Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,146 detections
Filters
Last updated
All Time
Detection languages
679
377
340
230
173
Contributors
630
378
354
143
119
Categories
835
831
746
387
348
Platforms
1,580
584
492
263
118
Products / Services
10,680
9,761
6,694
4,418
3,744
2,146
MITRE Techniques
655
561
377
331
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
Detects network connections to the GitHub API attempting to fetch a 'command.txt' file. This behavior is characteristic of the GITSHELLPAD backdoor, which uses private GitHub repositories for command and control (C2) communication as seen in the Gopher Strike campaign.
Detects network connections to known infrastructure associated with the EncystPHP web shell campaign. This IP (45.234.176.202) was observed distributing the 'c' and 'k.php' droppers.
Detects attempts to exploit the SmarterMail authentication bypass vulnerability (WT-2026-0001) by sending a POST request to the /api/v1/auth/force-reset-password endpoint with 'IsSysAdmin' set to 'true'.
Detects C2 network traffic associated with PylangGhost and GolangGhost, RATs used by the PurpleBravo group. The malware sends an RC4-encrypted payload via an HTTP POST request to known C2 servers.
Detects C2 network traffic associated with the InvisibleFerret RAT, used by the PurpleBravo group. This malware uses a plaintext HTTP channel for beaconing, data exfiltration, and payload delivery to specific URI endpoints.
Detects ICMP Echo Request packets where the Identification field is set to the specific magic value 0xC0DE (49374). This value is used by the VoidLink rootkit as a trigger for its covert, out-of-band C2 channel, which can bypass standard firewall rules.
Detects network traffic to web services associated with the ggwave project, such as 'ggwave.ggerganov.com'. These services can generate audio payloads from text, which could be used for covert data exfiltration over an acoustic channel, bypassing traditional network monitoring for the data content itself.
Detects the download of the Amnesia RAT payload from a specific Dropbox URL observed in a multi-stage malware campaign.
Detects HTTP POST requests to the Appsmith password reset endpoint where the 'Origin' header does not match the expected internal or legitimate application domain. This is indicative of an attempt to exploit CVE-2026-22794 to achieve account takeover.
Detects attempts to exploit the ServiceNow 'BodySnatcher' vulnerability (CVE-2025-12420) by invoking the internal 'AIA-Agent Invoker AutoChat' topic to execute arbitrary AI agents.
Detects data exfiltration activity by Turla's Kazuar v3 loader. After performing system reconnaissance, the VBScript loader sends collected information to the C2 server via HTTP POST requests. The exfiltration process collects system information including OS version, boot time, processor architecture, computer name, username, domain, running processes, and file listings, formats the data as plain text, and sends it via HTTP POST to the requestor.php endpoint on the C2 server. The loader uses WinHttp.WinHttpRequest.5.1 with SSL certificate validation disabled and sets User-Agent to "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 10.0; Win64; x64; Trident/7.0; .NET4.0C; .NET4.0E)" to appear as legitimate browser traffic. The requestor.php endpoint is a specific indicator of Kazuar v3 C2 communication. This rule detects POST requests to this endpoint targeting any internet-routable IPv4 address, as Turla may use different C2 servers across campaigns. The combination of the specific endpoint name and POST method is a strong indicator of Kazuar v3 data exfiltration.
This query detects network communication to known Command and Control (C2) IP addresses used by the Medusa ransomware group, often via malicious SimpleHelp RMM servers.
Detects the injection of a malicious iframe with attributes that impersonate the legitimate Stripe payment interface. This technique is used by Magecart actors to steal credit card data by replacing the real payment form with a clone.
Detects outbound network traffic with a User-Agent header indicating the use of the Rust 'reqwest' HTTP client library. This User-Agent is used by the RustyWater implant, associated with the MuddyWater APT group, for command and control (C2) communications.
Detects command injection attempts in HTTP POST requests targeting IoT device web interfaces, a technique used by the RondoDoX botnet to compromise vulnerable devices.
Identifies JSON Web Tokens (JWTs) where the signing algorithm in the header ('alg') is set to 'none'. A server that incorrectly trusts this header may skip signature validation, allowing an attacker to create arbitrary tokens and bypass authentication controls.
Detects outbound network connections to a list of IP addresses identified as high-confidence command and control (C2) infrastructure for the Clop ransomware group. This infrastructure has been observed across multiple campaigns, including the exploitation of vulnerabilities like CVE-2025-61882 (Oracle E-Business Suite), CVE-2023-34362 (MOVEit), and CVE-2023-0669 (GoAnywhere).
Detects potential exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882, which allows for unauthenticated remote code execution. This rule looks for specific web request URIs, post-exploitation process activity, and known indicators of compromise (IOCs).
Detects potential exploitation attempts against Next.js applications vulnerable to CVE-2025-66478 (React2shell). The rule looks for POST requests to Next.js Server Action endpoints with an unusually large request body, which may indicate a malicious payload designed to trigger a deserialization RCE.
Detects a distinctive User-Agent string used by the initial RedLoader DLL for command and control (C2) communications. This activity is associated with the GOLD BLADE threat group (also known as RedCurl).
Detects network connections to domains known to be used as infrastructure for an ongoing, highly evasive Evilginx phishing campaign targeting SSO portals.
Page 86 of 103