Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
7,270 detections
Filters
Last updated
All Time
Detection languages
3,342
1,086
505
478
472
Contributors
1,824
1,622
874
505
300
Categories
3,031
2,542
1,076
1,049
929
Platforms
39,960
7,270
6,537
3,868
3,651
Products / Services
1,331
1,109
991
658
494
MITRE Techniques
2,271
1,336
1,318
904
885
CVEs
66
65
33
32
28
IDS Classtypes
81
80
56
27
10
IDS Protocols
149
98
6
5
4
Detects unauthenticated path traversal attempts targeting the GitLab repository commits API, specifically checking for URL-encoded and plain path traversal patterns (e.g., '../') in requests to the commits endpoint. This behavior is indicative of attempts to exploit vulnerabilities like CVE-2026-85706 to read arbitrary files outside the repository scope.
Detects process creation events containing command-line arguments indicative of an OAuth 2.0 device code flow, commonly used in consent phishing or device code phishing attacks to hijack account access via a malicious OAuth application registration.
Matches known HOOKEDGE malware samples attributed to BlueDelta (APT28) via SHA256 hash comparison
Matches known HOOKEDGE malware samples attributed to BlueDelta (APT28) via SHA256 hash comparison
This rule detects processes or file operations attempting to interact with the Docker daemon socket ('/var/run/docker.sock') by non-standard or unauthorized binaries. Accessing the Docker socket from a container can allow an attacker to escape to the host, manipulate other containers, or perform privileged actions on the Docker daemon.
The rule detects the deletion of specific log files ('Udydn.out', 'server.log', or 'derby.log') which are often associated with application operations or internal debugging. Adversaries may delete these logs to conceal their activities, remove indicators of compromise, or interfere with forensic analysis.
Detects potential command and control (C2) beaconing activity to GitHub repository API endpoints. The rule monitors for a high frequency of requests to specific file names commonly associated with C2 payloads (e.g., command.txt, results.txt, heartbeat.txt) and employs statistical analysis to identify consistent, non-random connection patterns that deviate from expected business usage.
Detects a Golang-based remote access trojan (RAT) attributed to the Transparent Tribe (APT36) threat group. The rule identifies the malware based on distinctive fitness-themed C2 API endpoints, specific function names, hardcoded authentication secrets, and embedded Go runtime markers, while also monitoring for associated persistence registry keys and file paths.
Detects network connection events to known domains and subdomains associated with the SilkParasite threat actor. The rule specifically monitors for connections to specific parent domains (natcommunzu.com, kginfocom.com, mfa-uz.com) and subdomains utilizing service-oriented naming patterns (e.g., mail, service, help, storage, support, microsoft, post) commonly used by this actor for command and control infrastructure.
Detects the use of command-line tools like find and grep to recursively search the filesystem for files containing sensitive information, such as configuration files, environment variables, database credentials, and digital wallet keys. This behavior is indicative of an attacker performing automated discovery of credentials and secrets.
This rule detects a high volume of unique command executions within a short time window where the command lines contain patterns resembling developer or script comments (e.g., # or // followed by keywords like 'attempt', 'retry', 'diagnos'). The threshold-based logic (over 600 unique commands in less than 1 hour) combined with high-frequency retry attempts suggests automated or scripted activity, potentially indicative of automated exploitation frameworks, reconnaissance, or brute-force tools that include verbose logging or internal notes within the command execution.
Detects a suspicious correlation where a host reports a confirmed exploit attempt followed by a high volume of file modifications (encryption behavior) within a single hour. This short dwell time is a strong indicator of automated or AI-orchestrated ransomware deployments.
This rule detects the creation of cron jobs in /etc/cron.d/ that are associated with known miner file names (e.g., redis-miner, xminer). It explicitly looks for instances where the initiating process or its parent process is associated with Redis, suggesting a compromise or exploitation of a Redis service to establish persistence for a crypto miner.
This rule detects the creation of cron jobs in /etc/cron.d/ that are associated with known miner file names (e.g., redis-miner, xminer). It explicitly looks for instances where the initiating process or its parent process is associated with Redis, suggesting a compromise or exploitation of a Redis service to establish persistence for a crypto miner.
Detects potential JWT algorithm-confusion or authentication-bypass attempts
targeting WSO2 API Manager components through JWTs specifying unsupported,
downgraded, or unexpected signing algorithms such as "none" or HS256 where
asymmetric signing is expected. Matching events should be investigated to
determine whether the request represents exploitation of CVE-2026-5430.
targeting WSO2 API Manager components through JWTs specifying unsupported,
downgraded, or unexpected signing algorithms such as "none" or HS256 where
asymmetric signing is expected. Matching events should be investigated to
determine whether the request represents exploitation of CVE-2026-5430.
Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.
KQL Query from file: repeated-unauthenticated-post-to-elementor-pro-forms-endpoint-cve-2026-32475-pr.kql
Detects the initialization of PostgreSQL logical replication slots using uncommon or unrecognized output plugins. Attackers may leverage logical replication plugins to exfiltrate data from a database by streaming changes as they occur, which can be an alternative to traditional mass-export techniques.
This rule detects network communication (via DNS queries, web logs, or device network events) with a list of known malicious domains associated with Command and Control (C2) activity.
Detects suspicious behavior from database accounts with replication privileges ('rolreplication=true'). The rule monitors for logins from unauthorized IP addresses, the execution of non-replication related SQL commands by these accounts, and the use of potentially malicious plugin names (containing path traversal characters) during replication slot creation.
Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.
Page 88 of 347