Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects network traffic patterns associated with BlueNoroff ClickFix C2 communications. It specifically identifies GET requests to endpoints containing an 'ft?id=' parameter followed by a base64-encoded string, which indicates the delivery of encrypted tasking parameters to an infected system.
Detects web server request patterns associated with a 'Kali365' phishing campaign that utilizes device code authorization flows. The rule identifies suspicious JSON design payloads that simulate various enterprise brands (e.g., Microsoft 365, DocuSign, Adobe) in combination with a 'device_code' flow identifier, indicative of a credential or token-harvesting attack.
Detects network activity associated with BlueNoroff ClickFix campaigns, specifically targeting the download of suspicious Windows PE files from typosquatted CDN/payload URIs. The rule uses session tracking to correlate the initial URI request with the subsequent retrieval of executable content.
This rule detects network traffic patterns where an internal host initiates an HTTP connection to a specific Steam Community profile, which is used as a dead-drop resolver by the TELEPUZ malware (associated with the CLICKFIX-VIDAR campaign) to retrieve secondary command-and-control infrastructure information.
Detects an outbound HTTP GET request containing a .jpg extension in the URI, initiated by a user agent string containing 'PowerShell'. This pattern is commonly associated with attackers downloading images intended to serve as carriers for steganographic payloads, which are then parsed or executed by malicious PowerShell scripts.
This rule detects scenarios where an email containing a specific URL has been soft or hard deleted from a user's mailbox (often by security automated systems), but a user has subsequently clicked that same URL. This often indicates a race condition or a failure in security controls where a malicious link was delivered and accessed before or during the removal process.
Detects attempts to exploit the WordPress wp2shell vulnerability (CVE-2026-63030/CVE-2026-60137) by correlating the identification of a vulnerable WordPress version (6.9.0-6.9.4 or 7.0.0-7.0.1) via response banners with anomalous Batch REST API requests utilizing the 'author__not_in' parameter.
Detects unauthenticated exploitation attempts targeting WordPress sites using wp2shell techniques. The rule identifies malicious payloads attempting to leverage RSS, Navigation, or Calendar Gutenberg blocks in conjunction with the batch REST API to achieve Remote Code Execution.
Detects unauthenticated exploitation attempts targeting WordPress sites using wp2shell techniques. The rule identifies malicious payloads attempting to leverage RSS, Navigation, or Calendar Gutenberg blocks in conjunction with the batch REST API to achieve Remote Code Execution.
This rule detects outbound HTTP requests using the WebDAV protocol that target specific directory paths associated with the Stealth Falcon campaign staging activity. Such traffic may indicate a compromised host attempting to download tools or payloads from an adversary-controlled infrastructure.
This rule detects network activity associated with a phishing campaign impersonating the RENAPO CURP lookup service. It monitors for TLS SNI and HTTP Host headers containing the typosquatted domain 'gobf.mx', as well as HTTP responses containing specific keywords related to the Mexican CURP registration form originating from this domain.
Detects endpoint activity indicative of the TELEPUZ malware interacting with the Telegram API to resolve its fallback Command and Control (C2) server. The rule monitors for DNS queries, network connections, and security log entries related to the specific channel 'chanadarkpart' and common Telegram API endpoints used for retrieving message data or user profiles.
Detects unauthenticated HTTP POST requests targeting the /api/v1/validate/code endpoint in Langflow, which is indicative of an exploitation attempt associated with CVE-2025-3248.
Detects outbound HTTP POST requests containing JSON-RPC 'eth_call' methods, which are indicative of EtherHiding activity where blockchain infrastructure is abused for command and control or data retrieval.
Detects HTTP requests to known Cloudflare Turnstile challenge endpoints or challenge platform scripts which are commonly abused by phishing kits (e.g., Kratos) to act as an anti-sandbox or anti-scanner gate before delivering malicious content.
Detects outbound HTTP POST requests destined for 'webhook.site' containing the string 'secret' in the request body. This is a common pattern used by attackers to exfiltrate small amounts of sensitive data or credentials to a public web service for collection.
Detects instances where users click links directing to Proton Drive domains, a common vector for device code phishing and credential harvesting attacks.
Detects unauthenticated exploitation attempts targeting WordPress sites using wp2shell techniques. The rule identifies malicious payloads attempting to leverage RSS, Navigation, or Calendar Gutenberg blocks in conjunction with the batch REST API to achieve Remote Code Execution.
This rule monitors network traffic for DNS queries and HTTP requests directed toward known malicious domains associated with phishing campaigns, specifically those leveraging OAuth device code authorization flows (e.g., /devicelogin, /deviceauth) and credential harvesting sites.
Detects anomalous web server scanning activity where a single source IP performs rapid requests against multiple common administrative or login panel paths (/admin, /wp-admin, etc.) while utilizing randomized ephemeral source ports. This behavior is consistent with automated enumeration scanning, such as that performed by the TuxBot v3 malware.
Detects outbound HTTP POST requests containing the word 'secret' in the request body directed to the external service 'webhook.site', which is often used by adversaries for quick data exfiltration or testing during post-exploitation activities.
Page 102 of 202