Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,665
9,773
6,705
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects DNS TXT query responses containing anomalously large RDATA payloads (exceeding 100 bytes). Large TXT records are frequently used in DNS tunneling or data exfiltration scenarios to smuggle data out of a network while bypassing traditional network security controls. The rule applies a threshold limit to identify persistent, potentially malicious exfiltration activity from a specific source over a 60-second window.
Detects network traffic containing the Java Serialization magic header 'AC ED 00 05'. This sequence is commonly used to initiate Java deserialization attacks, which can lead to remote code execution if the application insecurely deserializes untrusted data.
This rule detects outgoing TCP traffic that initiates a SOCKS5 handshake (indicated by the byte sequence |05 01 00|) on destination ports other than standard web ports (80, 443, 8080, 8443). This behavior is characteristic of TOR client traffic attempting to establish an anonymous connection to an external TOR relay or node via non-standard network ports.
Detects network traffic containing a potentially malicious Microsoft Excel (.xlsx) OOXML file being downloaded. The rule identifies the presence of the 'Content-Disposition' header with an '.xlsx' extension, combined with a file signature matching the ZIP format (often used by OOXML files) and a file size exceeding 500KB, which may indicate an attempt to exploit CVE-2025-60727.
Detects anomalous ICMP Echo Request packets (type 8, code 0) that contain payloads exceeding 64 bytes. ICMP Echo requests with large, non-standard payloads are a classic indicator of ICMP tunneling, which can be used to bypass network firewalls and encapsulate non-ICMP traffic for command and control (C2) or data exfiltration. The rule includes a threshold to reduce noise by alerting only when multiple such packets are seen from the same source.
Detects Server-Side Request Forgery (SSRF) attempts targeting Microsoft Exchange via the /autodiscover/ endpoint. The attack leverages a specifically crafted X-BEResource header containing an internal IP address, which is indicative of the CVE-2021-26855 vulnerability used in ProxyLogon exploitation.
Detects HTTP POST requests containing multipart form data that include suspicious PHP functions commonly associated with webshells, such as eval(), base64_decode(), system(), or passthru(). This indicates a potential attempt to upload or execute a malicious PHP script on a web server.
Detects outbound HTTPS traffic on non-standard ports that matches a specific JA3 fingerprint associated with the Sliver command and control framework. This indicates potential beaconing or C2 communication from a compromised host.
Detects DNS query traffic with unusually long subdomains (over 100 characters) that exhibit Base64-like encoding patterns. This is a common behavioral indicator for DNS tunneling tools like iodine or dnscat2, which use DNS queries to encapsulate non-DNS protocol traffic for command and control or data exfiltration.
This rule detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by monitoring HTTP headers (User-Agent, X-Forwarded-For, Referer) for JNDI lookup strings. The JNDI lookup mechanism in vulnerable Log4j libraries allows an attacker to execute arbitrary code by pointing the lookup to a malicious LDAP, RMI, or DNS server.
Detects attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) by monitoring HTTP headers for JNDI lookup strings. The rule inspects traffic for malicious patterns like '${jndi:ldap://', '${jndi:rmi://', or '${jndi:dns://', which are used to trigger remote code execution in vulnerable Java applications.
Detects anomalous network traffic patterns characteristic of the Mimikatz 'lsadump' module performing a DCSync attack. The rule monitors for DRSUAPI (Directory Replication Service Remote Protocol) RPC requests, specifically the DsGetNCChanges operation, which is abused to synchronize Active Directory data including sensitive password hashes.
Detects network exploitation attempts targeting the SMBv1 protocol using the EternalBlue vulnerability (MS17-010). This vulnerability was famously exploited by the WannaCry and NotPetya ransomware to propagate across networks.
This rule detects DNS queries for domain names that exhibit patterns indicative of 'phantom squatting' targeting postal and courier services. These patterns often involve concatenating brand-related keywords (e.g., 'post', 'parcel', 'delivery') with service-oriented suffixes (e.g., '-login', '-verify', '-app') to create lookalike domains intended for phishing, credential harvesting, or infrastructure staging.
Detects outbound network traffic from internal hosts to the domain 'avenger-sync.live' over TLS port 443, which is associated with PamStealer stage-two command and control communication.
Detects outbound TCP traffic originating from the internal network to external hosts on TCP port 45588, which is associated with Interlock ransomware beaconing behavior. This rule monitors for initial TCP SYN packets, characteristic of an outbound connection attempt potentially related to command-and-control activity following the exploitation of CVE-2026-20131.
Detects network traffic containing a potentially malicious Microsoft Excel (.xlsx) OOXML file being downloaded. The rule identifies the presence of the 'Content-Disposition' header with an '.xlsx' extension, combined with a file signature matching the ZIP format (often used by OOXML files) and a file size exceeding 500KB, which may indicate an attempt to exploit CVE-2025-60727.
Detects HTTP GET requests for .msc (Microsoft Management Console) files, which can be leveraged as part of an attack chain to abuse the mmc.exe binary for proxy execution of malicious configurations.
Detects suspicious WinRM SOAPAction headers indicating potential lateral movement or remote command execution (e.g., shell command, process creation, or WMI operations) over WinRM HTTP ports 5985 and 5986.
Detects HTTP POST requests containing patterns associated with the Spring4Shell vulnerability (CVE-2022-22965). The rule specifically looks for payloads manipulating 'class.module.classLoader' or 'class.classLoader.resources.dirContext' to achieve Remote Code Execution (RCE) on vulnerable Spring Framework applications.
Detects attempts to exploit the ProxyShell vulnerability (CVE-2021-34473) in Microsoft Exchange servers. The rule identifies malicious path traversal sequences, specifically utilizing encoding techniques like double URL encoding (%25) or dot-dot-slash characters within requests to the Autodiscover service, aimed at bypassing security controls.
Page 99 of 124