Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,773
6,705
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects unauthenticated HTTP POST requests targeting the /api/v1/validate/code endpoint in Langflow, which is indicative of an exploitation attempt associated with CVE-2025-3248.
Detects HTTP traffic identified as MarkiRAT command and control beaconing, characterized by a specific multipart POST request structure directed at a known malicious URI and domain.
Detects HTTP POST requests directed at a '/save.php' URI, a common signature associated with the Kratos phishing kit used for capturing and exfiltrating user credentials.
Detects HTTP POST requests directed to the 'avenger-sync.live' domain by the PamStealer malware. The rule identifies specific C2 or exfiltration traffic patterns, including the '/api/sync' URI and a specific JSON-formatted data envelope in the request body, commonly used by the malware for communication.
Detects outbound network traffic consistent with CrySome RAT Command and Control (C2) communication, including direct connections to a known hardcoded IP address on port 5555 and the observation of the '##CRYCFG##' configuration marker within the TCP stream.
This rule detects outbound TLS 1.2 traffic communicating over TCP port 99, which is a non-standard port for TLS/HTTPS traffic. This behavior is indicative of potential command-and-control (C2) communication where an adversary is attempting to hide traffic using encryption on an unconventional port.
Detects network activity (DNS queries, HTTP requests, and TLS SNI) associated with the PamStealer malware communicating with its known command and control domain maccyapp.com.
This rule detects attempts to exploit the Nacos CVE-2021-29441 authentication bypass vulnerability. The vulnerability allows an attacker to bypass authentication by leveraging default or forged JWT tokens, specifically targeting the /nacos/ path with an Authorization header containing a Bearer token starting with 'eyJ'.
Detects established TLS connections to external networks where the server certificate subject contains a Common Name (CN) but lacks Organization (O) or Organizational Unit (OU) fields. This pattern is characteristic of basic, potentially malicious self-signed certificates used by command-and-control (C2) frameworks to mask communication.
Detects network traffic associated with Cavern Manticore command-and-control communication. The rule identifies a specific HTTP request pattern characterized by a static User-Agent string resembling a Chrome/Edge browser on Windows and the inclusion of a specific 'X-User-token' header in the HTTP request.
Detects DNS queries for known typosquatted domains associated with Command and Control (C2) activity. The rule monitors for queries targeting lookalike domains impersonating well-known brands such as Microsoft, Google, Facebook, and various VPN services.
This rule detects HTTP GET requests for specific file paths associated with known malicious lure archives (e.g., YEPlayer.rar, Pis2rayVPN.zip, YEMPlayer.msi). These files are typically used in social engineering campaigns to trick users into downloading and executing malware.
Detects the download of a Mach-O executable file over unencrypted HTTP. The rule identifies the Mach-O magic byte header ('CF FA ED FE') within the first few bytes of the HTTP response body, indicating a file download originating from an external network source.
Detects HTTP GET requests to the URI '/beacon' destined for a known JadePuffer command-and-control server IP address (45.131.66.106) on port 4444. This signature identifies potential beaconing activity, which is a common communication pattern for malware implants communicating with an adversary-controlled server.
Detects unauthorized access attempts to MinIO object storage using the default 'minioadmin' credentials. The rule specifically flags attempts to access sensitive files like 'terraform-state' or 'credentials.json' via HTTP GET requests.
Detects outbound network traffic originating from internal assets destined for IP addresses identified as Command and Control (C2) infrastructure associated with the UAT-7810 threat actor group.
This rule detects attempts to exploit an unauthenticated administration API vulnerability (CVE-2026-35616) in FortiClient EMS versions 7.4.5 and 7.4.6, commonly referred to as FortiBleed. This vulnerability could allow an unauthenticated attacker to gain unauthorized access to the administration interface.
Detects incoming HTTP POST requests to the /PSEMHUB/hub endpoint on Oracle PeopleSoft servers, which is indicative of exploitation attempts related to the Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2026-35273.
This rule detects suspicious Google OAuth authorization requests directed at accounts.google.com that utilize a local redirect URI (http://localhost) and are missing mandatory security parameters such as code_challenge, state, and login_hint. These characteristics are often associated with OAuth-based phishing or credential theft campaigns where an adversary attempts to intercept authorization codes.
Detects HTTP GET requests to signindat.com for suspected malicious payloads, including executables (.exe) and scripts (.ps1), as well as a decoy PDF document. The rule identifies communication with an external host using generic User-Agent strings, characteristic of the CrySome RAT multi-stage download process.
Detects HTTP traffic containing a User-Agent string associated with the NetSupport Manager remote access tool. This activity is indicative of the tool being used for unauthorized remote access or as a C2 channel, often seen in the context of the ClickFix campaign.
Page 97 of 124