Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects network communication with known malicious IP addresses or URLs associated with the 'govtop.one' infrastructure, which is commonly indicative of command and control activity or malware beaconing.
This rule monitors web request URLs and associated messages for common SQL injection characters and sequences, such as quotes and semicolons. It specifically targets requests involving the 'apiuser' account to identify potential attempts to manipulate or exploit backend database queries.
This rule detects potential XML External Entity (XXE) injection attempts by looking for specific XML-related keywords ('<?xml' or 'DOCTYPE') within the URI query string of IIS web server logs. It triggers an alert if three or more such attempts are observed from the same IP address within a one-hour window, indicating a possible automated scanning or attack.
This rule detects a high volume of web requests (20 or more within 5 minutes from a single IP address) containing keywords commonly associated with denial-of-service (DoS) attacks, performance testing, or reconnaissance activities against web applications. Keywords include 'sleep', 'benchmark', and 'loadtest' in the URI query string.
This rule detects potential open redirect attempts by monitoring W3C IIS logs for URI queries containing keywords like 'callback', 'redirect', or 'url='. It then aggregates these attempts by client IP address and time, triggering an alert if five or more such attempts are observed within an hour from a single IP. This pattern can indicate an attacker attempting to exploit an open redirect vulnerability to phish users or bypass security controls.
This detection identifies potential usage of the Naabu port scanner by searching for its process execution or its specific network user-agent string. Naabu is a fast port scanner that can be used for network reconnaissance. This search leverages the Endpoint and Web CIM data models.
Detects network requests involving a file named 'cors_exploit_poc.html' in either the URL or the Referrer field. This filename is characteristic of proof-of-concept (PoC) code used to test for vulnerabilities in Cross-Origin Resource Sharing (CORS) policies, which could allow unauthorized cross-domain access to sensitive data.
This rule detects suspicious web traffic patterns associated with potential Cross-Origin Resource Sharing (CORS) exploitation. It monitors for access to files containing 'cors_exploit_poc', HTTP POST requests containing sensitive 'AMAUTHID' cookies, or the presence of 'withCredentials' headers alongside 'Access-Control-Allow-Origin' configurations. These indicators, particularly when combined, suggest unauthorized attempts to bypass browser-based security models to access sensitive session identifiers or data.
This rule detects POST requests to the URI '/api/device/start' which is indicative of the EvilTokens phishing kit attempting to initiate a Microsoft OAuth Device Code flow. This technique is often used in phishing campaigns to gain unauthorized access to user accounts by tricking them into authenticating through a device code.
This rule detects network traffic indicative of the 'EvilTokens' phishing kit, specifically targeting Microsoft OAuth Device Code flow. It looks for HTTP POST requests to the '/api/device/start' URI on domains hosted on Cloudflare Workers ('.workers.dev'). This pattern suggests an attempt to initiate a device code phishing attack, where adversaries trick users into entering credentials or codes to grant access to malicious applications.
Detects instances of Bluekit Phishing-as-a-Service (PaaS) where the browser utilizes WebRTC RTCPeerConnection to initiate a UDP STUN request on port 3478 while concurrently accessing a suspicious web page. This behavior is used by attackers to discover the visitor's real IP address, effectively bypassing proxies or VPNs to identify security researchers or analysts.
Detects outbound HTTP/HTTPS requests to api.adblock-for-youtube.com to fetch scriptlet rules. This activity is consistent with the Adblock for YouTube extension (cmedhionkhpnakcndndgjjdbohmhepckk) periodically polling for updates.
Tracks network communication matching specific ClickOnce deployment URLs traversing over unencrypted HTTP. This rule identifies attempts to download or access ClickOnce application deployment files (.application) over unencrypted HTTP, which could indicate a potential supply chain attack or malware delivery mechanism.
This rule detects network communication targeting specific external IP addresses associated with known SD-WAN infrastructure and common management endpoints (e.g., /dataservice/). This behavior may indicate an attempt to interact with, enumerate, or compromise SD-WAN controllers or managed edge devices.
Detects attempts to create rogue WordPress administrator accounts using indicators associated with the OptinMonster/TrustPulse supply chain attack. The rule specifically looks for POST requests to WordPress user creation endpoints (REST API, admin form, AJAX) containing campaign-specific identifiers like 'developer_api1', 'customer1usx', or patterns like 'dev_xxxxxx' in the response body or request URL. This covers the known vectors of the attack, aiming to identify the unauthorized creation of administrative users.
This rule detects suspicious update requests to the Ghost CMS Admin API that indicate an attempt at dynamic script injection. It specifically looks for PUT requests to `/ghost/api/admin/posts/` containing markers associated with Base64 decoding (`atob(`) and dynamic DOM manipulation (`appendChild`, `createElement`), or specific strings (`ghost_once_footer_`, `btoa(a.origin)`) known to be used in the Ghost ClickFix attack chain. This activity suggests an attacker is attempting to inject malicious JavaScript into Ghost CMS content, potentially leveraging a vulnerability like CVE-2026-26980.
Detects HTTP 3xx redirect chains where a browser is redirected to a cloud-native staging domain (such as azurewebsites.net, pages.dev, or web.app) that has not been previously observed in the organization's network traffic history over the last 37 days. This pattern is commonly used by adversaries to redirect traffic to staging infrastructure hosting malicious payloads or C2 content while leveraging reputable cloud services to bypass filters.
This rule detects automated script interaction with HR portals by correlating headless browsers or rapid HTTP POST requests sequentially navigating payroll endpoints. Specifically, it looks for network connections to URLs containing 'workday' or 'adp' initiated by 'python.exe' or 'curl.exe'.
This rule detects HTTP POST connections initiated by 'AutoIt3.exe' which is indicative of Vidar Stealer attempting to exfiltrate data to its C2 server. The rule specifically looks for network events where the HTTP method is POST and joins them with process events where the initiating process is 'AutoIt3.exe'.
Detects the HTTPS POST exfiltration enforcing the server-side gate using the actor's custom X-Rise-To-The-Trinny: agree header or X-QT-SR: 14 header, associated with TeamPCP supply chain attacks.
This detection monitors for web requests to the specific URI path "/mifs/403.jsp". This path is known to be used by attackers to deploy a dormant Java-based webshell ("sleeper shell") on vulnerable Ivanti Endpoint Manager Mobile (EPMM) instances as part of an initial access campaign.
Page 132 of 202