Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,146 detections
Filters
Last updated
All Time
Detection languages
679
377
340
230
173
Contributors
630
378
354
143
119
Categories
835
831
746
387
348
Platforms
1,580
584
492
263
118
Products / Services
10,680
9,761
6,694
4,418
3,744
2,146
MITRE Techniques
655
561
377
331
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
This rule detects network connections to Azure infrastructure (azurewebsites.net) that utilize specific API paths associated with the MiniJunk C2 framework. The paths include '/api/app/check', '/api/app/update', and '/api/app/comment', which are indicative of command and control beaconing activity.
Detects successful outbound network connections to common botnet-associated remote ports (6667, 6697, 8006, 27374, 27375). The rule aggregates these connections by device to identify endpoints communicating with multiple distinct remote IP addresses, a behavior often indicative of botnet participation or command and control activity.
Detects anomalous device network activity involving 5G-specific protocol ports (e.g., GTP-U, SIP). The rule aggregates unique port usage per device over 1-hour intervals to identify potential network reconnaissance, scanning, or unauthorized control plane communication.
This rule detects network connections from internal devices to identified APT Command and Control (C2) IP address ranges over common ports (8080, 443, 21, 22, 23, 25, 445). This traffic pattern is indicative of unauthorized external communication commonly associated with malware or adversary activity.
Detects unusual connections from IT subnets to known OT/ICS protocol ports (Modbus:502, DNP3:20000, EtherNet/IP:44818, S7Comm:102, OPC UA:4840, IEC 60870-5-104:2404, BACnet/IP:18245) within private IP ranges. This rule specifically looks for a high volume of connections (more than 5) from a single source IP to different destination IPs on these OT ports, excluding traffic from Rockwell devices, which might indicate lateral movement or reconnaissance by threat actors like TheGentlemen, who have historically targeted OT environments.
Identifies HTTP requests containing the custom 'X-Antibot-Token' header used by the EvilTokens phishing kit to validate interactions and evade automated scanners. This header is highly specific to the EvilTokens PhaaS and its presence indicates malicious activity.
Detects access to underground markets selling initial access to compromised networks
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
This rule detects network connections to FTP servers (port 21) where the remote URL contains keywords associated with NetWare or Novell, along with suspicious whitespace patterns. This could indicate an attempt to exploit a known vulnerability related to whitespace handling in NetWare FTP servers, potentially the 'Squidbleed' vulnerability.
This rule identifies HTTP requests containing specific URL affiliate tracking parameters associated with the "Borrowed Trust" SEO poisoning campaign. The campaign utilizes these parameters to monetize its activities, often redirecting users to gambling sites. Detection is based on the presence of known affiliate codes in `RemoteUrl` from `DeviceNetworkEvents` or `RequestURL` from `CommonSecurityLog` (proxy/firewall logs).
Detects injection of malicious scripts into legitimate websites for watering hole attacks
This rule detects DNS queries to known malicious domains associated with various APT groups and ransomware families. The domains are hardcoded indicators of compromise (IOCs) and their resolution suggests potential compromise or communication with adversary infrastructure.
Detects audio capture and exfiltration via RTP media streams
Detects use of forged web credentials for unauthorized application access
Detects phishing links with credential harvesting redirects
Detects phishing links with credential harvesting redirects
This rule detects successful exploitation attempts against the Ivanti Sentry vulnerability CVE-2026-10520, which is a pre-authentication OS command injection. It specifically looks for HTTP 200 OK responses to requests targeting the vulnerable configuration endpoint '/mics/api/v2/sentry/mics-config/handleMessage'. A 200 OK status indicates that the request was successfully processed, suggesting a potential successful command injection.
Detects upload of backdoored container images to internal registries
Detects TCP SYN flood denial of service attacks targeting internal hosts
Detects Shellshock bash CGI exploitation attempts
This rule detects potential internal network scanning activity by identifying a single source IP address that communicates with 15 or more distinct internal destination IP addresses within a 5-minute time window. This behavior is often indicative of reconnaissance efforts by an attacker attempting to map out the internal network.
Page 76 of 103