Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,773
6,705
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects DNS queries and TLS SNI traffic directed towards known malicious domains associated with passkey and SSO phishing campaigns, specifically attributed to Storm-3121 and Storm-3032. These domains are used to deceive users into providing credentials or authentication tokens via fraudulent login portals.
This rule monitors incoming HTTP requests for the use of PHP stream wrappers (e.g., php://, data://, expect://, etc.). Such wrappers are often leveraged by adversaries to perform Local File Inclusion (LFI) or to achieve Remote Code Execution (RCE) by manipulating input parameters in vulnerable web applications.
This rule detects potential OS command injection attempts in HTTP request parameters by monitoring for common shell command separators and subsequent execution of suspicious system binaries (e.g., sh, bash, curl, wget, python).
Detects HTTP traffic that contains an abnormal number of nested encoding layers, which is often used by attackers to evade network-based inspection signatures and WAF filters.
Detects anomalous TCP stream reassembly where overlapping segments contain different data. This technique is often used to bypass Network Intrusion Detection Systems (IDS) by presenting different data to the target system than what the IDS inspects.
Detects established TLS outbound connections to external networks on ports other than standard ones (e.g., 443, 465, 587, 993, 995, 8443, 9443). This behavior may indicate a covert C2 channel or unauthorized data exfiltration attempting to bypass standard firewall controls.
This rule detects HTTP requests that contain duplicate 'Content-Length' headers, a technique used to perform HTTP Request Smuggling attacks. Attackers exploit discrepancies in how front-end and back-end servers interpret duplicate or conflicting request headers to smuggle requests, bypass security controls, or gain unauthorized access to back-end systems.
Detects repeated suspicious network requests, including non-standard HTTP methods and URI structures, as well as TLS SNI anomalies, targeting the internal sales portal 'agent.3bb.co.th'. The rule triggers when a threshold of 20 requests within a 60-second window is reached from a single source, indicating likely automated reconnaissance or vulnerability scanning activity.
Detects repeated suspicious network requests, including non-standard HTTP methods and URI structures, as well as TLS SNI anomalies, targeting the internal sales portal 'agent.3bb.co.th'. The rule triggers when a threshold of 20 requests within a 60-second window is reached from a single source, indicating likely automated reconnaissance or vulnerability scanning activity.
Detects repeated suspicious network requests, including non-standard HTTP methods and URI structures, as well as TLS SNI anomalies, targeting the internal sales portal 'agent.3bb.co.th'. The rule triggers when a threshold of 20 requests within a 60-second window is reached from a single source, indicating likely automated reconnaissance or vulnerability scanning activity.
Detects HTTP POST requests to a Gitea repository's diffpatch API endpoint whose body contains both a real git diff header and the malicious 'hooks/post-index-change' file path used by the CVE-2026-60004 exploit chain to plant an executable Git hook via an add/add merge collision.
Detects repeated manual HTTP GET requests from many distinct source IPs to a canary token resource. The URI pattern follows a format indicative of a tracked canary token resource, and the threshold of 49 unique source IPs accessing the resource within a prolonged period suggests potential unauthorized reconnaissance or probing activities.
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
Detects successful authentication events using known default or low-privileged Cisco Firepower Management Center (FMC) service accounts, or IDS alerts (Snort SID 66883) associated with credential abuse activity potentially related to CVE-2026-20316.
This rule detects network traffic (DNS, TLS, HTTP, and TCP) originating from internal assets to known infrastructure associated with the QTFY proxy botnet/C2 framework. It identifies communication with specific C2 domains, proxy management systems, and associated malicious IP ranges.
Detects HTTP responses containing JavaScript-based anti-bot challenge patterns commonly used by phishing kits to identify and block automated crawlers, security scanners, and headless browsers.
Detects periodic outbound network connections from internal hosts to external networks, consistent with command-and-control beaconing behavior often observed in malware like BabylonRAT.
Detects HTTP response body content indicating the activation of a FlashProxy residential proxy by the GhostCode C2 harvester, based on geoip API responses.
This rule detects network activity associated with GhostCode phishing campaigns. It monitors for suspicious TLS SNI fields and HTTP Host headers matching known device-code phishing subdomain patterns (e.g., [service]-access-[8-chars].[domain]). Additionally, it detects requests to specific known malicious hostnames and high-entropy URI paths indicative of phishing kit redirects.
Detects HTTP traffic patterns associated with C2 infrastructure challenges, specifically looking for anti-bot/anti-scanner responses containing specific JavaScript variables ('badAgents', 'js_enabled=1') and subsequent client-side validation requests containing a specific token structure and 'check=1' parameter.
This rule detects potential BabylonRAT C2 beaconing activity by monitoring for recurring outbound HTTP GET requests using a 'Firefox' User-Agent string on non-standard HTTP ports. The threshold mechanism specifically flags repeated connections within a short time frame, which is characteristic of malware beaconing behavior.
Page 73 of 124