Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,773
6,705
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects the use of the 'diagnose sniffer packet' command on a FortiGate network device, which is indicative of an administrator or attacker performing network traffic capture and analysis directly from the device's management interface.
This rule detects attempts to exploit a Server-Side Request Forgery (SSRF) vulnerability in Oracle PeopleSoft by targeting the '/PSIGW/HttpListeningConnector' endpoint. The detection looks for malicious URI patterns and request bodies containing internal-only network indicators such as loopback addresses (127.0.0.1, localhost), link-local addresses (169.254.169.254), or local file access attempts (file://), which are indicative of SSRF exploitation attempts.
Detects anomalous, oversized IKEv1 Phase 1 packets targeting Check Point VPN devices, indicative of an exploitation attempt for CVE-2026-50751.
Detects high-frequency DNS queries for long, random-looking subdomains that result in NXDomain responses, a behavioral indicator of malware using Domain Generation Algorithms (DGA) for command-and-control beaconing.
Detects a specific network handshake pattern indicative of the Cavern Manticore malware establishing a SOCKS5-over-WebSocket tunnel. The rule monitors for a WebSocket upgrade request followed by the initial SOCKS5 connection authentication byte sequence.
Detects outbound HTTP POST requests to a /gallery URI endpoint, which is associated with Cavern Manticore C2 beacons. The detection logic inspects the HTTP request body for a specific Base64-encoded pattern following XOR 0x48 encoding, indicating potential command-and-control communication.
Detects attempts to exploit Microsoft Exchange vulnerabilities (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207), collectively known as ProxyShell. The rule monitors inbound HTTP requests targeting the /autodiscover/ endpoint with specific path traversal patterns and malicious components used to stage web shells or execute arbitrary commands.
Detects an unusually large data transfer (greater than 5MB) from an internal MySQL server to an external network, which may indicate unauthorized database record exfiltration or data dumping.
Detects outbound network communication to an IP address (64.20.53.230) identified as a staging server associated with the JadePuffer activity. This activity involves potential data exfiltration following self-narrated deletion payloads.
Detects incoming HTTP POST requests to the /PSEMHUB/hub endpoint on Oracle PeopleSoft servers, which is indicative of exploitation attempts related to the Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2026-35273.
Detects anomalous, oversized IKEv1 Phase 1 packets targeting Check Point VPN devices, indicative of an exploitation attempt for CVE-2026-50751.
Detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by identifying JNDI lookup strings (e.g., ${jndi:ldap://, ${jndi:rmi://, ${jndi:dns://) within HTTP request headers, a technique used to trigger remote code execution in vulnerable Java applications using the Log4j library.
Detects HTTP POST requests directed at a specific suspicious endpoint (/service/save.php) on a known malicious host (83.138.53.110), consistent with the exfiltration behavior of the FortiBleed EKZ stealer malware. The rule identifies potential credential theft and exfiltration over standard web protocols.
Detects established TLS traffic originating from the internal network to external destinations on TCP port 99. This port is commonly used in legacy or non-standard configurations and, when combined with TLS, may indicate C2 relay infrastructure or unauthorized exfiltration channels.
This rule detects attempts to exploit a Server-Side Request Forgery (SSRF) vulnerability in Oracle PeopleSoft by targeting the '/PSIGW/HttpListeningConnector' endpoint. The detection looks for malicious URI patterns and request bodies containing internal-only network indicators such as loopback addresses (127.0.0.1, localhost), link-local addresses (169.254.169.254), or local file access attempts (file://), which are indicative of SSRF exploitation attempts.
This rule detects internal network traffic communicating with the Telegram Bot API endpoint 'api.telegram.org' using the 'getUpdates' method. This pattern is commonly used by malware for C2 polling to retrieve commands from an adversary-controlled Telegram bot.
Detects network traffic attempting to modify SSH authorized_keys or the sshd_config file using SCP or SFTP protocols, which is a common technique used by attackers to maintain persistence on compromised systems.
Detects anomalous ICMP Echo Request packets (Type 8) directed towards external networks that contain a payload size greater than 128 bytes. Such anomalies are often indicative of ICMP tunneling, which may be leveraged by adversaries for command and control (C2) communication or data exfiltration.
Detects network communication associated with AsyncRAT command-and-control activity. The rule identifies established outbound connections on non-standard ports (6606, 7707, 8808) containing a specific 3-byte null sequence header, which is indicative of AsyncRAT's communication protocol.
This rule detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by monitoring HTTP headers for malicious JNDI lookup strings. Attackers use this injection to trigger the JNDI mechanism to connect to a remote server (LDAP, RMI, DNS) and download malicious Java classes, leading to remote code execution.
Detects network traffic attempting to exploit the SMBv1 vulnerability (CVE-2017-0144), commonly known as EternalBlue. The rule monitors for specific SMB Trans2 SESSION_SETUP packet structures associated with this remote code execution exploit.
Page 98 of 124