Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,443
11,831
5,875
5,151
4,864
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects Server-Side Request Forgery (SSRF) attempts targeting SonicWall SMA1000 WorkPlace endpoints. The rule monitors both HTTP GET query parameters and HTTP request bodies for patterns indicating attempts to redirect the application to internal loopback addresses or local network ranges (e.g., 127.0.0.1, 169.254.169.254, RFC1918 private subnets).
Detects a multi-stage phishing attack targeting cryptocurrency users, specifically Ledger wallet holders. The detection identifies an initial request to a Vercel-hosted domain for a BIP-39 wordlist (a common recovery phrase standard) followed by a POST request to a similar Vercel-hosted endpoint, suggesting the exfiltration of a secret recovery phrase.
Detects activity from known Storm-3168 (JADEPUFFER) campaign IP addresses across Azure control-plane, sign-in, and App Service logs. The rule monitors for malicious indicators in Azure Activity logs, Azure Sign-in logs, and Service Principal sign-ins, as well as specific sensitive URI paths (e.g., shells, admin login paths) within App Service HTTP logs.
Detects activity from known Storm-3168 (JADEPUFFER) campaign IP addresses across Azure control-plane, sign-in, and App Service logs. The rule monitors for malicious indicators in Azure Activity logs, Azure Sign-in logs, and Service Principal sign-ins, as well as specific sensitive URI paths (e.g., shells, admin login paths) within App Service HTTP logs.
Detects HTTP POST requests characteristic of the AgtaBackup RAT, specifically exfiltrating browser profiles or system information via the '/api/agents/' endpoint. The rule monitors for established connections targeting this specific URI structure.
Detects outbound network traffic from internal hosts to external destinations containing a specific, hard-coded User-Agent string (firefox/21.0). This behavior is characteristic of the NeedyMantis malware family, which utilizes this string to identify its own C2 communications, and is a strong indicator of compromise.
This rule detects potentially malicious Command and Control (C2) traffic utilizing DNS over HTTPS (DoH) to interact with public resolvers like Cloudflare, Google, and Quad9. It identifies both high-frequency, repeated direct-to-resolver TLS sessions and specific HTTP requests to these resolvers that resolve domains associated with known C2 infrastructure, such as the ClickFix campaign.
Hunts telemetry for published NeedyMantis indicators: three known SHA-256 hashes (WinSparkle.dll first-stage loader and its encrypted archive, plus the older libcurl archive), the C2 domain corp.tripswithengine[.]com, and the C2 URL path /library/zip/ on that domain. Domain/URL matching parses the actual host out of RemoteUrl and requires an EXACT match (not substring 'has/contains'), so a different domain that merely contains 'corp.tripswithengine.com' as a suffix of a longer label (e.g. 'notcorp.tripswithengine.com') or as a prefix of an unrelated domain (e.g. 'corp.tripswithengine.com.evil.net') cannot match. No malicious IP address has been published for this campaign, so IP-based matching is intentionally not included.
Detects outbound HTTP requests to api.github.com targeting the 'contents' API with patterns indicative of RUSTYSHADE malware command-and-control (C2) communication, including file extensions and filenames typical of its tasking mechanisms.
Detects anomalous HTTP traffic patterns identified in the 'Ted' backdoor used by North Korean-affiliated threat actors (APT37/Kimsuky/Lazarus). The rule specifically monitors the 'Accept-Language' HTTP header for a specific construction containing 'mrt=' followed by 'msc=' or 'mst=', which is used as a covert mechanism for authentication or command signaling.
This rule detects HTTP POST requests characteristic of the curlRAT malware used by DPRK-affiliated threat actors. The detection looks for a specific POST body format containing 'name=', '&value=', and '&type=' parameters, which indicates C2 communication patterns commonly associated with this specific backdoor.
Detects web requests targeting Oracle PeopleSoft Integration Broker (PSIGW) endpoints that contain suspicious query parameters associated with exploitation attempts, such as path traversal sequences, command injection patterns, or Java-based class invocations. This rule is designed to identify exploitation attempts against PeopleSoft systems as observed in the mid-2026 ShinyHunters zero-day campaign.
Detects potential NTLM relay attacks targeting Active Directory Certificate Services (AD CS) web enrollment endpoints, including subsequent certificate requests for sensitive templates. This pattern identifies attackers attempting to relay NTLM authentication to AD CS and potentially requesting certificates for high-privilege templates (e.g., DomainController, SubCA, Machine, or User) to facilitate privilege escalation.
This rule detects potential Browser-in-the-Browser (BitB) phishing attacks by identifying suspicious browser pop-up behavior (using window.open flags, hidden address/toolbars) on non-identity-provider domains, followed shortly by credential submission patterns on the same device. This pattern mimics legitimate OAuth or SSO windows to harvest user credentials.
Detects a sequence of potentially malicious activity targeting LLM-related API endpoints. The rule identifies a client IP performing rapid, distinct endpoint discovery, followed by a POST request to sensitive paths, and concluding with a spike in 5xx server-side errors, indicating potential exploitation attempts or fuzzing against Large Language Model interfaces.
Detects a sequence of potentially malicious activity targeting LLM-related API endpoints. The rule identifies a client IP performing rapid, distinct endpoint discovery, followed by a POST request to sensitive paths, and concluding with a spike in 5xx server-side errors, indicating potential exploitation attempts or fuzzing against Large Language Model interfaces.
Detects web servers serving significantly different content sizes to AI crawlers (e.g., ChatGPT-User, ClaudeBot) compared to human web browsers for the same URL, which is a technique used to serve benign content to automated scrapers while delivering malicious or deceptive content to human users.
This rule performs a point-in-time sweep for known Indicators of Compromise (IOCs) associated with the NeedyMantis threat actor group. The detection logic searches for specific file, process, and image-load SHA256 hashes, communication with a known C2 domain (tripswithengine.com), and the use of a hard-coded user-agent string (Firefox/21.0) across various telemetry sources within the last 30 days.
This rule detects attempts to exploit a pre-authentication path traversal and unsafe file-upload vulnerability (CVE-2026-93616) in Check Point Management Server. It monitors web server logs for specific application-level error messages related to ReflectionUtils failure and suspicious path traversal sequences (../) in request URLs.
This rule detects suspicious HTTP POST requests to a /collect endpoint that contain tracking parameters (visitorId, stage, variant, events) associated with 'ClickFix' social engineering campaigns. These campaigns typically trick users into copying and pasting malicious code by simulating error prompts or CAPTCHAs.
Detects unauthorized HTTP requests to sensitive Cisco Identity Services Engine (ISE) API and administrative paths (/ers/, /admin/, /api/). The rule specifically looks for incoming requests that lack both an Authorization header and a Cookie header, which is indicative of potential exploitation attempts against vulnerabilities such as CVE-2026-76460, where authentication mechanisms might be bypassed or ignored.
Page 16 of 202