Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
565 detections
Filters
Last updated
All Time
Detection languages
464
49
14
12
11
Contributors
217
119
88
54
41
Categories
20,443
11,831
5,875
5,151
4,864
565
Platforms
495
55
21
17
14
Products / Services
468
195
64
23
14
MITRE Techniques
180
93
66
63
60
CVEs
4
4
4
4
3
IDS Classtypes
303
37
23
23
21
IDS Protocols
449
3
Detects exploitation attempts against Joomla websites targeting CVE-2023-23752. This vulnerability allows an unauthenticated attacker to disclose sensitive information, such as configuration details or user data, by crafting specific GET requests to the Joomla API.
Detects HTTP traffic originating from external sources that contains response body patterns associated with a DEBULL-themed phishing lure. This rule specifically identifies content indicators related to device-code broker phishing, where a user is tricked into navigating to a malicious URL (debull.app) to authorize access or provide credentials.
Detects the download of a Mach-O executable file over unencrypted HTTP. The rule identifies the Mach-O magic byte header ('CF FA ED FE') within the first few bytes of the HTTP response body, indicating a file download originating from an external network source.
This rule detects potential unauthorized access and environment variable disclosure attempts against the Flowise API, specifically targeting the MCP (Model Context Protocol) endpoints. It monitors for path traversal-like patterns using case variants (e.g., /api/v1/env), unauthorized access to configuration endpoints, and the exposure of sensitive data like API keys, database URLs, and passwords in API responses or request headers.
Detects network traffic containing a potentially malicious Microsoft Excel (.xlsx) OOXML file being downloaded. The rule identifies the presence of the 'Content-Disposition' header with an '.xlsx' extension, combined with a file signature matching the ZIP format (often used by OOXML files) and a file size exceeding 500KB, which may indicate an attempt to exploit CVE-2025-60727.
Detects network traffic containing a potentially malicious Microsoft Excel (.xlsx) OOXML file being downloaded. The rule identifies the presence of the 'Content-Disposition' header with an '.xlsx' extension, combined with a file signature matching the ZIP format (often used by OOXML files) and a file size exceeding 500KB, which may indicate an attempt to exploit CVE-2025-60727.
Detects anomalous HTTP upgrade requests (h2c, websocket) targeting potentially vulnerable web infrastructure (e.g., nghttpx). The rule correlates abnormal 'Upgrade' header usage, suspicious request paths (/poisoned, /upgrade), and subsequent 400 error codes, which are indicative of HTTP request smuggling attempts aimed at desynchronizing frontend and backend request queues.
Detects HTTP response bodies containing common PE/Shellcode magic headers (MZ, PE, or NOP sleds) which are associated with the delivery of payloads designed to exploit or utilize the Windows KernelCallbackTable for process injection. The detection focuses on suspicious content delivered over HTTP connections.
Detects outbound HTTP POST requests to suspicious URIs and subsequent inbound responses containing executable binary (PE) signatures, characteristic of Emotet malware command-and-control (C2) activity.
This rule detects HTTP responses that return an Android Package (APK) file (application/vnd.android.package-archive) to a client. This is indicative of potential mobile malware delivery or unauthorized application distribution.
This rule detects attempts to exfiltrate GCP service account credentials by performing a Server-Side Request Forgery (SSRF) attack targeting the GCP metadata server or local system files. It correlates suspicious outbound request patterns with subsequent response bodies containing standard GCP credential fields, excluding known legitimate authentication traffic to cloud APIs.
Detects web traffic where the referrer header contains keywords associated with gaming or educational themes (such as 'bioshock', 'game', 'puzzle', 'math', 'quiz') combined with access attempts to sensitive URI paths (like '/code', '/token', '/secret', '/private', '/api-key') resulting in a redirect status (301-308). This behavior pattern is often indicative of automated reconnaissance or exploitation attempts using non-standard or obfuscated referrers to bypass simple security filters.
This rule monitors outbound HTTP responses to detect the presence of the Montana Empire phishing panel by analyzing specific branding artifacts, such as strings like 'ENTER THE EMPIRE', '256-bit Encrypted', and 'Brute-force Protected' located within the HTTP response body associated with the URI '/mentalite.php'.
This rule monitors for two types of anomalous network behavior: first, it identifies connections to known domains from IP addresses not previously associated with those domains over a seven-day lookback period. Second, it identifies HTTP proxy responses (from Zscaler or Squid) where the content-length significantly deviates from the historical baseline for specific URLs. These patterns are potential indicators of C2 channel shifts or data exfiltration via web protocols.
Detects potential SSRF or local file read attempts by identifying requests to sensitive system or application file paths (e.g., /proc/self/environ, /etc/passwd) that result in an unusually large response body compared to the historical baseline for that endpoint.
Detects the transmission of a Metasploit Meterpreter stage over HTTP, identified by an application/octet-stream response containing the DOS MZ header signature.
Detects web traffic containing HTTP 301/302 redirects to known cloud hosting platforms (Azure, AWS, Cloudflare) that exhibit suspicious URL patterns or originate from identified malicious referrers associated with phishing or credential harvesting campaigns.
This rule detects potential phishing or cloaking activity where a web server response contains JavaScript logic that checks the visitor's User-Agent string using 'navigator.userAgent' and conditionally redirects the user via 'window.location'. This technique is commonly used to redirect specific targets (e.g., mobile devices or specific browsers) to malicious sites while serving benign content to others, often for credential harvesting or malware delivery.
This rule monitors for two types of anomalous network behavior: first, it identifies connections to known domains from IP addresses not previously associated with those domains over a seven-day lookback period. Second, it identifies HTTP proxy responses (from Zscaler or Squid) where the content-length significantly deviates from the historical baseline for specific URLs. These patterns are potential indicators of C2 channel shifts or data exfiltration via web protocols.
This rule monitors network traffic for HTTP POST requests directed toward specific destination ports (443 or 8770) that return HTTP status codes in the 4xx range (client errors), excluding known legitimate URI paths. This pattern may indicate scanning activity, exploitation attempts, or unauthorized access attempts against internal services or misconfigured applications.
Detects web traffic where the referrer header contains keywords associated with gaming or educational themes (such as 'bioshock', 'game', 'puzzle', 'math', 'quiz') combined with access attempts to sensitive URI paths (like '/code', '/token', '/secret', '/private', '/api-key') resulting in a redirect status (301-308). This behavior pattern is often indicative of automated reconnaissance or exploitation attempts using non-standard or obfuscated referrers to bypass simple security filters.
Page 12 of 27