Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects network activity communicating with Google Drive domains (drive.google.com and www.googleapis.com). This rule monitors outbound traffic, which may indicate the use of Google Drive as a command-and-control (C2) channel or for unauthorized data exfiltration.
Detects periodic POST requests to an external endpoint containing specific request parameters (name, value, type) and a 'User-token' header, consistent with the expected beaconing intervals of the curlRAT malware (12h or 30s fast-poll).
Detects periodic POST requests to an external endpoint containing specific request parameters (name, value, type) and a 'User-token' header, consistent with the expected beaconing intervals of the curlRAT malware (12h or 30s fast-poll).
This rule correlates successful Microsoft 365 sign-in events with preceding network events involving identified NovaCookies AiTM phishing infrastructure (specifically targeting .vu domains or specific URL patterns). It triggers when a user successfully authenticates using MFA shortly after accessing a known phishing link, which is a strong indicator of an active AiTM session hijacking attempt.
Detects cross-site scripting payloads in the request URI.
Detects common SQL injection attack patterns such as UNION SELECT, OR 1=1, DROP TABLE, and others within the request URI of Caddy web server logs.
Detects probing of common sensitive paths such as .env, .git, wp-admin, phpmyadmin.
Detects access attempts to sensitive files such as xmlrpc.php, .htaccess, wp-config.php, /etc/shadow.
Detects incoming HTTP requests to a Caddy web server using the TRACE or TRACK methods. These methods are rarely used in legitimate production traffic and are frequently associated with Cross-Site Tracing (XST) attempts, which can be used to bypass security controls and steal sensitive data such as cookies.
This rule identifies potential command and control (C2) activity by correlating DNS over HTTPS (DoH) requests initiated by non-browser or unsigned processes with subsequent network connections to a known malicious C2 domain (gw.proxyvector.cc) within a 15-minute window.
This rule identifies potential command and control (C2) activity by correlating DNS over HTTPS (DoH) requests initiated by non-browser or unsigned processes with subsequent network connections to a known malicious C2 domain (gw.proxyvector.cc) within a 15-minute window.
Detects network activity related to the Toy Ghouls 'matrix-bird-agent' backdoor. The rule identifies communication with the domain 'meet.element.tw' via TLS SNI and HTTP host headers, as well as specific Matrix API event types (m.bird.status, m.bird.metrics, m.bird.cmd_response) and references to 'panel-bot' within the HTTP request body, indicating potential command-and-control behavior.
Detects unauthenticated requests to the WordPress admin-ajax.php endpoint utilizing the 'super_create_nonce' action. This action allows an unauthenticated user to generate a valid session nonce, which is a critical bypass mechanism often required for the exploitation of vulnerabilities within the Super Forms plugin, such as CVE-2026-14894.
Detects local/remote file inclusion attempts via php wrappers and similar schemes.
Detects empty, placeholder, or abnormally long User-Agent headers often used to evade fingerprinting.
This rule monitors web server logs (IIS, W3C, and Azure Application Gateway) for incoming traffic that matches known malicious or automated vulnerability scanners, as well as requests for common system fingerprinting paths (such as /server-status or /.git/config). The rule aggregates these hits by source IP address to identify potential active reconnaissance or vulnerability scanning attempts.
Detects outbound HTTP GET/POST requests containing 'event=pasted' in the query string or URL, often directed at paths like '/api/metrics/run'. This pattern is associated with 'ClickFix' or 'AMOS' second-stage beaconing, where an adversary confirms a victim has successfully executed a social-engineered command (e.g., via copy-paste into a terminal) before proceeding with further payload delivery.
Detects unauthenticated attempts to invoke Grafana API tools via the Model Context Protocol (MCP) by utilizing spoofed Mcp-Session-Id headers while bypassing bearer token authentication requirements. This primarily targets unauthorized access to API functionality on Grafana instances configured with bearer-token authentication (v1.1.0+).
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Detects potential Server-Side Request Forgery (SSRF) attacks targeting Grafana instances. The rule identifies suspicious 'grafana_api_request' calls that occur shortly after an unauthenticated discovery call ('tools/call') within the same session, where the target URL in the request header is not included in a defined allowlist of known internal Grafana hosts.
Page 94 of 202