Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
565 detections
Filters
Last updated
All Time
Detection languages
464
49
14
12
11
Contributors
217
119
88
54
41
Categories
20,443
11,831
5,875
5,151
4,864
565
Platforms
495
55
21
17
14
Products / Services
468
195
64
23
14
MITRE Techniques
180
93
66
63
60
CVEs
4
4
4
4
3
IDS Classtypes
303
37
23
23
21
IDS Protocols
449
3
Detects instances of an mcp-grafana server responding with an HTTP 200 status code to a 'tools/call' request without an Authorization header, indicating potential unauthenticated remote tool execution on a vulnerable or misconfigured server.
Detects an HTTP GET request to 'dl.php' containing an 'f' parameter (target file) and an 'k' parameter (access token), followed by a response body starting with the 'MZ' header, indicating the successful download of a Windows PE executable as part of a potential phishing campaign stage-2 payload delivery.
Detects an HTTP GET request to 'dl.php' containing an 'f' parameter (target file) and an 'k' parameter (access token), followed by a response body starting with the 'MZ' header, indicating the successful download of a Windows PE executable as part of a potential phishing campaign stage-2 payload delivery.
This rule detects sophisticated phishing lure pages impersonating DocuSign or NFe documentation. It specifically identifies pages that implement multi-layered anti-bot gating techniques, including detection of browser automation (navigator.webdriver), identification of headless browser artifacts (headless/HeadlessChrome), and the presence of interaction-wait fallback timers using addEventListener, all tied to specific malicious content indicators.
Detects Server-Side Request Forgery (SSRF) attempts targeting an MLflow server where an attacker-controlled HTTP redirect response forces the server to reach out to the cloud instance metadata service at 169.254.169.254. This rule specifically looks for HTTP 30x redirect status codes where the Location header contains the sensitive metadata service IP address.
Detects Server-Side Request Forgery (SSRF) attempts targeting an MLflow server where an attacker-controlled HTTP redirect response forces the server to reach out to the cloud instance metadata service at 169.254.169.254. This rule specifically looks for HTTP 30x redirect status codes where the Location header contains the sensitive metadata service IP address.
Detects indicators of cross-site scripting (XSS) attacks aimed at stealing web session cookies. The rule covers the injection of malicious scripts into client responses, anomalous CORS preflight responses that could facilitate data exfiltration, and subsequent HTTP callbacks or beaconing containing cookie data to external endpoints.
This rule detects potential unauthenticated access or unauthorized configuration modifications to an AI agent management backend. It monitors HTTP logs for requests targeting configuration endpoints that lack proper authentication, specifically identifying attempts to retrieve sensitive information like Dify or Coze keys, or attempts to inject new agent configurations via unauthenticated POST requests.
Detects instances of an mcp-grafana server responding with an HTTP 200 status code to a 'tools/call' request without an Authorization header, indicating potential unauthenticated remote tool execution on a vulnerable or misconfigured server.
Detects malicious traffic directed towards unpkg.com associated with the 'Beamglea' campaign. The rule specifically monitors for connections to known malicious npm-mirrored packages or pages serving fake Cloudflare CAPTCHA challenges, which are common tactics for credential theft and browser-based exploitation.
This rule detects potential unauthenticated access or unauthorized configuration modifications to an AI agent management backend. It monitors HTTP logs for requests targeting configuration endpoints that lack proper authentication, specifically identifying attempts to retrieve sensitive information like Dify or Coze keys, or attempts to inject new agent configurations via unauthenticated POST requests.
This rule detects sophisticated phishing lure pages impersonating DocuSign or NFe documentation. It specifically identifies pages that implement multi-layered anti-bot gating techniques, including detection of browser automation (navigator.webdriver), identification of headless browser artifacts (headless/HeadlessChrome), and the presence of interaction-wait fallback timers using addEventListener, all tied to specific malicious content indicators.
Detects evidence of malicious file tampering on public CDNs (bootcdn.net, bootcss.com, staticfile.org) associated with the Funnull campaign. The rules identify specific malicious file hashes and anomalous oversized file sizes that indicate the presence of injected malicious loaders within common JavaScript libraries.
Detects evidence of malicious file tampering on public CDNs (bootcdn.net, bootcss.com, staticfile.org) associated with the Funnull campaign. The rules identify specific malicious file hashes and anomalous oversized file sizes that indicate the presence of injected malicious loaders within common JavaScript libraries.
Detects malicious traffic directed towards unpkg.com associated with the 'Beamglea' campaign. The rule specifically monitors for connections to known malicious npm-mirrored packages or pages serving fake Cloudflare CAPTCHA challenges, which are common tactics for credential theft and browser-based exploitation.
This rule detects potential unauthenticated access or unauthorized configuration modifications to an AI agent management backend. It monitors HTTP logs for requests targeting configuration endpoints that lack proper authentication, specifically identifying attempts to retrieve sensitive information like Dify or Coze keys, or attempts to inject new agent configurations via unauthenticated POST requests.
Detects instances of an mcp-grafana server responding with an HTTP 200 status code to a 'tools/call' request without an Authorization header, indicating potential unauthenticated remote tool execution on a vulnerable or misconfigured server.
Detects instances of an mcp-grafana server responding with an HTTP 200 status code to a 'tools/call' request without an Authorization header, indicating potential unauthenticated remote tool execution on a vulnerable or misconfigured server.
This rule detects potential unauthenticated access or unauthorized configuration modifications to an AI agent management backend. It monitors HTTP logs for requests targeting configuration endpoints that lack proper authentication, specifically identifying attempts to retrieve sensitive information like Dify or Coze keys, or attempts to inject new agent configurations via unauthenticated POST requests.
This rule monitors for HTTP traffic directed at .vu TLD domains, which contain the specific Cloudflare 'Just a moment' browser-check page. This pattern is characteristic of the NovaCookies Phishing-as-a-Service (PhaaS) platform, which uses such gates to prevent automated analysis and security scanners from accessing the final phishing page.
Detects network traffic associated with the BengalSEO campaign, specifically the retrieval of a rogue Matomo analytics script from 'stats.us3.org' and the presence of a specific Google Tag Manager ID (G-5Y9CZZF6WJ) in file traffic. This behavior is indicative of a supply chain or SEO poisoning attack aiming to track or redirect users.
Page 10 of 27