Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects outbound TLS-encrypted network traffic directed towards known SilkParasite infrastructure using non-standard high ports commonly associated with RDP-over-TLS (NLA). The rule identifies potential Command and Control (C2) activity by flagging connections to suspicious IP/port combinations typical of this adversary cluster.
Detects network communication associated with the SilkParasite campaign, specifically targeting TLS connections that use spoofed certificates impersonating azure.uzrailwaystax.com or communication with known SpiceRAT command-and-control server IP addresses.
Detects high-frequency, unauthenticated probe requests targeting Dahua P2P relay endpoints (/probe/device/ and /online/p2psrv/). This activity is indicative of automated scanning, enumeration, or potential exploitation attempts related to CVE-2025-31702 against internet-facing or network-connected Dahua hardware.
Detects exploit attempts targeting the authentication bypass vulnerability in Dahua NetKeyboard devices (CVE-2021-33044) by monitoring HTTP requests containing malicious 'global.login' RPC parameters.
Detects network communications between internal hosts and known malicious infrastructure associated with SpiceRAT, including TLS-based command channels and HTTP requests for decoy pages.
Detects network activity associated with the SilkParasite C2 infrastructure (used by SpiceRAT and NodeEdgeRAT malware). The rule monitors for specific impersonated TLS certificates, known malicious IP addresses, and unique JA4X TLS fingerprints associated with these threat actors.
Detects unauthenticated HTTP POST requests targeting the FortiGate administrative API (/api/v2/), which may indicate exploitation attempts related to CVE-2025-25249. The rule specifically looks for requests lacking authentication headers (Cookie or Authorization).
Detects an attempt to exploit CVE-2026-24858 in FortiCloud SSO by sending a crafted SAML authentication request that lacks a signature. This vulnerability allows an attacker to bypass authentication by providing an unsigned SAML response.
This rule detects malformed SCTP packets that trigger a protocol decoding error ('pkt_too_small'). This behavior is associated with the 'DiagSpill' vulnerability (CVE-2026-74469), where specially crafted chunk sequences in the SCTP stream can cause a remote service crash or potential instability. The rule includes a threshold to mitigate noise from non-malicious malformed packets.
This rule detects malformed SCTP packets that trigger a protocol decoding error ('pkt_too_small'). This behavior is associated with the 'DiagSpill' vulnerability (CVE-2026-74469), where specially crafted chunk sequences in the SCTP stream can cause a remote service crash or potential instability. The rule includes a threshold to mitigate noise from non-malicious malformed packets.
This rule detects network activity associated with the SilverFox malware, specifically targeting communication patterns between the compromised host and identified relay infrastructure. The detection focuses on unique URL query patterns for relay discovery and dispatcher requests, as well as the identification of staging/download links within server responses.
Detects network activity associated with the Rapuncel malware, including raw TCP exfiltration of files via POST requests to /upload, connections to known malicious C2 infrastructure, and repeated exfiltration retry patterns.
This rule detects repeated HTTP POST requests to a Polygon blockchain endpoint ('eth_call') containing specific contract address and method identifiers. This behavior is indicative of 'EtherHiding', a technique where attackers use blockchain smart contracts to host malicious C2 configurations or update C2 infrastructure, allowing for stealthy dynamic command and control rotation.
This rule detects network traffic indicative of N0va Phishkit verification or session initialization. It looks for specific GET request URI parameters (/api/verification/init?session=, flow=, prompt_profile=) that align with the initial handshake phase of this phishing kit, which is often used for credential and session cookie theft.
Detects outbound network traffic and subsequent inbound responses associated with AsyncRAT command and control (C2) communication. This rule monitors connections directed toward a specific hardcoded IP address known to be associated with AsyncRAT activity.
This rule monitors network traffic to detect a specific 'Client Hello' beaconing behavior associated with the RMRLX Remote Access Trojan (RAT), identifying potential command-and-control communication directed at a known malicious IP address over TCP port 4561.
Detects malicious activities associated with the SilkParasite campaign targeting Redis servers. The rules identify the initiation of a 'SLAVEOF' command to a rogue replication host, subsequent handshake (PSYNC/REPLCONF) with an external attacker-controlled node, and the modification of server configuration ('CONFIG SET dbfilename') to potentially facilitate unauthorized file persistence or data exfiltration through the Redis replication mechanism.
Detects outbound TCP traffic containing system reconnaissance data, such as OS information, computer name, and location, being sent to a known C2 server address. The rule monitors for specific content patterns indicative of an infected host checking in or exfiltrating host configuration details.
Detects network activity associated with the QUICAgent backdoor, including QUIC C2 traffic using a self-signed 'RAT System' certificate, direct connections to a known C2 IP address (104.64.211.22), and DNS queries for the hardcoded C2 domain 'register.mediumser.com'.
Detects attempts to exploit a path traversal vulnerability in the GitLab commits API, specifically targeting the /api/v4/projects/ repository/commits path. The rule monitors for directory traversal patterns such as .. or url-encoded variations in conjunction with file paths, which could allow unauthorized access to files outside the intended directory.
This rule detects attempts to exploit a path traversal vulnerability (CVE-2024-21762) in FortiOS SSL-VPN by monitoring for malformed GET requests targeting the /remote/fgt_lang endpoint. The rule also tracks successful exploitation by identifying HTTP 200 responses containing Linux password file patterns (root:x:0:0:), indicating potential remote file disclosure.
Page 46 of 110