Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
This rule detects potential command and control (C2) beaconing activity by monitoring for high-frequency POST requests to OpenAI and Google Generative Language chat completion API endpoints. The rule triggers when a source host makes 5 or more requests within a 60-second window, which may indicate automated polling for commands or exfiltrated data transfer using legitimate LLM infrastructure.
Detects a potential automated exploit sweep or brute-force attempt, identified by a high frequency of HTTP requests (GET or POST) directed to the same URI from a single source IP address within a short time frame.
Detects inbound HTTP POST requests directed at common paths associated with self-hosted OpenAI-compatible LLM inference APIs, such as LocalAI or vLLM. This rule identifies potentially unauthorized or unintended public exposure of internal LLM infrastructure, which could lead to unauthorized model usage, information disclosure, or exploitation of the inference engine.
This analytic detects intrusion events from known threat activity using Cisco Secure Firewall Intrusion Events.
It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where one or multiple Snort signatures
associated with a known threat or threat actor activity have been triggered within a one-hour time window. The detection uses a
lookup table (cisco_snort_ids_to_threat_mapping) to map Snort signature IDs to known threat actors and their techniques.
When multiple signatures associated with the same threat actor are triggered within the time window, and the count of
unique signatures matches or exceeds the expected number of signatures for that threat technique, an alert is generated.
This helps identify potential coordinated threat activity in your network environment by correlating related intrusion
events that occur in close temporal proximity.
Currently, this detection will alert on the following threat actors or malware families as defined in the cisco_snort_ids_to_threat_mapping lookup:
* AgentTesla
* Amadey
* ArcaneDoor
* AsyncRAT
* CastleRAT
* Chafer
* DCRAT
* LokiBot
* Lumma Stealer
* Nobelium
* Quasar
* Remcos
* Snake
* Static Tundra
* Xworm
To add or update threat actors, update the cisco_snort_ids_to_threat_mapping.csv lookup file with new or modified threat names and associated Snort signature IDs.
It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where one or multiple Snort signatures
associated with a known threat or threat actor activity have been triggered within a one-hour time window. The detection uses a
lookup table (cisco_snort_ids_to_threat_mapping) to map Snort signature IDs to known threat actors and their techniques.
When multiple signatures associated with the same threat actor are triggered within the time window, and the count of
unique signatures matches or exceeds the expected number of signatures for that threat technique, an alert is generated.
This helps identify potential coordinated threat activity in your network environment by correlating related intrusion
events that occur in close temporal proximity.
Currently, this detection will alert on the following threat actors or malware families as defined in the cisco_snort_ids_to_threat_mapping lookup:
* AgentTesla
* Amadey
* ArcaneDoor
* AsyncRAT
* CastleRAT
* Chafer
* DCRAT
* LokiBot
* Lumma Stealer
* Nobelium
* Quasar
* Remcos
* Snake
* Static Tundra
* Xworm
To add or update threat actors, update the cisco_snort_ids_to_threat_mapping.csv lookup file with new or modified threat names and associated Snort signature IDs.
This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of unwanted applications. This activity can signify possible compromised hosts on the network.
Detects outbound network traffic from internal hosts to the domain 'skyleen.fr' over TLS/HTTPS, which is characteristic of credential exfiltration associated with the Sckit supply chain worm.
This rule detects HTTP GET requests initiated by the Windows PowerShell User-Agent where the destination host is a decimal-encoded IP address. This pattern is commonly associated with ClickFix-style social engineering attacks, where users are tricked into executing obfuscated PowerShell commands to download malicious payloads.
Detects network traffic associated with the ClickFix Traffic Distribution System (TDS), specifically targeting requests to known malicious domains like fsputnik.com and uasputnik.com, as well as associated fake Cloudflare verification lure pages.
This rule detects outbound network traffic originating from internal assets attempting to establish an SSH connection to a known malicious C2 infrastructure (190.211.124.187). This behavior is indicative of the CARBONATO malware utilizing a reverse SSH tunnel for command-and-control communication.
Detects network traffic destined for api.telegram.org that follows the specific URL structure pattern associated with the CARBONATO Hermes Agent bot command-and-control channel.
Detects HTTP traffic where the Host header contains a decimal-encoded IP address, which is a technique often used in stager evasion and obfuscation (notably associated with 'ClickFix' or similar browser-based malvertising campaigns) to bypass domain-based filtering or reputation systems.
Detects potential credential stuffing activity by monitoring for a high volume of HTTP 401 (Unauthorized) or 403 (Forbidden) responses originating from a single source IP address within a 60-second window, specifically targeting URIs containing the path 'login'.
Detects high-frequency TCP connection attempts to WinRM (port 5985) originating from a single source host within the internal network. This pattern of behavior is often indicative of an adversary attempting to scan for or move laterally to multiple systems using WinRM.
Detects unauthorized exfiltration of sensitive information, such as camera credentials or location data, directed to the Telegram Bot API as part of the 'Operation CameraSwarm' campaign.
Detects incoming HTTP traffic containing a custom 'X-Quad' header, which is indicative of exploitation attempts targeting PaperCut MF vulnerabilities (CVE-2026-82078/CVE-2026-81578). This header is associated with the deployment or interaction with a Java-based web shell to establish unauthorized access.
Detects HTTP POST requests originating from the internal network directed at a known suspicious C2 infrastructure IP address (156.227.0.13), indicating potential C2 check-in activity associated with AdaptixC2 malware.
This rule detects network traffic originating from internal hosts using a specific HTTP User-Agent string associated with the default configuration of the AdaptixC2 framework. This is a common indicator of a C2 implant performing heartbeat or command-and-control communication.
Detects HTTP GET requests to external servers for files identified as 'mscopilot.exe' or '65722.txt', which are associated with the AdaptixC2 framework/malware, indicating potential payload delivery or command and control activity.
Detects network traffic associated with Adversary-in-the-Middle (AiTM) phishing kits that impersonate Microsoft and Google login pages. The rules identify the presence of specific HTML elements (like Cloudflare Turnstile anti-bot gates) and authentication session cookie headers served from non-authorized/non-official domains, indicating a reverse-proxy phishing attack.
Detects Git clone or fetch operations targeting bitbucket.org where the requested branch or ref is formatted as a SHA hash. This specific pattern is identified as a potential precondition for exploitation attempts targeting vulnerabilities like Plugin4Shell, where malicious branch names are used to trigger code execution on the server-side.
Detects HTTP GET requests to specific domains (microsoft-flash.com or wps-cn.com) attempting to download a file named 'flashcenter_pp_ax_install_en.exe', which is associated with malicious installer activity.
Page 12 of 110