Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects potential prompt injection attempts targeting AI systems by looking for specific keywords related to AI models (gpt, claude, copilot) in HTTP logs, combined with suspicious characters or commands commonly used in injection attacks (e.g., <script>, javascript:, eval(). The rule triggers if 5 or more such attempts are observed from a single IP within an hour.
Detects attempts to exploit an authorization bypass vulnerability in MyBB (specifically observed in version 1.8.40) where a non-administrative ACP account can assign users to the administrator group (gid=4) by manipulating POST requests to the user-add or user-edit endpoints.
Detects incoming HTTP POST requests to the /PSEMHUB/hub endpoint on Oracle PeopleSoft servers, which is indicative of exploitation attempts related to the Server-Side Request Forgery (SSRF) vulnerability identified as CVE-2026-35273.
Detects exploitation attempts of the MyBB limited Admin CP-to-Admin privilege escalation vulnerability. The detection looks for unauthorized HTTP POST requests to the user management module that assign the Administrator group (gid=4) to a new user, or access to sensitive super-admin-only modules by accounts that should not have such permissions. It also flags requests containing known PoC artifact identifiers.
This rule detects suspicious Google OAuth authorization requests directed at accounts.google.com that utilize a local redirect URI (http://localhost) and are missing mandatory security parameters such as code_challenge, state, and login_hint. These characteristics are often associated with OAuth-based phishing or credential theft campaigns where an adversary attempts to intercept authorization codes.
Detects HTTP GET requests to signindat.com for suspected malicious payloads, including executables (.exe) and scripts (.ps1), as well as a decoy PDF document. The rule identifies communication with an external host using generic User-Agent strings, characteristic of the CrySome RAT multi-stage download process.
This rule detects a suspicious pattern involving mass HTTP scraping behavior (high frequency of requests to numerous distinct remote IP addresses) occurring on the same host, correlated with the creation of multiple new user accounts (Windows Event ID 4720) within the same 30-minute time window. This behavior is indicative of a compromised host being used for automated reconnaissance or data collection alongside persistence mechanism establishment.
This rule detects attempts to exploit a Server-Side Request Forgery (SSRF) vulnerability in Oracle PeopleSoft by targeting the '/PSIGW/HttpListeningConnector' endpoint. The detection looks for malicious URI patterns and request bodies containing internal-only network indicators such as loopback addresses (127.0.0.1, localhost), link-local addresses (169.254.169.254), or local file access attempts (file://), which are indicative of SSRF exploitation attempts.
Detects HTTP POST requests to LLM chat completion API endpoints containing keywords associated with phishing kit generation, malware scaffolding, and automated credential harvesting. This behavior is consistent with attackers using LLM-assisted supply chain or phishing campaigns.
Detects anomalous access to Cisco SD-WAN Manager (vManage) infrastructure. This includes unauthenticated REST API access, unauthorized NETCONF sessions, and suspicious OMP/DTLS peering connections, which may indicate exploitation of vulnerabilities (such as CVE-2026-20127 or CVE-2026-20182) or unauthorized management access.
This rule detects potentially unauthorized or suspicious WebSocket connections established over TCP port 1313. It specifically looks for Socket.IO traffic utilizing the 'EIO=4' protocol version and 'websocket' transport, while explicitly checking for the absence of Authorization headers and Sec-WebSocket-Protocol headers. The pattern matching on the raw payload suggests identification of initial handshake or messaging sequences (e.g., '0{' or '40') indicative of unauthenticated interaction with a WebSocket service.
Detects wscript.exe or powershell.exe processes exfiltrating system reconnaissance inventory (computer, OS, process, and directory listings) via HTTP POST requests using multipart/form-data. The activity involves Base64-encoded payloads transmitted to PHP endpoints (e.g., finalservice.php) hosted on dynamic DNS (dynv6.net) infrastructure, often associated with the Kimsuky threat group.
Detects unauthenticated POST requests directed at the '/accessv2' endpoint of an Azure Application Gateway originating from non-internal IP addresses. This behavior is associated with the exploitation of vulnerabilities like CVE-2026-8037.
Detects high-volume, unauthenticated REST API requests to ServiceNow endpoints, specifically those identified as coming from a 'guest' user account or lacking authentication tokens, which may indicate reconnaissance, vulnerability scanning, or automated data extraction attempts.
Detects outbound HTTP POST requests to a /gallery URI endpoint, which is associated with Cavern Manticore C2 beacons. The detection logic inspects the HTTP request body for a specific Base64-encoded pattern following XOR 0x48 encoding, indicating potential command-and-control communication.
Detects network proxy requests from Go-based HTTP clients targeting Dropbox and gofile.io, which are common indicators of VILE ransomware communication or data exfiltration activities.
This rule identifies network connections over port 1313 that initiate a Socket.io WebSocket upgrade request. The detection checks for the presence of the '/socket.io/' URI path, the 'EIO=4' protocol version parameter, and the 'transport=websocket' requirement, which are characteristic of Socket.io communication. This can be used to monitor for potentially unauthorized C2 channels or application-specific tunneling.
This rule detects network connections on TCP port 1313 that explicitly use the Socket.IO protocol for WebSocket communication (URI path containing '/socket.io/?EIO=4&transport=websocket'). This pattern may indicate the presence of command and control (C2) traffic, web shells, or unauthorized application communications leveraging WebSocket tunnels over non-standard ports.
Detects unauthenticated HTTP requests to sensitive Gitea endpoints containing the 'X-WEBAUTH-USER' header set to 'admin'. This rule identifies exploitation attempts against misconfigured Docker deployments where 'REVERSE_PROXY_TRUSTED_PROXIES' is improperly set to a wildcard, allowing unauthorized users to impersonate administrative accounts (CVE-2026-20896).
Detects Server-Side Request Forgery (SSRF) attempts against a GCP Cloud Run service. The rule identifies malicious payloads targeting the 'url' parameter, which utilize path traversal sequences (e.g., ../, %2f, %5c) to escape the GitHub repository segment or attempt to access sensitive local system files like /proc/self/environ, /app/main.py, or /app/requirements.txt.
Detects Server-Side Request Forgery (SSRF) attempts using a double-slash URL manipulation technique. Adversaries append an absolute local file path (e.g., /etc/passwd or /proc/self/environ) after a GitHub blob URL to bypass URL validation logic commonly found in web proxies, API gateways, and serverless environments like GCP Cloud Run.
Page 105 of 202