Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,443
11,831
5,875
5,151
4,864
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
This rule detects network traffic patterns associated with the Turla group's STOCKSTAY malware, specifically identifying WebSocket upgrade requests directed at the external domain 'canal1zac1a.onrender.com'. This pattern is indicative of a Command and Control (C2) channel initiation.
This rule detects potential Remote Code Execution (RCE) exploitation attempts targeting Dell Wyse Management Suite (WMS) by identifying abnormally large POST requests containing JSON payloads directed at specific management paths (/WMS/ or /wyse/). This behavior is indicative of an exploit attempt against CVE-2026-41120.
Detects HTTP traffic attempting to upgrade a connection to a WebSocket protocol directed towards the known Turla-associated command-and-control infrastructure 'driverx86-adobe.onrender.com'. This pattern is characteristic of the STOCKBROKER component within the STOCKSTAY malware framework, observed in recent phishing campaigns.
Detects anomalous HTTP GET requests targeting the ClawHub API for 'skills' that match known patterns of malicious file downloads, specifically identifying poc.py scripts or skill.md files which are indicative of the ClawHavoc campaign activity.
Detects the transmission of a Windows executable binary file in an HTTP response stream, which may indicate an attempt to exploit vulnerabilities in Dell Wyse Management Suite (CVE-2026-41120 or CVE-2026-49506) by delivering malicious payloads.
This rule monitors HTTP traffic for the presence of a Python Pickle deserialization payload in the response body. Attackers use serialized Python objects to achieve remote code execution when these objects are improperly deserialized by a client application. This signature specifically looks for the hexadecimal byte sequence associated with the pickle protocol in conjunction with HTTP responses containing text or binary data.
Detects anomalous HTTP responses containing high-entropy, potentially multi-layered obfuscated payloads. The rule specifically monitors for patterns suggesting Base64, ROT13, and Hex encoding in the response body, which is consistent with methods used to deliver obfuscated malicious AI skills or scripts via web traffic.
Detects network traffic associated with the Turla group's STOCKSTAY malware, specifically identifying outbound WebSocket upgrade requests directed to the known command-and-control domain weatherdataai.theworkpc.com.
This rule detects network traffic patterns associated with the Turla group's STOCKSTAY malware, specifically identifying WebSocket upgrade requests directed at the external domain 'canal1zac1a.onrender.com'. This pattern is indicative of a Command and Control (C2) channel initiation.
This rule detects attempts to exploit a path traversal vulnerability (CVE-2026-49506) in the Dell Wyse Management Suite API. The rule inspects HTTP requests for directory traversal sequences such as '..' or URL-encoded equivalents, which could allow an unauthorized attacker to access files or directories outside the intended scope on the web server.
Detects HTTP GET requests for specific malicious archives (calculator.rar, EditorToolsPdf.zip) originating from suspected compromised Ukrainian domains (basecon.com.ua, online.zp.ua). This behavior is associated with the STOCKSTAY malware used by the threat actor Turla.
Detects the transmission of a Windows executable binary file in an HTTP response stream, which may indicate an attempt to exploit vulnerabilities in Dell Wyse Management Suite (CVE-2026-41120 or CVE-2026-49506) by delivering malicious payloads.
This rule monitors HTTP traffic for the presence of a Python Pickle deserialization payload in the response body. Attackers use serialized Python objects to achieve remote code execution when these objects are improperly deserialized by a client application. This signature specifically looks for the hexadecimal byte sequence associated with the pickle protocol in conjunction with HTTP responses containing text or binary data.
Detects anomalous HTTP responses containing high-entropy, potentially multi-layered obfuscated payloads. The rule specifically monitors for patterns suggesting Base64, ROT13, and Hex encoding in the response body, which is consistent with methods used to deliver obfuscated malicious AI skills or scripts via web traffic.
Detects outbound network traffic from internal hosts exhibiting characteristics of PowerShell-based download cradles, such as specific User-Agent strings or URL patterns associated with IEX DownloadString or Invoke-WebRequest.
Detects outbound network traffic established by a client using the default self-signed TLS certificate generated by Metasploit for Meterpreter Reverse HTTPS sessions. The rule looks for the common default subject fields 'CN=metasploit' and 'O=msf' within the TLS handshake.
This rule monitors incoming DNS traffic for A record responses containing RFC1918 private IP addresses (10.0.0.0/8, 172.16.0.0/12, or 192.168.0.0/16). This behavior is characteristic of DNS rebinding attacks, where a malicious web service resolves to a victim's internal network address to bypass browser same-origin policies.
This rule detects potential Cobalt Strike Beacon check-in activity over HTTP. It identifies incoming GET requests where the URI is abnormally short and the HTTP Referer header is missing, which are common indicators of default Cobalt Strike malleable C2 profiles.
Detects inbound HTTP requests containing the JNDI lookup string characteristic of attempts to exploit the Log4Shell vulnerability (CVE-2021-44228) in Java-based applications.
This rule detects outgoing HTTP POST requests containing patterns commonly associated with Emotet command-and-control (C2) communication, specifically identifying the use of an application/octet-stream content type combined with a specific, randomized URI path structure consisting of alphanumeric segments.
This rule detects repeated path traversal sequences (../ or ..%2F) in the HTTP URI. This behavior is indicative of an attacker attempting to escape the intended web directory to access sensitive files or configuration files on the underlying filesystem.
Page 104 of 110