Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects repeated authentication login attempts (opcode 0xA0) against Dahua Easy4IP devices over TCP port 37777, indicative of a brute-force or credential stuffing attack.
Detects outbound TCP traffic originating from internal hosts to known command and control infrastructure associated with the SilkParasite campaign and the SpiceRAT malware family.
Detects network activity related to the exploitation of the CVE-2025-31702 vulnerability in Dahua P2P Relay services. The rules monitor for probe attempts, device parameter fetching (randsalt), serial number enumeration bursts, and successful no-auth channel responses, indicating a bypass of authentication mechanisms on vulnerable Dahua devices.
This rule detects a specific network exploit attempt targeting Dahua devices (CVE-2021-33045), where an attacker attempts to bypass authentication by manipulating the login parameters, specifically by forcing the system to interpret requests as coming from the local loopback interface.
Detects attempts to exploit CVE-2021-33044, an authentication bypass vulnerability in Dahua NetKeyboard hardware. The rule triggers when a POST request containing 'global.login', 'clientType: NetKeyboard', and 'loginType: Direct' is observed, which allows unauthorized access by manipulating authentication parameters.
Detects high-concurrency brute-force attempts against Dahua Easy4IP-enabled devices targeting port 37777, identified by specific binary patterns (opcode 0xA0) in the packet payload. This indicates an automated attempt to compromise device authentication.
This rule detects an attempted authentication bypass vulnerability (CVE-2021-33045) targeting Dahua NetKeyboard devices. The exploit involves a specific HTTP request structure to the 'global.login' endpoint, where the 'loginType' parameter is set to 'Loopback' and the 'ipAddr' is set to '127.0.0.1', attempting to leverage internal loopback logic to circumvent authentication mechanisms.
Detects outbound network traffic attempting to interact with a specific Polygon smart contract address using eth_call. This behavior is indicative of the EtherHiding technique, where adversaries leverage blockchain infrastructure as a dead-drop resolver for command-and-control (C2) operations to bypass traditional network defenses.
Detects rapid TCP connection attempts to port 445 (SMB) from a single source IP address, indicative of network scanning or reconnaissance activities typically used by the DragonForce ransomware or similar automated threats for lateral movement.
Detects outbound HTTP requests to 'relay.php' that include the 'X-Captcha-Track: 1' header, which serves as a telemetry beacon for the CRPx0 ClickFix social engineering campaign. This activity is indicative of a user interacting with a malicious webpage designed to trick them into executing harmful commands via copy-paste actions.
Detects outbound HTTP requests to the Telegram Bot API (/sendMessage) which are often used by malware (such as 'Exvicy' or 'Small Sieve') for command and control or exfiltration notification, utilizing the Telegram bot token structure in the URI.
Detects outbound network traffic from internal hosts directed toward identified Exvicy command-and-control (C2) infrastructure IP addresses. This includes both general beaconing attempts and established TLS handshake sessions potentially linked to post-ClickFix malicious activity.
Detects an attempt to exploit a directive injection vulnerability in the SharePoint 'WebPartPages.asmx' SOAP web service, specifically targeting the 'GetWebPartPageConnectionInfo' method. The rule looks for suspicious 'Register' directives in the request body, which could lead to unauthorized code execution or configuration manipulation.
Detects specific Cloudflare name server pairs ('randy.ns.cloudflare' and 'stevie.ns.cloudflare') in DNS responses. This pattern is associated with Exvicy domain management infrastructure, which has been identified as a component in adversary C2 and domain staging operations.
These rules detect various exploitation attempts targeting SharePoint to bypass SafeControls, an security mechanism used to restrict the types of controls allowed in web parts. The patterns match suspicious Register directives and markup injection techniques often associated with remote code execution or privilege escalation, as identified in CVE-2026-65660.
Detects HTTP POST requests directed to the '/api.php' endpoint with specific patterns characteristic of Exvicy/ClickFix malware C2 communication. The rule identifies suspicious action parameters (check, dl, or cb) and a specific 48-character hexadecimal 'k' parameter used for identifying infected state.
This rule detects a raw TCP authentication handshake associated with the VelvetCake malware family. It specifically monitors for established connections to a known malicious C2 IP address (111.92.246.145) over port 12345 containing the specific hardcoded 'PASSWORD' string used for initial communication.
Detects outbound network traffic from internal hosts to a domain associated with the VelvetCake fileless malware variant. The rule specifically looks for HTTP requests to 'p1o2i3u4y5t6r7e8w9q0.medianewsonline.com' using specific login parameters ('Areyou=cake', 'OKey=', 'Who='), which is indicative of command and control activity linked to the Konni actor group.
Detects HTTP POST requests directed at etherscan.io containing 'eth_call' in the request body. This pattern is indicative of the GHAPPIER / PolinRider malware family utilizing the Ethereum blockchain's public JSON-RPC interface as a dead-drop resolver for command-and-control communication.
Detects PIVOTPIPE malware beaconing activity indicative of peer-to-peer (P2P) lateral movement between internal hosts. The rule monitors for sustained established TCP traffic with specific small packet size characteristics, suggesting command-and-control heartbeats or tunneled traffic within the internal network.
Detects HTTP responses containing keywords associated with ClearFake campaigns hosted on Cloudflare Workers. These pages are typically designed to trick users into downloading malicious files by displaying fake browser verification or captcha pages.
Page 35 of 110