Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,453
11,838
5,876
5,154
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects attempts to download Python packages from the official Python Package Index (PyPI) where the package name in the URI appears to be a typosquatted version of common legitimate packages. Specifically, it looks for HTTP requests to pypi.org with URIs containing 'requets' (instead of 'requests'), 'boto' (instead of 'boto3' or similar), 'djang0' (instead of 'django'), 'flask2' (instead of 'flask'), or 'numpy2' (instead of 'numpy'). This indicates a potential supply chain attack where an attacker has registered a similarly named malicious package to trick users into downloading it.
This rule detects attempts to capture credentials via an 'Evil Twin' access point by looking for HTTP POST requests to URIs containing both 'login' and 'wifi'. This combination suggests a malicious captive portal designed to trick users into submitting their credentials.
This rule detects potential open redirect attempts by monitoring W3C IIS logs for URI queries containing keywords like 'callback', 'redirect', or 'url='. It then aggregates these attempts by client IP address and time, triggering an alert if five or more such attempts are observed within an hour from a single IP. This pattern can indicate an attacker attempting to exploit an open redirect vulnerability to phish users or bypass security controls.
This rule detects an unusually high number of web search queries (identified by 'search' or 'query' in the URI) originating from a single IP address within a one-hour window. A threshold of 100 or more queries triggers the alert. This behavior could indicate automated activity such as web scraping, reconnaissance, or a denial-of-service attempt against the search functionality.
Detects web requests containing common SQL injection payloads or specific PoC metacharacters embedded within JSON:API filter array keys targeting Drupal CVE-2026-9082. The rule specifically looks for requests to Drupal's JSON:API that include 'filter[' and '[condition][value][' in the URI query, combined with SQL injection indicators such as '--', 'UNION', 'SELECT', '$$', '.$', or 'RAPTORMARKER42'.
This rule detects network connections originating from clients using a specific User-Agent string associated with the SessionGate malware. The User-Agent string 'NSIS_InetLoad' combined with 'Mozilla' is indicative of SessionGate C2 check-ins, leveraging the NSIS (Nullsoft Scriptable Install System) InetLoad plugin. The rule searches across common proxy and web logs for this pattern.
This rule detects potential command and control (C2) activity where a compromised WordPress site is used as a relay. It specifically looks for HTTP POST requests to URIs containing "wp-admin" with a data size greater than 1000 bytes. A threshold of 5 such events within 60 seconds from the same source IP triggers the alert, indicating a potential high volume of C2 communication.
This rule detects attempts to sell or exchange VPN credentials by looking for the keywords "vpn" and "credentials" in the client body of HTTP traffic. This could indicate an attacker attempting to monetize stolen VPN access or an insider threat attempting to leak sensitive access information.
This rule detects potential employee directory enumeration attempts via web requests. It triggers when HTTP URI content contains both 'directory' and 'people' (case-insensitive) within a 60-second window from the same source IP, with a threshold of 10 occurrences. This behavior is indicative of an attacker attempting to discover employee information or organizational structure.
This rule detects potential email address harvesting via web scraping by identifying a high volume of HTTP GET requests to URIs containing the word "contact" within a short timeframe from a single source IP address. The threshold is set to 30 requests within 30 seconds, indicating automated or rapid access attempts often associated with scraping activities.
This rule detects a high rate of HTTP GET requests from a single source IP address to internal web servers, indicating a potential reconnaissance activity. Specifically, it triggers if a source IP makes 50 or more HTTP GET requests within a 30-second window. This behavior could be indicative of an attacker attempting to map out web application structure or discover vulnerabilities.
This rule detects attempts to harvest physical location data via web requests. It specifically looks for HTTP GET requests where the URI contains both 'location' and 'address' (case-insensitive). A threshold of 15 such requests within 30 seconds from the same source IP triggers the alert, indicating a potential network scan or automated data collection activity.
Robots.txt Discovery Access
Suricata
This rule detects HTTP requests for '/robots.txt'. This file is commonly accessed by automated tools and attackers during the reconnaissance phase to understand a website's structure and identify disallowed paths. The detection is based on the URI content and is classified as a network scan.
This rule detects network traffic where the HTTP referer header contains "web.archive.org". This indicates that a user on the internal network is navigating to a website via a link from the Wayback Machine, which could be a sign of reconnaissance activity, where an attacker or insider is researching past versions of a website or looking for historical information that might no longer be publicly available on the live site. The rule specifically looks for established HTTP connections flowing to the server.
This rule detects automated web crawlers by identifying a high rate of HTTP GET requests from a single source IP address to the home network. Specifically, it triggers an alert if a source IP makes 100 or more GET requests within a 30-second window.
This rule detects bulk scraping of LinkedIn company profiles. It triggers when a client makes 20 or more HTTP requests to 'linkedin.com' with a URI containing '/company/' within a 60-second window. This behavior is indicative of automated tools attempting to extract large amounts of public company data from LinkedIn.
This rule detects attempts to access a web page on an IoT device that contains both 'about' and 'firmware' in its URI, case-insensitively. This could indicate an attacker or researcher attempting to discover firmware details or disclosure pages on IoT devices, potentially as part of a reconnaissance effort.
This rule detects attempts to discover the origin server behind a Content Delivery Network (CDN). It triggers when an HTTP request is made to a host containing "cdn" (case-insensitive) and the URI contains "origin" (case-insensitive). This behavior is indicative of reconnaissance activities where an attacker tries to bypass CDN protections to directly target the backend server.
This rule detects attempts to discover the 'security.txt' file on a web server. The 'security.txt' file is a proposed standard for security researchers to easily find contact information for reporting security vulnerabilities. Attackers or reconnaissance tools might look for this file to identify potential targets or gather information about an organization's security posture.
This rule detects potential career page scraping activity, which could be an indicator of reconnaissance by an attacker. It triggers when a client makes 15 or more HTTP requests containing 'careers' in the URI within a 30-second window, suggesting automated or rapid browsing of career-related pages.
This rule detects bulk access to web pages containing the term 'press' in their URI, indicating potential business intelligence gathering or reconnaissance activity. It triggers an alert if a single source IP makes 20 or more such requests within a 30-second window.
Page 166 of 202