Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,456
11,839
5,876
5,155
4,865
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects unauthorized POST requests to the '/Windchill/login/' directory targeting .jsp files. This path is not used by legitimate PTC Windchill/FlexPLM traffic and is indicative of an adversary attempting to interact with a webshell or exploit a vulnerability such as CVE-2026-12569.
This rule monitors web server access logs for common attack patterns, including SQL injection, Cross-Site Scripting (XSS), Path Traversal/LFI, Remote File Inclusion (RFI), potential JNDI-based RCE (e.g., Log4Shell patterns), web shell activity, and sensitive endpoint discovery or enumeration (specifically targeting WordPress/CMS).
This rule detects potential Web Proxy Auto-Discovery (WPAD) abuse by monitoring for network requests to 'wpad.dat' or 'wpad' resources on port 80, specifically on endpoints that have been tagged as connected to untrusted or public networks (e.g., guest, hotel, public). WPAD abuse is a common technique used by attackers to force devices to use a malicious proxy, enabling traffic interception and potential credential theft.
Detects HTTP traffic to the hardcoded Heroku-hosted SNOWGLAZE C2 endpoint (sad4w7h913-b4a57f9c36eb.herokuapp.com) where the client requests a WebSocket upgrade on the /ws URI and sends a JSON body containing login, password, and uuid fields used to authenticate the tunnel to the actor's C2 infrastructure.
This rule detects DNS queries, HTTP Host headers, and TLS SNI values indicative of interaction with specific doppelganger domains designed to impersonate Microsoft online services (ms365-device.com, ms365-live.com, m365-owa.com, owa-ms365.com). Such activity is commonly associated with phishing or C2 infrastructure targeting Microsoft 365 environments.
SNOWBELT time-based DGA S3 bucket manifest retrieval
Detects outbound network traffic to the 'logfriend[.]com' domain, specifically to endpoints used by the Forg365 'ForgCookie' browser extension. This extension is known to facilitate the automated refreshing of Microsoft SSO cookies, potentially enabling persistent session hijacking and bypassing MFA.
Detects outbound FOFA asset-search traffic containing an exact title="Langflow" query directed at the FOFA API host (fofa.info), indicating reconnaissance for Langflow deployments.
Detects a CountLoader command-and-control pattern where a process issues an HTTP GET to a /connect endpoint with XOR-hex-style query parameters, followed within one hour by an Authorization: Bearer JWT token reused by the same process, host, and agent.
Detects HTTP GET requests with an Upgrade: websocket header directed at known UNC6692 Edgecution/SNOWBELT malware command-and-control infrastructure hosted on CloudFront subdomains via the /ws URI path. This indicates active WebSocket-based communication between an infected host and the threat actor's C2 server.
Detects inbound HTTP requests targeting specific hosts (photo.pokok.edu.hk, pta.sfaeps.edu.hk) with URI patterns associated with exploitation campaigns targeting vulnerabilities including CVE-2018-11511, CVE-2021-24139, CVE-2021-31755, and CVE-2021-32305.
Detects high-frequency outbound HTTP traffic matching specific URI patterns associated with potential Adaptix C2 beaconing behavior. The rule uses a sliding window threshold (10 requests within 600 seconds) to identify repetitive check-in patterns, which is a common characteristic of malware command-and-control channels.
Detects potential SQL injection attempts targeting the WordPress REST API batch endpoint (/wp-json/batch/v1) specifically attempting to query the wp_users table for credential fields such as user_pass or user_login.
This rule detects proxy requests directed to the legitimate Microsoft OAuth 2.0 device authorization endpoint (/common/oauth2/deviceauth). This activity is indicative of OAuth device code phishing, where a user is tricked into entering a malicious or attacker-provided device code into the legitimate Microsoft device login page to complete an authentication flow and grant unauthorized access to an attacker-controlled application.
Detects malicious SQL injection attempts targeting WordPress REST API endpoints that attempt to forge post parameters by injecting self-referential cycles. The pattern specifically looks for 'UNION SELECT' combined with 'author_exclude' and manipulated 'post_parent' values, matching known exploitation patterns for the wp2shell vulnerability (CVE-2026-63030 / CVE-2026-60137).
Detects outbound HTTP GET requests to google.com that utilize a bare 'Mozilla/5.0' User-Agent header, which is indicative of the TOKYOCORE malware performing network connectivity checks. This behavior is atypical for standard browsers and can be used to identify potential beaconing activity.
Detects malicious SQL injection attempts targeting WordPress REST API endpoints that attempt to forge post parameters by injecting self-referential cycles. The pattern specifically looks for 'UNION SELECT' combined with 'author_exclude' and manipulated 'post_parent' values, matching known exploitation patterns for the wp2shell vulnerability (CVE-2026-63030 / CVE-2026-60137).
Detects malicious SQL injection attempts targeting WordPress REST API endpoints that attempt to forge post parameters by injecting self-referential cycles. The pattern specifically looks for 'UNION SELECT' combined with 'author_exclude' and manipulated 'post_parent' values, matching known exploitation patterns for the wp2shell vulnerability (CVE-2026-63030 / CVE-2026-60137).
Detects the clipboard_start/clipboard_stop/clipboard_data C2 command schema used by ChonkyChicken for clipboard monitoring.
Detects HTTP traffic patterns characteristic of suo5 and Neo-reGeorg web shell tunnels. These tools facilitate bidirectional communication through JSP endpoints (e.g., /jmx/suo5.jsp, /common/themes/top_css.jsp) by utilizing hardcoded proxy identifiers in HTTP headers. This behavior is indicative of a compromised web server acting as a pivot point for command-and-control operations.
Detects high-frequency HTTP GET request patterns indicative of bulk vulnerability scanning using the Nuclei scanner against public-facing web services. The rule triggers when a source IP initiates 250 or more requests within a 300-second window, excluding pre-authorized scanner source IP addresses.
Page 99 of 202