Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects anomalous HTTP GET requests to the Microsoft Teams trap-exp/tokens endpoint that do not carry the expected 'Teams' user-agent string. This pattern is indicative of the DragonForce backdoor attempting to illicitly request Skype authentication tokens.
Detects specific markers in UDP traffic on ports 3478, 5349, and 443 that are associated with the DragonForce malware's TRN1 C2 beaconing protocol. The rules identify session initiation, task polling, task acknowledgment, and result uploading behaviors.
Detects specific markers in UDP traffic on ports 3478, 5349, and 443 that are associated with the DragonForce malware's TRN1 C2 beaconing protocol. The rules identify session initiation, task polling, task acknowledgment, and result uploading behaviors.
Detects network activity associated with the DragonForce backdoor, specifically the use of MQTT for command and control. The rules monitor for unique 16-character client IDs used during registration on non-standard ports, subsequent command retrieval structures containing 'cmdnum', and DNS queries for the hardcoded broker 'broker.emqx.io'.
Detects network activity associated with the DragonForce backdoor, specifically the use of MQTT for command and control. The rules monitor for unique 16-character client IDs used during registration on non-standard ports, subsequent command retrieval structures containing 'cmdnum', and DNS queries for the hardcoded broker 'broker.emqx.io'.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects outbound HTTP POST requests destined for 'aware-cr1.com' targeting the URI '/api/beacon', which is indicative of command-and-control (C2) communication associated with the 2CLoader malware.
This rule detects HTTP GET requests to a specific IP address (62.60.226.185) attempting to download a file named 't0907.exe'. This pattern is associated with the delivery phase of the 2CLoader malware.
This rule detects an exploitation attempt targeting the ConnectWise ScreenConnect Path Traversal vulnerability (CVE-2024-1708). The detection monitors incoming HTTP traffic for attempts to traverse the file system by inspecting the URI for repeated '..' sequences within the '/App_Extensions/' directory, a hallmark of this vulnerability.
Detects incoming HTTP POST requests to the 'diffpatch' endpoint in Gitea that contain suspicious 'diff --git' patterns combined with path traversal sequences ('../') targeting 'hooks/' directories. This indicates an attempt to exploit CVE-2026-60004 to achieve unauthorized file system access or remote code execution via repository hooks.
This rule detects HTTP GET requests to known malicious domains or URI patterns associated with fake video-conferencing lures. These lures redirect users to download RMM (Remote Monitoring and Management) MSI installers, often masquerading as legitimate software like Adobe Reader or video conferencing tools, as part of a social engineering campaign for initial access.
Detects incoming HTTP POST requests to internal AI/LLM API endpoints containing common prompt injection strings, such as instructions to ignore previous system prompts or attempts to trigger jailbreak modes like 'DAN'.
Detects attempts to exploit a vulnerability (CVE-2026-68536) in the Apache MyFaces JSF resource handler. The rule monitors for malicious URI parameters ('ln' or 'library') that attempt Server-Side Request Forgery (SSRF) targeting cloud metadata services, path traversal, or URI-based injection attacks.
This rule detects attempts to exploit CVE-2026-93647, a Stored Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic Webclient. The exploit involves injecting malicious script tags or JavaScript event handlers into calendar fields such as SUMMARY, DESCRIPTION, or LOCATION. The detection monitors inbound TCP traffic on web ports used by the application, specifically looking for common XSS injection patterns within calendar-related fields.
Detects potential SQL injection attempts targeting Cisco AsyncOS Email Gateways via the SMTP DATA command. The rule monitors for malicious patterns, specifically those attempting to execute unauthorized commands or database queries (such as COPY TO PROGRAM or embedded SQL statements) within SMTP traffic.
Detects attempts to exploit an unauthenticated OS command injection vulnerability in Cisco ISE (CVE-2026-20130). The rule monitors inbound HTTP traffic for shell metacharacters and common command-line binaries in the URI or request body, indicating an attempt to execute arbitrary commands on the underlying host.
Detects network traffic patterns characteristic of the EternalBlue (MS17-010) exploit targeting the SMBv1 protocol. Specifically, it monitors for a malformed SESSION_SETUP request containing an unusually large payload, which is indicative of an attempt to trigger a buffer overflow in the SMB service.
Detects network requests to the domain 'cloud-ack.workers.dev', which is known to be used as a redirector for hosting Microsoft authentication lookalike pages to conduct phishing attacks.
Detects unauthenticated network requests targeting MLflow Model Registry and Ajax API endpoints on port 5000. These requests are characteristic of unauthorized reconnaissance against exposed machine learning management services.
Detects unauthorized attempts to access exposed Chroma or Weaviate vector database APIs via standard HTTP requests (GET/POST) targeting known API endpoints for collections or objects. This may indicate an adversary conducting reconnaissance on publicly accessible database infrastructure.
Page 11 of 110