Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,146 detections
Filters
Last updated
All Time
Detection languages
679
377
340
230
173
Contributors
630
378
354
143
119
Categories
835
831
746
387
348
Platforms
1,580
584
492
263
118
Products / Services
10,680
9,761
6,694
4,418
3,744
2,146
MITRE Techniques
655
561
377
331
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
Detects network connections initiated by regsvr32.exe or cmstp.exe to external IP addresses on common web ports. This behavior can indicate the use of these legitimate Windows utilities for malicious purposes, such as downloading and executing malicious scripts or DLLs, often bypassing application whitelisting.
This rule detects attempts to exploit a vulnerability in ShareFile (CVE-2026-2699/CVE-2026-2701) by monitoring for HTTP GET requests to the `/ConfigService/api/StroageZoneConfig` URI path with a `h=` query parameter. This pattern is indicative of an attacker trying to leak API secrets.
Detects the creation of specific webshell files (GW.class, payload.bin, or dpr_<8-hex-digits>.jsp) associated with CVE-2026-4681 weaponization on PTC Windchill and FlexPLM servers, or suspicious web requests containing patterns which could indicate exploitation attempts.
This rule detects exploitation attempts against Oracle WebLogic servers by identifying HTTP requests that target known WebLogic administrative or internal endpoints and simultaneously contain indicators of command execution payloads within the URL. Specifically, it looks for URLs containing '/console/', '/wls-wsat/', '/bea_wls_internal/', or '/_async/' combined with keywords like 'cmd=', 'bash', 'powershell', 'wget', 'curl', 'base64', 'IEX', or 'Runtime.getRuntime'. The rule also requires the source IP to be different from the target IP, indicating an external attacker. This pattern is typical of Remote Code Execution (RCE) exploitation attempts, including those targeting vulnerabilities like CVE-2026-21962.
Detects EtherRAT-related host and network activity using reported artefacts including a known C2 domain (aurineuroth[.]com), a CDN-like beacon URL pattern, the creation of a svchost.log debug file, and various hidden PowerShell commands for system information discovery (AV, domain, MachineGuid, GPU).
This rule detects various stages of DeepLoad malware activity, including initial delivery via PowerShell execution policy bypass with IEX/IRM style ClickFix, network retrieval using mshta.exe, persistence mechanisms like scheduled task creation and WMI, fileless injection through PowerShell Add-Type compilation and suspicious child processes (LockAppHost.exe, makecab.exe, Magnify.exe), credential stealing via filemanager.exe, and USB propagation indicators including specific C2 paths and LNK themed installer names. It also identifies known DeepLoad infrastructure domains.
Detects HTTP GET requests to the vulnerable Citrix NetScaler /wsfed/passive?wctx endpoint, specifically looking for the malformed query string used in CVE-2026-3055 exploitation where 'wctx' is present without an associated value or '=' symbol. This rule combines common network appliance and web server logs to identify potential exploit attempts.
Detects suspicious WebLogic HTTP requests with command execution indicators, specifically targeting known WebLogic endpoints and looking for patterns indicative of Remote Code Execution (RCE) payloads. The rule also correlates this activity with external IP addresses.
Detects exploitation attempts against Oracle WebLogic via suspicious HTTP requests and command execution patterns. The rule identifies WebLogic-specific endpoints combined with RCE payload indicators such as cmd, bash, powershell, wget, curl, or encoded payloads within the URI query.
Detects HTTP POST requests targeting the Langflow public flow build endpoint, which is vulnerable to unauthenticated Remote Code Execution (CVE-2026-33017).
Detects web requests to Cloudflare workers.dev subdomains containing specific keywords commonly used in the EvilTokens device code phishing campaign. The rule specifically looks for a pattern like '[lure-type]-[3char-id].[username]-[domain]...workers.dev' to identify malicious URLs.
Identifies web requests to commonly abused PaaS platforms (Cloudflare Workers, Vercel, AWS Amplify) or the Microsoft device login endpoint.
This rule acts as a base to identify specific events for downstream correlation. To properly detect a device code phishing sequence (such as EvilTokens), correlate a PaaS access event followed by a device login event from the same Source IP within a 5-minute window.
This rule acts as a base to identify specific events for downstream correlation. To properly detect a device code phishing sequence (such as EvilTokens), correlate a PaaS access event followed by a device login event from the same Source IP within a 5-minute window.
This rule detects network communication (DNS queries, HTTP requests, or network connections) to the command and control (C2) domain 'checkmarx.zone', which is associated with the TeamPCP threat group. This activity indicates potential compromise or communication with adversary infrastructure.
This rule detects potential device code phishing attempts where a user accesses a commonly abused Platform-as-a-Service (PaaS) platform (Cloudflare Workers, Vercel, Amplify) and subsequently attempts to log in via the Microsoft device login endpoint within a 5-minute window. This sequence of events is indicative of an adversary luring a user to a malicious site hosted on a PaaS platform to capture a device code, which is then used to authenticate to Microsoft services.
This rule detects network connections to suspicious domains or IP addresses associated with potentially compromised or malicious VPN infrastructure. Specifically, it looks for connections to 'vpn-fortinet.com', 'ivanti-vpn.org', 'forticlient-vpn.de', or the IP address '194.76.226.93'. These indicators may suggest attempts to establish command and control, exfiltrate data, or engage in other malicious activities via compromised VPN services.
Identifies suspicious URI request patterns potentially indicative of CVE-2026-4681 exploitation attempts against PTC PLM solutions. This rule looks for these specific patterns within web traffic logs from various sources (access logs, IIS, Apache).
This rule detects network connections or DNS queries to a specific Internet Computer Protocol (ICP) domain and canister ID (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io or tdtqy-oyaaa-aaaae-af2dq-cai). This pattern is associated with command and control (C2) activity, where compromised systems communicate with an adversary-controlled server.
Detects User-Agent rotation behavior from a single Source IP (c-ip) associated with more than 3 distinct
User-Agent (c-useragent) values within a 5-minute window. This behavior is characteristic of the Nuclei
'-random-agent' flag, which allows the scanner to bypass WAF (Web Application Firewall) detections by
using a different, valid browser User-Agent string for each request.
User-Agent (c-useragent) values within a 5-minute window. This behavior is characteristic of the Nuclei
'-random-agent' flag, which allows the scanner to bypass WAF (Web Application Firewall) detections by
using a different, valid browser User-Agent string for each request.
Detects outbound network connections to the known typosquatted C2 domain (`scan.aquasecurtiy.org`) or associated IP address (`45.148.10.212`) used by the TeamPCP threat actor. This infrastructure was utilized during the Trivy supply chain attack for exfiltrating stolen SSH keys, cloud credentials, and CI/CD secrets.
Detects HTTP POST requests targeting the Langflow public flow build endpoint, which is vulnerable to unauthenticated Remote Code Execution (CVE-2026-33017).
Detects outbound web requests to the Anthropic API containing the specific beta header required to upload files. This can be abused by attackers to exfiltrate sensitive data from the Claude sandbox to an attacker-controlled Anthropic account.
Page 81 of 103