Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,146 detections
Filters
Last updated
All Time
Detection languages
679
377
340
230
173
Contributors
630
378
354
143
119
Categories
835
831
746
387
348
Platforms
1,580
584
492
263
118
Products / Services
10,650
9,755
6,688
4,418
3,745
2,146
MITRE Techniques
655
561
377
331
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
Detects a module changing protocol, destination class, or cloud service after repeated failed connections on its primary channel. This behavior is indicative of malware like Kazuar attempting to establish C2 communication through alternative means when its initial attempts fail.
Detects manipulation of financial transaction data for financial theft
Detects anomalous SSH lateral movement originating from the Cisco SD-WAN Manager (vManage) to other control plane components (vSmart/vBond). This rule correlates network connections on port 22 with successful SSH logins using privileged or service-related accounts, which is indicative of potential post-exploitation activity or pivoting within an SD-WAN control plane environment.
Detects HTTP/1.1 Upgrade requests directed at an nghttpx proxy that contain a non-zero Content-Length header. This combination is the core primitive for the nghttp2-nghttpx-upgrade-queue-poison-poc attack, where the proxy incorrectly forwards request body bytes to the next backend connection user.
This rule detects attempts to exploit MyBB administrative controls. It monitors for two primary patterns: unauthorized privilege escalation where a limited ACP account creates a new Administrator (usergroup=4) user by bypassing access controls, and unauthorized access by limited ACP accounts to restricted administrative modules such as template and plugin management.
Detects potential HTTP Request Smuggling attempts targeting the nghttpx reverse proxy by monitoring for HTTP/1.1 'Upgrade: h2c' requests that include a 'Content-Length' header, or traffic containing known PoC-specific payloads, poisoned paths, or specific nghttp2 version strings that indicate exploitation activity.
This rule detects anomalous DNS query activity that may indicate command and control (C2) or data exfiltration over the DNS protocol. It monitors for three specific indicators: excessive query volume to a single domain family within a short timeframe, the use of abnormally long DNS subdomain labels, and the transmission of TXT record queries from endpoints not acting as designated DNS servers.
This rule monitors for network connections that occur over non-standard ports (STUN, MQTT) or to specific suspicious IP addresses and domains, while excluding known legitimate user-facing applications. The detection aims to identify potentially malicious command and control (C2) communication or unauthorized network activity performed by non-standard processes.
Detects potential HTTP Request Smuggling attempts targeting nghttpx proxies. The rule monitors for malicious request patterns involving HTTP/1.1 Upgrade headers combined with a body (Content-Length) designed to poison the request queue, as well as specific path patterns (e.g., /upgrade, /poisoned) or server-agent identification of the nghttp2/nghttpx service.
Detects outbound network connections over port 8883 (MQTT/IoT) indicative of the Grandoreiro banking trojan. The rule identifies suspicious, unsigned, or non-whitelisted processes attempting to initiate multiple connections to external endpoints, masquerading as legitimate IoT telemetry traffic using MQTT client configurations.
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
Detects a browser session requesting a device code and repeatedly polling the token endpoint while the victim completes authentication elsewhere. This behavior is indicative of an adversary using a device code phishing technique, often associated with the Tycoon threat actor.
Detects network communication behavior consistent with the TinyRCT backdoor. The rule identifies instances where a process named 'PerfWatson2.exe' attempts to establish HTTP GET or POST connections to a known malicious IP address (45.32.113.172), signaling potential C2 beaconing activity using an encrypted channel.
Detects Content Security Policy (CSP) violation reports or network traffic containing references to 'netdna-ssl.com' or 'netdna-cdn.com'. These hostnames are legacy CDN domains that have been re-registered, presenting a significant supply chain risk where malicious content could be injected into web applications loading resources from these domains.
Detects an AI agent performing outbound network connections to the stitch-design.ai domain. This behavior is indicative of a malicious AI agent attempting to fetch dynamically loaded execution instructions at runtime to evade static analysis during security vetting processes.
Detects network connection activity originating from a host to the hardcoded IP 62.102.148.212 on port 37393, which is identified as a command and control (C2) endpoint for Remcos RAT. This communication is often associated with process hollowing where the malware hides within legitimate browser processes.
Detects anomalous network scanning behavior from a Qualys scanner towards Domain Controller ports. The rule monitors CommonSecurityLog and NetworkSessions for high volumes of connection attempts (more than 50 within one hour) targeting critical Active Directory ports (88, 135, 389, 445, 636, 3268, 3269). This activity may indicate a scanner configuration error, a compromised scanner, or an adversary attempting to map the environment while masquerading as a security tool.
Detects high-volume, multi-port connections from a single source to a domain controller, which is indicative of vulnerability scanning activity such as Nessus. The rule monitors for a large volume of connection attempts across multiple sensitive ports (e.g., 88, 135, 389, 445, 464, 636, 3268, 3269) within a short 5-minute window.
This rule detects high-volume connection requests to LDAP services (default ports 389, 636, 3268, 3269). A high number of connections from a single source to a destination within a short time window may indicate automated reconnaissance, LDAP enumeration, or brute-force attempts against domain services.
Detects high-frequency network connection attempts targeting common ManageEngine service ports (8443, 9251, 9261, 8080). This behavior is indicative of potential network reconnaissance, service scanning, or automated exploitation attempts.
Page 72 of 103