Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,443
11,831
5,875
5,151
4,864
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects network connections to a known Amatera Stealer C2 IP address where the HTTP Host header is spoofed. This technique is used by the malware to masquerade its C2 traffic, often by using a legitimate-looking or unrelated domain in the Host header, while communicating directly with the malicious IP address.
Detects network connections to the GitHub API attempting to fetch a 'command.txt' file. This behavior is characteristic of the GITSHELLPAD backdoor, which uses private GitHub repositories for command and control (C2) communication as seen in the Gopher Strike campaign.
Detects network connections to known infrastructure associated with the EncystPHP web shell campaign. This IP (45.234.176.202) was observed distributing the 'c' and 'k.php' droppers.
Detects attempts to exploit the SmarterMail authentication bypass vulnerability (WT-2026-0001) by sending a POST request to the /api/v1/auth/force-reset-password endpoint with 'IsSysAdmin' set to 'true'.
Detects C2 network traffic associated with PylangGhost and GolangGhost, RATs used by the PurpleBravo group. The malware sends an RC4-encrypted payload via an HTTP POST request to known C2 servers.
Detects C2 network traffic associated with the InvisibleFerret RAT, used by the PurpleBravo group. This malware uses a plaintext HTTP channel for beaconing, data exfiltration, and payload delivery to specific URI endpoints.
Detects HTTP POST requests to the Appsmith password reset endpoint where the 'Origin' header does not match the expected internal or legitimate application domain. This is indicative of an attempt to exploit CVE-2026-22794 to achieve account takeover.
Detects attempts to exploit the ServiceNow 'BodySnatcher' vulnerability (CVE-2025-12420) by invoking the internal 'AIA-Agent Invoker AutoChat' topic to execute arbitrary AI agents.
This rule detects an attempt to exploit an XML External Entity (XXE) vulnerability in GeoServer's Web Map Service (WMS) GetMap function. The detection logic looks for HTTP POST requests to the '/wms?' endpoint containing 'request=GetMap' in the URI, and specific XML elements like '<StyledLayerDescriptor>', '<!DOCTYPE', '<!ENTITY', and 'SYSTEM' within the request body, along with a URL-like pattern '://' indicating an attempt to fetch external content.
Detects the injection of a malicious iframe with attributes that impersonate the legitimate Stripe payment interface. This technique is used by Magecart actors to steal credit card data by replacing the real payment form with a clone.
Detects outbound network traffic with a User-Agent header indicating the use of the Rust 'reqwest' HTTP client library. This User-Agent is used by the RustyWater implant, associated with the MuddyWater APT group, for command and control (C2) communications.
SleepyDuck Malware Etherhiding
Cortex XDR
This rule detects network connections to specific RPC addresses and a contract address associated with the SleepyDuck malware's Etherhiding technique. It filters for DNS queries containing known RPC domains and HTTP/network activity containing a specific Ethereum contract address. This indicates potential communication with the malware's command and control infrastructure for persistence.
Detects specific User-Agent strings associated with the DDoSia malware, which is used by the NoName057(16) hacktivist group for DDoS attacks. The rule looks for two distinct User-Agent patterns in HTTP traffic.
Detects HTTP POST requests to n8n '/form/*' endpoints where the Content-Type header is 'application/json'. This indicates an attempt to exploit the Content-Type confusion vulnerability (CVE-2026-21858) to achieve arbitrary file read and subsequent remote code execution.
Detects network communication patterns
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
Detects command injection attempts in HTTP POST requests targeting IoT device web interfaces, a technique used by the RondoDoX botnet to compromise vulnerable devices.
This rule detects patterns indicative of an Evilginx-style Adversary-in-the-Middle (AiTM) phishing attack. It specifically looks for HTTP requests to hostnames ending in suspicious top-level domains (TLDs) such as .click, .online, .cloud, or .shop, combined with specific URI paths like /wlc/, /load/, or /success/. These patterns are commonly used by AiTM redirectors to capture credentials and session tokens.
Detects HTTP POST requests containing WDDX XML payloads that attempt to exploit a deserialization vulnerability in Adobe ColdFusion (CVE-2023-26359). The attack leverages a JNDI injection with the 'com.sun.rowset.JdbcRowSetImpl' gadget chain.
Identifies JSON Web Tokens (JWTs) where the signing algorithm in the header ('alg') is set to 'none'. A server that incorrectly trusts this header may skip signature validation, allowing an attacker to create arbitrary tokens and bypass authentication controls.
Detects potential exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882, which allows for unauthenticated remote code execution. This rule looks for specific web request URIs, post-exploitation process activity, and known indicators of compromise (IOCs).
Page 176 of 202