Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,456
11,839
5,876
5,155
4,865
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
This rule detects potential Server-Side Request Forgery (SSRF) activity where web application or runtime processes attempt to access the Cloud Instance Metadata Service (IMDS) or container task metadata endpoints. By monitoring network connections and application logs, the rule filters out known legitimate metadata clients and identifies suspicious processes frequently associated with web-based vulnerabilities that are repeatedly querying sensitive metadata paths.
Detects a GitLab personal access token/response indicating Owner-level (access_level 50) group access combined with the broad 'api' scope on the sensitive gnutls/gnutls project -- the excessive standing-privilege pattern that turned one leaked token into a 55-project exposure.
Detects the gitlab-triage automation tool being invoked with a personal access token scoped to the broad 'api' permission rather than a narrower issue/MR-only scope, inflating the blast radius if the token leaks.
This rule detects potential abuse of the device code authentication flow by correlating a successful device code login with a subsequent non-interactive sign-in using the 'python-requests' user agent for the same user within 10 minutes. This behavior is indicative of an attacker programmatically accessing resources or APIs immediately after gaining authorization via a device code phishing or relay attack.
This rule detects potential abuse of the device code authentication flow by correlating a successful device code login with a subsequent non-interactive sign-in using the 'python-requests' user agent for the same user within 10 minutes. This behavior is indicative of an attacker programmatically accessing resources or APIs immediately after gaining authorization via a device code phishing or relay attack.
Detects unauthorized modification of the Nacos database users table, specifically identifying direct INSERT or UPDATE statements used to plant a backdoor administrative account. The rule correlates database modifications with abnormal authentication patterns, such as a password hash update occurring after a failed login attempt to the Nacos application.
Detects multiple successful GitLab authentication events from a specific source IP that contain parameters indicating an attempt to skip or bypass two-factor authentication, consistent with known GitLab 2FA bypass vulnerabilities.
Detects administrator-privileged actions in JFrog Artifactory audit logs attributed to the 'token:anonymous' identity, the tell-tale signature left when CVE-2026-42018 (unauthenticated token retrieval) is chained with CVE-2026-42016 (privilege escalation) to mint an admin-scope token that retains the anonymous username. Also relevant to CVE-2026-82329 authentication bypass activity.
Detects instances where a development-oriented web server (such as Vite or Node.js) is configured to bind to all network interfaces ('0.0.0.0') and is simultaneously receiving inbound connections from non-private, external IP addresses on a common development port (5173). This rule filters out common CI/CD environments to focus on potentially insecure exposure of development tools to the public internet.
Detects instances where a development-oriented web server (such as Vite or Node.js) is configured to bind to all network interfaces ('0.0.0.0') and is simultaneously receiving inbound connections from non-private, external IP addresses on a common development port (5173). This rule filters out common CI/CD environments to focus on potentially insecure exposure of development tools to the public internet.
Detects browser extensions that inject hidden or invisible DOM elements (using display:none, visibility:hidden, or opacity:0) into specific AI assistant web pages (such as gemini.google.com or perplexity.ai). This behavior is characteristic of 'Prompt-Forcing' or 'BragJack' techniques, where malicious scripts attempt to smuggle unauthorized prompts into the AI's input channel through hidden fields, leading to unintended command execution.
This rule monitors the software inventory for outdated versions of the PostgreSQL database server. It identifies installations where the major and minor versions are below the threshold for current security releases (e.g., v18 < 6, v17 < 11, v16 < 15, v15 < 19, v14 < 24). Running outdated software increases the risk of exploitation of known vulnerabilities.
This rule detects potential exploitation or unauthorized interaction with an HAProxy service. It correlates process execution on Linux systems involving the HAProxy PID file with subsequent network traffic containing the suspicious string 'writeservice_info' within a one-hour window.
Detects the presence of the 'X_TRACE_' marker within Magento report files or system logs, which is characteristic of the StyleSmuggler threat actor's method of poisoning log files to facilitate subsequent code execution.
Detects potential session replay or cookie theft attacks against Google Workspace accounts. The rule identifies anomalous session activity where a single session ID is associated with multiple country codes within a short timeframe (less than 60 minutes), suggesting that a stolen session token is being used by an adversary in a different location than the legitimate user.
Detects GitLab CI/CD pipeline configuration (.gitlab-ci.yml) that sets job artifacts to 'untracked: true' with 'when: always', which publishes every untracked file as a downloadable CI artifact -- the exact misconfiguration that exposed the leaked GitLab token in the GnuTLS incident.
Detects a direct push to the protected 'gnutls_3_7_x' release branch with no associated merge request, bypassing code review even when the pusher's role technically satisfies branch-protection rules.
Detects the gitlab-triage automation tool being invoked with a personal access token scoped to the broad 'api' permission rather than a narrower issue/MR-only scope, inflating the blast radius if the token leaks.
Detects multiple successful GitLab authentication events from a specific source IP that contain parameters indicating an attempt to skip or bypass two-factor authentication, consistent with known GitLab 2FA bypass vulnerabilities.
This rule detects potential exploitation attempts (CVE-2026-59822) against LiteLLM MCP tool endpoints. It identifies HTTP requests where the authorization bearer token is unusually short (<= 12 chars), lacks the 'sk-' prefix, and does not appear to be a valid JWT, yet successfully results in a 200 OK status, indicating a potential bypass of authentication logic.
Detects high-velocity publication of Ruby packages by an account that uses naming conventions related to 'OAI' or a known-malicious contact email. This behavior is indicative of a supply chain attack involving the automated deployment of numerous malicious packages to the RubyGems ecosystem.
Page 36 of 83