Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
485 detections
Filters
Last updated
All Time
Detection languages
151
136
74
42
39
Contributors
103
95
90
56
41
Categories
88
80
76
66
65
Platforms
210
208
110
108
71
Products / Services
10,661
9,758
6,692
4,418
3,749
485
MITRE Techniques
102
93
89
64
54
CVEs
6
6
5
4
4
Detects activity from Anthropic network range across multiple event types
Detects a Parallels appliance tar archive containing a directory entry name with an embedded double-quote character followed by the --use-compress-program flag, characteristic of the ParaShells (CVE-2026-90894) tar argument-injection payload
Detects instances where a RedTail malware variant enumerates processes via the /proc filesystem to identify and terminate previous instances of itself using a kill signal.
Detects gem packages containing a .yardopts file linking to attacker-controlled Ruby scripts abused for RCE during RubyDoc.info documentation builds
Detects gem packages containing a .yardopts file linking to attacker-controlled Ruby scripts abused for RCE during RubyDoc.info documentation builds
This rule detects IDS/IPS or vulnerability management alerts triggered by exploitation attempts targeting the Cisco IOS XR control plane, specifically related to CVE-2026-20212.
Detects text/report artifacts (markdown, JSON, plain text) produced by an autonomous AI-driven vulnerability research pipeline that decompiles binaries, traces cross-references, hypothesizes memory-safety flaws, and generates/debugs proof-of-concept exploits
This rule detects IDS/IPS or vulnerability management alerts triggered by exploitation attempts targeting the Cisco IOS XR control plane, specifically related to CVE-2026-20212.
Detects KATARU IoT malware samples embedding the DirtyFrag (CVE-2026-43284) Linux local privilege escalation exploit copied from public PoC code, as part of a chained LPE attempt targeting root shell spawning
Detects the malicious NFe-themed ZIP dropper MOTOROLA_MOB_COM_NFe_2026-07-16_21781624.zip by known hash and archive structure
This rule monitors for the creation or presence of a specific backdoor account (username 'p2pwn' and password 'p2password') on Dahua devices. This account is known to be injected by threat actors exploiting CVE-2024-39943 as part of Operation CameraSwarm to maintain persistent unauthorized access.
Detects forged NDA documents used in Phantom Deal fake acquisition fraud, requiring corroborating secrecy-clause language and M&A-fraud-specific wire-transfer/payment phrasing alongside impersonated advisory brands
Detects forged NDA documents used in Phantom Deal fake acquisition fraud, requiring corroborating secrecy-clause language and M&A-fraud-specific wire-transfer/payment phrasing alongside impersonated advisory brands
Detects forged Citibank payment confirmation/account statement PDFs used in Phantom Deal BPC fraud to falsely demonstrate wire transfer progress; requires combination of bank branding with fraud-specific SWIFT/routing/CTA artifacts
Detects unauthorized devices or processes attempting to communicate with the Telegram Bot API (/sendMessage or /sendDocument) and monitors for credential-related terms within the request metadata. This often indicates the use of Telegram as a command-and-control (C2) channel for data exfiltration or credential theft.
This rule detects IDS/IPS or vulnerability management alerts triggered by exploitation attempts targeting the Cisco IOS XR control plane, specifically related to CVE-2026-20212.
Detects gem packages containing a .yardopts file linking to attacker-controlled Ruby scripts abused for RCE during RubyDoc.info documentation builds
Detects unauthorized devices or processes attempting to communicate with the Telegram Bot API (/sendMessage or /sendDocument) and monitors for credential-related terms within the request metadata. This often indicates the use of Telegram as a command-and-control (C2) channel for data exfiltration or credential theft.
Detects unauthorized devices or processes attempting to communicate with the Telegram Bot API (/sendMessage or /sendDocument) and monitors for credential-related terms within the request metadata. This often indicates the use of Telegram as a command-and-control (C2) channel for data exfiltration or credential theft.
Detects the malicious NFe-themed ZIP dropper MOTOROLA_MOB_COM_NFe_2026-07-16_21781624.zip by known hash and archive structure
Detects the malicious NFe-themed ZIP dropper MOTOROLA_MOB_COM_NFe_2026-07-16_21781624.zip by known hash and archive structure
Page 8 of 24