Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,443
11,831
5,875
5,151
4,864
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects network traffic containing specific User-Agent strings used by the BurrowShell implant and the Rust-based keylogger to masquerade as legitimate Windows Update or browser traffic. These User-Agent strings are 'Windows-Update-Agent/10.0.10011.Client-Protocol/2.50' and 'Mozilla/5.0 (compatible; SecureNet/1.2)'.
This rule detects network connections to or from known suspicious IP addresses and requests to known suspicious domains. These indicators are often associated with command and control (C2) activity, malware distribution, or other malicious infrastructure.
Detects attempts to bypass authentication in SolarWinds Web Help Desk by exploiting the page restoration mechanism (CVE-2025-40552, CVE-2025-40554). An attacker can specify a sensitive page via the 'wopage' parameter to gain access to post-authentication functionality without valid credentials.
Detects attempts to exploit a remote code execution vulnerability (CVE-2025-40553) in SolarWinds Web Help Desk. Attackers use hex-encoded escape sequences (`\xNN`) and other JSON parsing gotchas to bypass security filters and achieve deserialization of malicious objects.
Detects attempts to exploit a deserialization vulnerability (CVE-2025-40553) in SolarWinds Web Help Desk. Attackers use non-standard hex escape sequences (e.g., `\xNN`) in JSON payloads to bypass security filters and achieve remote code execution.
Detects the beaconing activity of the HeaconLoad Golang downloader, a component of the BoryptGrab campaign. This malware sends HTTP POST requests containing system information to the "/healthcheck" endpoint on port 8088.
Detects HTTP requests to download the BoryptGrab stealer, which uses a specific URL pattern containing a hardcoded build name. This activity is characteristic of the initial launchers used in the BoryptGrab campaign to fetch the main stealer component from a C2 server.
This rule is meant to catch a very specific web request pattern tied to the SolarWinds Web Help Desk issue described in the report. The attack sends a crafted request to a known application path and includes a small group of values that are unusual in normal traffic but important in the exploit chain. The rule stays tight by requiring the request method, the path, and the special body values together. That matters because web applications often have busy and messy traffic, and loose matching on only one keyword would create noise. In plain language, this rule tries to spot a request that is not just using the help desk site, but is trying to abuse it to make the server handle attacker-controlled data in a dangerous way. It is best used as a high-confidence lead for review rather than a generic web alert. When it fires, it should be treated as a focused sign of attempted abuse rather than normal help desk.
Detects URL click events or browser launches where the URL targets Microsoft or Google OAuth endpoints and contains the combination of 'prompt=none' and 'scope=invalid'. This specific combination is used by attackers to force a silent error redirect to a malicious URI.
Detects the complete CVE-2026-21902 exploitation chain against Juniper Junos OS Evolved On-Box Anomaly Detection Framework. Requires all four steps: command creation, DAG creation, DAG instance scheduling, and commit.
Detects attempts to perform Indirect Prompt Injection (IDPI) by embedding malicious instructions for AI agents or Large Language Models (LLMs) within web content. This rule identifies when common prompt injection keywords are present in conjunction with CSS techniques used to hide the text from being rendered in a browser, a method used to evade human review while targeting automated systems.
Detects network traffic matching patterns used by the Chrysalis backdoor for C2 communications. The malware was observed using the domain 'api.skycloudcenter.com' and mimicking DeepSeek AI API URL paths to evade detection.
Detects Indirect Prompt Injection (IDPI) attempts where malicious instructions are dynamically injected into the DOM using JavaScript or concealed within HTML data attributes. Attackers use these methods to bypass static analysis tools and deliver hidden prompts to AI/LLM agents that process raw web content.
This rule is meant to help analysts quickly spot a high-confidence indicator related to Google AuraInspector Salesforce Aura Audit. It is written to be easy to understand and to keep false alarms low by focusing on a very specific match: an HTTP POST to a Salesforce /aura endpoint that includes specific Aura method strings. A match does not automatically prove an attacker is currently active, and it does not prove a file was executed, but it does mean the event is important because it lines up with a public threat intelligence source. When this triggers, start by identifying the host, user, and timeframe involved, then decide whether the activity is expected for that system. If it is unexpected, preserve the related logs and any files, and look for nearby events that could explain how the indicator appeared, such as a download, a new process, or a new connection. If the same indicator appears on multiple systems, treat it as a scoping signal and expand the investigation window. Use the reference link (https://cloud.google.com/blog/topics/threat- intelligence/auditing-salesforce-aura-data-exposure) to document where the indicator came from and to support incident notes and reporting.
Detects HTTP POST requests to the SolarWinds Web Help Desk (WHD) AjaxProxy endpoint that contain hex-encoded JSON keys or values (e.g., `\xNN`).
Attackers use this technique to bypass security filters and achieve remote code execution, as detailed in the exploit chain for CVE-2025-40552 and CVE-2025-40553.
Attackers use this technique to bypass security filters and achieve remote code execution, as detailed in the exploit chain for CVE-2025-40552 and CVE-2025-40553.
Detects web content containing strings associated with destructive commands or unauthorized financial transactions, often embedded as part of an Indirect Prompt Injection (IDPI) attack. These prompts are designed to be executed by an AI agent or LLM, potentially leading to data loss, denial of service, or financial theft.
Detect .NET hollowing technique
Suricata
.NET hollowing technique - external fetch of InstallUtil.exe (rare)
This rule set detects various activities associated with the Dohdoor malware campaign (UAT-10027). It includes detection for known malware hashes, suspicious network communication patterns such as DNS over HTTPS (DoH) to Cloudflare with specific user agents, staging URL patterns, and odd-cased infrastructure domains. Additionally, it identifies endpoint activities like curl downloading batch/command files and DLL sideloading attempts using specific DLL names and LOLBins executed from common public writeable directories. The intent is to provide strong leads for investigation into potential Dohdoor infections.
Identifies network connections to known command and control (C2) and dropper distribution infrastructure associated with the EncystPHP web shell campaign.
Triofox CVE-2025-12480
Suricata
Triofox CVE-2025-12480 - localhost Host header to admin setup pages
This detection identifies JSON Web Tokens (JWTs) with an expiration time ("exp" claim) that is set unusually far in the future. Attackers may forge tokens with long lifespans to maintain persistent access after an initial compromise.
Page 172 of 202