Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,146 detections
Filters
Last updated
All Time
Detection languages
679
377
340
230
173
Contributors
630
378
354
143
119
Categories
835
831
746
387
348
Platforms
1,580
584
492
263
118
Products / Services
10,680
9,761
6,694
4,418
3,744
2,146
MITRE Techniques
655
561
377
331
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
This rule detects attempts to access a known vulnerable endpoint in Ivanti Sentry appliances, specifically '/mics/api/v2/sentry/mics-config/handleMessage', via an HTTP POST request. This activity is indicative of exploitation attempts related to CVE-2026-10520, which is a pre-authentication OS command injection vulnerability.
This rule detects a high number of distinct URLs and total network connections originating from a single remote IP address within a one-minute time window. This behavior can be indicative of various malicious activities such as data exfiltration, command and control (C2) communication, or network scanning. The threshold for distinct URLs is set to greater than 100 and total connections greater than 500.
This rule detects unusual network connection patterns characterized by a high volume of connections to a remote IP address within a 5-minute window, combined with anomalous connection durations. Specifically, it flags scenarios where there are more than 1000 connections and either the 95th percentile of connection durations is very short (less than 50ms) or the 5th percentile of connection durations is very long (greater than 30000ms). These patterns can indicate activities such as network scanning, denial-of-service attempts, or command and control communication.
Detects data exfiltration via generic web services or cloud platforms
Detects HTTP POST requests directed to the specific URI path '/api/validate/keyboard-events', which is used by a North Korean-linked npm malware to exfiltrate keylogger data.
Detects HTTP requests where the Cookie header contains the specific prefixes 'euconsent-v2=' or 'zd_cs_pm=', which are used by the OceanLotus SPECTRALVIPER backdoor to exfiltrate encrypted host profiling data.
Bun Runtime Remote Download
Cortex XDR
Detects network connections downloading the Bun runtime from the oven-sh GitHub repository, a behavior exhibited by the Hades loader. This rule specifically looks for HTTP network events where the URL contains 'github.com' and 'oven-sh/bun/releases/download', indicating an attempt to download the Bun runtime.
Detects outbound network traffic to specific Hong Kong backend fleet subnets (AS398478) identified as being utilized by the 'Borrowed Trust' threat actor. This infrastructure is used to manage redirection and affiliate attribution for their SEO poisoning campaign.
Detects network connections to specific API endpoints used by the HarborWatch Agent for Command and Control (C2) communication. This rule helps identify active C2 beaconing and tasking, even if the underlying IP infrastructure changes, by monitoring for unique URI paths like '/api/agent/tasks/' and '/api/heartbeat'.
Detects wildcard TLS certificates on cheap TLDs commonly used for attack infrastructure
Detects Shellshock bash CGI exploitation attempts
This rule detects an unusual number of HTTP OPTIONS or TRACE method requests from a single IP address within a one-hour window. While these methods have legitimate uses, their frequent or excessive use can indicate reconnaissance, vulnerability scanning, or attempts to bypass security controls. The rule triggers if 5 or more such requests are observed from the same IP within an hour.
Detects requests for a specific favicon image (`/img/ib99-hq.ico`) that is consistently used across all deployments of a threat actor's Next.js gambling kit. This kit is associated with the "Borrowed Trust" campaign. The rule identifies these requests in both endpoint network telemetry and perimeter proxy/firewall logs, indicating potential reconnaissance or active exploitation attempts targeting systems hosting this gambling kit.
Detects Spring4Shell remote code execution exploitation attempts
Detects Node.js or Bun processes making network connections to the GitHub API. This rule is designed to identify potential exfiltration attempts, specifically referencing the Miasma campaign which spoofs a 'python-requests/2.31.0' User-Agent to evade network detection while exfiltrating credentials to api.github.com/repos/.
Detects DNS requests to domains matching known UNC3753 data leak sites or phishing domains masquerading as IT helpdesks, serving as an early warning of an ongoing vishing campaign or active extortion.
Detects repeated SSH connections used to grab banners for host information gathering
This rule detects network connections or DNS queries to a specific Internet Computer Protocol (ICP) domain and canister ID (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io or tdtqy-oyaaa-aaaae-af2dq-cai). This pattern is associated with command and control (C2) activity, where compromised systems communicate with an adversary-controlled server.
This rule identifies web traffic containing the custom User-Agent string 'HarborWatchAgent', which is indicative of Command and Control (C2) communication by the HarborWatch Agent. It searches both endpoint network events and network appliance/proxy logs for this specific User-Agent string.
Detects HTTP requests utilizing a specific, highly verbose, and legacy Internet Explorer 8 User-Agent string. This exact hardcoded string is utilized by a fileless .NET loader (originating from a malspam campaign) to download subsequent payload stages from its staging server.
Detects attempts to bypass the UniFi OS authentication gateway by exploiting a path traversal vulnerability. The rule looks for requests to the '/api/auth/validate-sso/' endpoint containing URL-encoded path traversal sequences like '..%2f' or '..%2e'. This indicates an attacker is trying to access internal resources or bypass authentication mechanisms.
Page 77 of 103