Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects attempts by processes to access the Google Cloud Platform Instance Metadata Service (IMS) at 169.254.169.254 or via the 'metadata.google.internal' DNS entry. This is often an indicator of reconnaissance, SSRF exploitation, or credential theft attempts by an adversary on a compromised cloud instance.
This rule detects potentially malicious web requests attempting to access sensitive local system files, environment variables, or application source code within a cloud-hosted application environment. The detection logic focuses on URI patterns indicative of Local File Inclusion (LFI) attempts targeting proc filesystem nodes, credential configuration files, or application source bundles.
Detects Server-Side Request Forgery (SSRF) attempts against the Google Cloud metadata server (169.254.169.254 or metadata.google.internal) within GCP Cloud Run request logs. This rule identifies inbound requests attempting to access sensitive cloud metadata paths or tokens, often indicative of an adversary attempting to extract service account credentials or instance information.
Detects Server-Side Request Forgery (SSRF) attempts targeting the Google Cloud Platform (GCP) metadata server (169.254.169.254). The rule inspects RequestURL and RequestContext fields for indicators of metadata API access, URL parameter manipulation, authority confusion payloads, and encoding bypass techniques often used to access cloud instance metadata for unauthorized credential or information harvesting.
Detects potential SSRF or local file read attempts by identifying requests to sensitive system or application file paths (e.g., /proc/self/environ, /etc/passwd) that result in an unusually large response body compared to the historical baseline for that endpoint.
Detects incoming HTTP requests that use URL-encoding (e.g., %2e%2e, %2f) to obfuscate path traversal sequences targeting sensitive operating system or container application files, such as /proc/self/environ or /etc/passwd. This technique is often used to bypass security filters or URL validation mechanisms in web applications.
Detects URL credential confusion attempts where an attacker injects an @ symbol into URL-based query parameters. By including an '@' character, the attacker forces a mismatch between how a hostname validator parses the URL (seeing a legitimate hostname like github.com as the userinfo component) and how the backend fetcher resolves the URL (ignoring the userinfo and resolving the host following the @ symbol), potentially enabling Server-Side Request Forgery (SSRF) or local file read bypasses.
This rule detects potential JDY botnet activity characterized by host fingerprinting and data exfiltration patterns. It looks for repeated POST requests to specific URI patterns ('/gate', '/report', '/scan') accompanied by a significant volume of outbound data, indicative of automated C2 communication or data staging. The rule aggregates metrics per host to identify high-volume exfiltration patterns and calculates a risk score based on the frequency of requests and the diversity of destination IPs.
Detects high-frequency POST requests originating from outside internal network ranges (10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) that contain suspicious payloads in the request body (such as shell commands, downloading utilities, or busybox) or target common CGI-BIN paths, indicating a potential attempt to exploit a public-facing web server.
This rule detects WebSocket upgrade attempts to 'google-ai-labs-it.onrender.com', which is associated with the Turla group's STOCKSTAY malware C2 infrastructure.
This rule detects outbound HTTP traffic generated by the WinHTTP library, specifically when the User-Agent identifies as WinHttp.WinHttpRequest. This pattern is indicative of potential post-exploitation activity, such as command-and-control communication or data exfiltration, originating from a process associated with an exploited Excel document (CVE-2025-60727).
Monitors IIS web servers for signs of potential exploitation by tracking suspicious child processes spawned by worker processes (w3wp.exe/iisexpress.exe), tracking unexpected WER (Windows Error Reporting) crashes associated with IIS workers, aggregating IIS-related application crashes, and detecting anomalous W3C IIS log request patterns (e.g., malformed content-length, negative bytes, or suspicious URI characteristics).
Detects path traversal attempts in web server access logs by searching for dot-dot-slash (../), dot-dot-backslash (..\), or their URL-encoded equivalents (..). These patterns are indicative of efforts to access files or directories outside the intended web root.
This rule identifies network connections (DNS queries, HTTPS/WebSocket traffic) directed toward known suspicious domains associated with potentially malicious C2 infrastructure.
This rule detects suspicious HTTP request bodies containing the 'LD_PRELOAD' environment variable assignment, targeting common temporary or writable directories. This behavior is indicative of an attempt to perform dynamic linker hijacking on a Linux system to inject malicious shared libraries into target processes.
This rule detects HTTP directory traversal attempts by inspecting incoming URI requests for common path traversal sequences such as '../', '..%2F', '..%2f', '..%5C', or '..%5c'. Attackers use these sequences to escape the web root directory and access unauthorized files on the server.
Detects classic SQL injection attack patterns within incoming HTTP requests, such as UNION SELECT statements, boolean-based tautologies (1=1), table dropping commands, or common URL-encoded quote characters.
Detects incoming HTTP POST requests directed at PHP, ASPX, or JSP files that contain suspicious command execution patterns (such as cmd=, exec=, system(, or eval()). This behavior is highly indicative of an attacker interacting with a web shell to execute unauthorized commands on the server.
Detects incoming HTTP traffic targeting Apache Struts servers, attempting to exploit CVE-2017-5638 by injecting malicious OGNL (Object-Graph Navigation Language) expressions within the 'Content-Type' header.
Detects HTTP POST requests characteristic of Emotet Epoch 4 and 5 C2 communication. The rule monitors for specific URI patterns, the presence of a 'Cookie' header, and a base64-encoded request body exceeding 80 characters, which are indicative of Emotet malware beaconing activity.
Detects common SQL injection patterns within the HTTP URI query string. The rule monitors established network traffic to web servers and uses regex matching to identify attempts to use SQL keywords like UNION SELECT, OR 1=1 boolean-based attacks, blind SQL injection techniques (sleep/benchmark), and attempts to access information_schema metadata tables.
Page 116 of 202