Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
Detects network activity associated with the DragonForce backdoor, specifically the use of MQTT for command and control. The rules monitor for unique 16-character client IDs used during registration on non-standard ports, subsequent command retrieval structures containing 'cmdnum', and DNS queries for the hardcoded broker 'broker.emqx.io'.
Detects network activity associated with the DragonForce backdoor, specifically the use of MQTT for command and control. The rules monitor for unique 16-character client IDs used during registration on non-standard ports, subsequent command retrieval structures containing 'cmdnum', and DNS queries for the hardcoded broker 'broker.emqx.io'.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects network exploitation attempts targeting CVE-2026-82329 in JFrog Artifactory. The rule identifies path traversal, malicious Java deserialization payloads, and unauthorized access attempts to sensitive administrative API endpoints.
Detects high-frequency, sequential outbound GET requests to short URL patterns, potentially indicating a sandbox escape attempt or automated command-and-control activity where shortened links are used to download multi-stage payloads.
Detects incoming HTTP requests to an Artifactory deployment that utilize 'X-Forwarded-Host' and 'X-Forwarded-Scheme' headers in a manner consistent with HTTP cache poisoning attacks (CVE-2026-66384), specifically identifying when the 'X-Forwarded-Host' header contains unexpected or non-internal network values.
Detects high-frequency requests to Hugging Face dataset repository commit and discussion endpoints, which may indicate the use of the platform as a dead drop resolver or for C2 polling.
This rule detects repeated access to the RubyGems legacy API key endpoint within a short timeframe from a single source. This behavior is indicative of automated credential harvesting, where an adversary attempts to brute force or cycle through various API keys to gain unauthorized access to RubyGems accounts.
Detects automated HTTP GET requests directed at government or council calendar endpoints (specifically targeting mgCalendarMonthView or GetMeetings parameters) using a common generic User-Agent. This behavior is indicative of an automated scripted client potentially using public infrastructure as a Command and Control (C2) relay.
Detects an abnormally high volume of POST requests to the RubyGems API endpoint used for publishing packages. A sudden burst of these requests from a single source may indicate a mass upload campaign, commonly associated with software supply chain poisoning attempts.
This rule detects network activity associated with the GemStuffer malware, specifically monitoring for DNS queries to known OAST callback domains, HTTP requests to specific C2 paths, and unauthorized data exfiltration attempts to the webhook.site service.
Detects HTTP traffic attempting to download specific known malicious RubyGems packages from rubygems.org associated with the GemStuffer campaign. This indicates a supply chain compromise attempt where attackers distribute malicious code via public package repositories.
Detects a multi-stage communication pattern involving an initial request to a URL-mirroring or shortening service with a long base64-encoded path, followed by a request to a screenshot/rendering API, and culminating in the reception of an image file. This chain is indicative of command and control (C2) communication where command output or exfiltrated data is encoded into images rendered by external web services to bypass traditional network security filters.
This rule monitors for two related scenarios targeting the RubyGems legacy API-key endpoint. First, it identifies suspicious responses indicating an API key might have been served from a CDN cache, potentially leading to cross-user credential leaks. Second, it flags a high volume of requests to the same endpoint using gzip compression, which is a known technique associated with edge-cache poisoning attacks.
Detects HTTP responses containing patterns associated with a malicious HTA stager hosted on Cloudflare Pages. The rule looks for specific URL structures often used in phishing campaigns that attempt to deliver malicious payloads, specifically involving a cloned Gmail attachment widget.
Detects Heartbleed (CVE-2014-0160) exploitation attempts by monitoring for malformed TLS heartbeat requests (undersized payload) followed by oversized responses from the server that indicate potential memory disclosure.
Detects Heartbleed (CVE-2014-0160) exploitation attempts by monitoring for malformed TLS heartbeat requests (undersized payload) followed by oversized responses from the server that indicate potential memory disclosure.
Detects SQL injection exploitation attempts against MOVEit Transfer targeting the CVE-2023-34362 vulnerability, followed by the deployment and subsequent interaction with the 'human2.aspx' webshell associated with Cl0p ransomware mass-exploitation campaigns.
Detects network requests to specific GitHub, Blogspot, and Telegram endpoints, which are known to be used by the 'VPN-for-X' extension to fetch proxy configuration files. This behavior is indicative of C2 channel configuration retrieval.
Page 16 of 110