Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects HTTP responses containing JavaScript-based anti-bot challenge pages consistent with the GhostCode toolkit, and subsequent HTTP requests containing tracking tokens used for victim verification after passing the challenge.
This rule detects potential credential stuffing attempts against a Fortinet FortiGate SSL VPN portal. It triggers when an external source performs multiple HTTP POST requests to the /remote/login endpoint within a short period, accompanied by the FortiGate-specific header, which is indicative of automated brute-force or credential stuffing activity associated with the 'FortiBleed' campaign pattern.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting the cdnsuicaches[.]com domain. The rules identify the initial DNS query, the subsequent TLS SNI connection, and the retrieval of malicious JavaScript containing the 'cookie-captcha-complete' overlay signature. This behavior is indicative of a browser-based social engineering attack.
Detects outbound HTTP POST requests directed at a known StealC command-and-control IP address. The rule identifies suspicious beaconing behavior by looking for POST requests that lack a standard User-Agent, do not utilize common HTTP content types, and contain a request body exceeding 16 bytes, suggesting custom binary protocol usage.
Detects outbound HTTP POST requests directed at a known StealC command-and-control IP address. The rule identifies suspicious beaconing behavior by looking for POST requests that lack a standard User-Agent, do not utilize common HTTP content types, and contain a request body exceeding 16 bytes, suggesting custom binary protocol usage.
Detects network activity associated with the 'ClickFix' campaign, specifically targeting DNS queries, TLS SNI, HTTP Host headers, and direct IP connections to known malicious infrastructure domains (cdnsuicaches.com, mnl.ac) and exfiltration endpoints (23.227.198.199).
Detects unauthorized attempts to request an AWS token via the JFrog Artifactory API, specifically targeting a vulnerability identified as CVE-2026-42018. The rule triggers when a POST request is made to the '/access/api/v1/aws/token/' endpoint without an Authorization header, indicating potential exploitation of an anonymous token request flaw.
Detects network traffic initiated by the WeaselBiscuit loader targeting api.npoint.io, a known free JSON storage service often abused by adversaries as a dead drop resolver for Command and Control (C2) configurations or secondary payloads.
This rule detects outbound TLS connections to suspicious domain names characteristic of the Koktevrat malware's DGA. The rule identifies SNI strings that match a specific regex pattern (8-16 alphanumeric characters followed by .icu or .cfd TLDs), which is indicative of automated C2 communication.
Detects repeated authentication attempts over PPTP (port 1723) or L2TP (port 1701) protocols originating from an external network, indicative of potential brute-force activity against remote access services.
This rule detects HTTP requests directed at suspicious URI patterns associated with 'LeakySensey' logs. It specifically monitors for attempts to access transaction or compromise log endpoints, which could indicate an attacker attempting to enumerate leaked data or verify compromised credentials from an exposed log repository.
This rule detects inbound HTTP requests targeting Microsoft Exchange Server that contain the specific headers and patterns associated with the ProxyLogon (CVE-2021-26855) Server-Side Request Forgery (SSRF) vulnerability. It specifically monitors for the presence of the 'X-BEResource' header and malformed request structures used by attackers to bypass authentication.
This rule detects network traffic directed at the Telegram Bot API (api.telegram.org) where the request URI indicates a bot action ('/bot' followed by 'sendMessage') and the HTTP request body contains the keyword 'VIEW'. This pattern is commonly associated with C2 beacons using Telegram as an intermediary service to send status or command results from compromised hosts.
This rule detects potential automated reconnaissance activity characteristic of the 'Strix' tool against web applications. It uses two detection mechanisms: tracking high-frequency requests that match typical scanning path patterns (excluding OPTIONS requests) and monitoring for a surge in 404 or 400 error responses, which often indicates an automated vulnerability scanner attempting to probe non-existent resources.
This rule detects SQL injection attempts targeting the BuddyBoss members REST endpoint, specifically identifying exploitation patterns associated with the 'sqlmap' tool. The rule monitors for specific URL parameters including 'member_type', 'search_terms', and 'scope' in combination with an 'sqlmap' user-agent, indicating an automated exploitation attempt against the application.
Detects HTTP POST requests to a specific API endpoint (/api/adbk/upload) containing references to 'cert.pem' and 'private.key', indicating the exfiltration of sensitive cryptographic material by the RatHat malware.
This rule monitors for outbound TCP traffic from internal hosts to a specific IP address (212.34.141.103) on port 4521, which is associated with C2 beaconing behavior, potentially involving the abuse of MSBuild.exe as a LOLBin.
This rule detects network communication patterns indicative of the Kimsuky threat group using compromised WordPress sites hosted on wasmer.app for command and control (C2). It specifically looks for established HTTP requests to the .wasmer.app domain, targeting a specific WordPress uploads path and a unique token format in the URI string.
Detects network traffic associated with Hannibal Stealer, including communication with known hardcoded C2 infrastructure, suspicious URI patterns for data exfiltration, and the use of the Telegram Bot API for potential C2 or exfiltration.
Detects suspicious FTP command and control traffic originating from internal hosts to known compromised servers in Taiwan. The rules monitor for specific FTP commands such as STOR (to upload archive4.zip), RETR (to download archive1.zip), and initial authentication (USER command) associated with C2 communication.
Page 47 of 110