HTTP POST requests targeting Adobe Commerce or Magento checkout, customer, or admin endpoints that contain suspicious syntax patterns indicative of Server-Side Template Injection (SSTI). These patterns ({{...}}, {%...%}, ${...}) are common in various template engines and, when injected into application inputs, can lead to Remote Code Execution (RCE) via CVE-2026-75650.
Detects attempts to exploit CVE-2026-83549 in SonicWall SMA1000 appliances, where an attacker sends a malicious HTTP request to the 'workplace' URI containing shell metacharacters such as ';', '|', '`', or '$(' to execute arbitrary OS commands.
This rule detects a potential heap overflow exploitation attempt against F5 BIG-IP Access Policy Manager (APM) by inspecting HTTP POST requests to the /oauth/token endpoint with an unusually large 'grant_type' field (exceeding 4096 bytes). This behavior is characteristic of an attempt to trigger the heap overflow vulnerability identified as CVE-2026-94127.
Detects unauthorized or external access attempts to the Ollama LLM API service (TCP port 11434). The rule specifically flags POST requests targeting the /api/generate or /api/chat endpoints, which are commonly exposed via misconfiguration or lack of authentication, potentially allowing remote command execution or model exploitation.
Detects an exploitation attempt against PoeLLM or LiteLLM MCP test/connection endpoint using a python3 stdio payload that fetches data from port 81.
Detects SQL injection exploitation attempts against MOVEit Transfer targeting the CVE-2023-34362 vulnerability, followed by the deployment and subsequent interaction with the 'human2.aspx' webshell associated with Cl0p ransomware mass-exploitation campaigns.
This rule detects outbound TLS traffic to the domain 'trace-flow.ru', which is associated with Max Messenger covert telemetry beaconing behavior. The rule inspects the Server Name Indication (SNI) field in the TLS handshake for the specific domain string.
Detects HTTP GET requests for files with a .hta extension, utilizing a legacy Internet Explorer User-Agent string. This pattern is commonly associated with SideCopy threat group activities where mshta.exe is used to proxy the execution of remotely hosted malicious HTA files, often as part of an initial infection chain.
This rule detects potential exploitation attempts targeting the Splunk REST API (CVE-2026-20253) by monitoring for unauthenticated inbound requests to the /services/ path. It specifically looks for requests that lack the required Authorization or Cookie headers.
Detects network traffic matching the default HTTP check-in pattern of Mythic C2 agents. This rule monitors for POST requests using a specific hardcoded User-Agent string and Content-Type header commonly used in default Mythic agent configurations, indicating a potential active command-and-control session.
Detects specific markers in UDP traffic on ports 3478, 5349, and 443 that are associated with the DragonForce malware's TRN1 C2 beaconing protocol. The rules identify session initiation, task polling, task acknowledgment, and result uploading behaviors.
Detects TLS connections to a specific, potentially adversary-controlled ScreenConnect relay infrastructure endpoint. Adversaries frequently abuse legitimate remote access tools like ScreenConnect for command and control purposes.
Detects multiple attempts to connect to administrative shares (ADMIN$, C$, IPC$) from a single source within a 60-second window. This pattern is indicative of automated lateral movement or enumeration attempts using the SMB protocol.
Detects outbound HTTP requests to known Alibaba OSS buckets hosting malicious AdaptixC2 payloads. This is associated with exploitation attempts against PaperCut MF software (referencing CVE-2026-82078 and CVE-2026-81578).
Detects an exploitation attempt against PaperCut MF software leveraging SQL injection to deliver a Java bytecode loader (identified by the 'cafebabe' magic bytes) via a POST request.
This rule detects established TLS connections to external domains that exhibit characteristics often associated with phishing campaigns. Specifically, it looks for domain names in the SNI field that contain common brand names (e.g., microsoft, google, paypal) combined with typical login-related keywords (e.g., login, verify, auth) on high-churn or suspicious Top-Level Domains (TLDs) such as .top, .xyz, or .icu.
This rule detects established TLS connections to external domains that exhibit characteristics often associated with phishing campaigns. Specifically, it looks for domain names in the SNI field that contain common brand names (e.g., microsoft, google, paypal) combined with typical login-related keywords (e.g., login, verify, auth) on high-churn or suspicious Top-Level Domains (TLDs) such as .top, .xyz, or .icu.
This rule detects established TLS connections to external domains that exhibit characteristics often associated with phishing campaigns. Specifically, it looks for domain names in the SNI field that contain common brand names (e.g., microsoft, google, paypal) combined with typical login-related keywords (e.g., login, verify, auth) on high-churn or suspicious Top-Level Domains (TLDs) such as .top, .xyz, or .icu.
Page 7 of 124