Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,773
6,705
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects the specific C2 handshake pattern associated with HVNC (Hidden Virtual Network Computing) remote access trojans. The rule monitors for a unique sequence of markers, specifically CLIENT_ID, COMPUTER, IDENTIFIER_CHANNEL, and a version string, indicating a malware-specific communication protocol.
Detects the specific C2 handshake pattern associated with HVNC (Hidden Virtual Network Computing) remote access trojans. The rule monitors for a unique sequence of markers, specifically CLIENT_ID, COMPUTER, IDENTIFIER_CHANNEL, and a version string, indicating a malware-specific communication protocol.
Detects outbound network traffic from a potential backdoor known as 'Toy Ghouls' (bird-agent) to the ip-api.com service, likely used for geolocation-based reconnaissance or target validation.
This rule detects high-volume, potentially automated POST requests to specific WordPress plugin endpoints (Super Forms and Elementor Pro) used for form submissions and file uploads. A high frequency of these requests from a single source within a short timeframe suggests active reconnaissance or exploitation attempts against these vulnerable components.
Detects inbound network traffic originating from IP addresses known to be associated with exploitation attempts targeting the Elementor Pro CVE-2026-32475 vulnerability. This rule monitors for connections to internal network assets from these identified threat actor sources.
Detects Server-Side Request Forgery (SSRF) attempts originating from the Grafana MCP (Model Context Protocol) process. The rule specifically monitors for instances where the 'grafana_api_request' tool is used in conjunction with a 'X-Grafana-URL' header targeting cloud metadata IP ranges (169.254.0.0/16), or where the host attempts to resolve GCP metadata domains ('metadata.google.internal'). This behavior is indicative of an attacker attempting to access cloud provider instance metadata to exfiltrate security credentials.
Detects anomalous use of the 'X-Grafana-URL' header in conjunction with an 'Authorization: Bearer' token, indicative of an attempt to exfiltrate a service account token to an unauthorized or external domain, exploiting CVE-2026-15583.
Detects HTTP 301 redirection responses from a hardcoded IP address to an external domain associated with ProRAM command-and-control infrastructure.
Detects evidence of malicious file tampering on public CDNs (bootcdn.net, bootcss.com, staticfile.org) associated with the Funnull campaign. The rules identify specific malicious file hashes and anomalous oversized file sizes that indicate the presence of injected malicious loaders within common JavaScript libraries.
Detects evidence of malicious file tampering on public CDNs (bootcdn.net, bootcss.com, staticfile.org) associated with the Funnull campaign. The rules identify specific malicious file hashes and anomalous oversized file sizes that indicate the presence of injected malicious loaders within common JavaScript libraries.
Detects inbound network connections from known IP addresses associated with the StyleSmuggler malware distribution, which is used to inject malicious scripts into web applications.
Detects DNS lookups, TLS SNI headers, and HTTP Host headers associated with the known StyleSmuggler malware download domain '247.cdnflare.xyz'.
Detects outbound network traffic associated with StyleSmuggler C2 infrastructure. The rule identifies established TLS connections to a known malicious IP address (99.84.67.186) and monitors for WebSocket-over-TLS traffic using the suspicious SNI 'windwsecurity.run'.
This rule detects an unauthenticated exploitation attempt against Magento GraphQL endpoints, specifically targeting the 'styles' parameter. The attack pattern involves sending a malformed request to the /graphql endpoint with an 'X-TRACE-' header, which is indicative of the StyleSmuggler vulnerability exploit.
Detects DNS queries for known typosquatted time-sync domains and associated UDP traffic on port 123 (NTP) utilized by the StyleSmuggler malware for command and control purposes.
Detects inbound HTTP POST requests to the /paypal/transparent/response/ endpoint containing encoded PHP webshell payloads, specifically attempting to execute base64-decoded code via eval.
Detects malicious traffic directed towards unpkg.com associated with the 'Beamglea' campaign. The rule specifically monitors for connections to known malicious npm-mirrored packages or pages serving fake Cloudflare CAPTCHA challenges, which are common tactics for credential theft and browser-based exploitation.
This rule detects a multi-stage reconnaissance behavior where an internal host first establishes a TLS connection to speedtest.net, followed immediately by high-volume TCP SYN packet activity (100+ events in 10 seconds), characteristic of network scanning tools like Masscan.
Detects high-frequency login attempts using the Dahua Easy4IP protocol. The rule flags multiple login opcode requests (identified by specific byte patterns 0xFF followed by 0x00A0) originating from the same source within a 60-second window, which is indicative of an automated brute-force or credential-stuffing attack targeting vulnerable IoT devices.
Detects incoming TCP and UDP traffic containing the 'sxcdewqaz!@#' magic string. This pattern is characteristic of a packet-triggered backdoor (often referred to as 'Fire Ant'), which uses custom packet payloads to activate malicious functionality on a listening host.
Detects high-frequency TCP SYN connection attempts originating from an internal device, which is indicative of a port scanning behavior typically used for network service discovery.
Page 89 of 124