Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects outbound network communication patterns (DNS lookups and TLS SNI traffic) associated with the Koktevrat Android RAT. The rule monitors for connections to known malicious domains used for command-and-control (C2) operations.
Detects outbound network communication patterns (DNS lookups and TLS SNI traffic) associated with the Koktevrat Android RAT. The rule monitors for connections to known malicious domains used for command-and-control (C2) operations.
Detects outbound network communication patterns (DNS lookups and TLS SNI traffic) associated with the Koktevrat Android RAT. The rule monitors for connections to known malicious domains used for command-and-control (C2) operations.
This rule detects network traffic directed at known command and control (C2) domains associated with the Koktevrat malware, specifically targeting the domain 'fb-market-play.cc'. This pattern is indicative of compromised hosts attempting to communicate with attacker infrastructure, often following an initial infection phase initiated via malicious links.
This rule detects network traffic directed at known command and control (C2) domains associated with the Koktevrat malware, specifically targeting the domain 'fb-market-play.cc'. This pattern is indicative of compromised hosts attempting to communicate with attacker infrastructure, often following an initial infection phase initiated via malicious links.
This rule detects network traffic directed at known command and control (C2) domains associated with the Koktevrat malware, specifically targeting the domain 'fb-market-play.cc'. This pattern is indicative of compromised hosts attempting to communicate with attacker infrastructure, often following an initial infection phase initiated via malicious links.
Detects incoming HTTP POST requests to the GitLab '/import' endpoint that attempt to access the internal cloud metadata service (169.254.169.254), indicating an exploitation attempt for vulnerabilities such as CVE-2021-22175 or CVE-2021-39935.
Detects attempts to exploit CVE-2023-2825, a path traversal vulnerability in GitLab. The rule monitors HTTP GET requests to the /uploads/ endpoint containing directory traversal sequences (e.g., ../ or encoded variants) in the URI, indicating an effort to access restricted files on the system.
Detects high-frequency connection attempts to PPTP (1723) and L2TP (1701) VPN ports from an external source, indicative of automated scanning or vulnerability discovery activity.
This rule detects potentially malicious use of residential proxies by monitoring for outbound HTTP CONNECT requests originating from consumer devices in the internal network. The use of HTTP CONNECT is a common method for establishing tunnels through proxies to mask C2 communication or facilitate unauthorized access, often associated with botnets or malicious proxy networks.
This rule detects potentially malicious use of residential proxies by monitoring for outbound HTTP CONNECT requests originating from consumer devices in the internal network. The use of HTTP CONNECT is a common method for establishing tunnels through proxies to mask C2 communication or facilitate unauthorized access, often associated with botnets or malicious proxy networks.
This rule detects high-frequency TCP SYN connection attempts originating from external networks targeting common administrative or tunneling ports (1723/PPTP, 1701/L2TP, 22/SSH) on internal systems. The detection uses a threshold of 100 connection attempts within 120 seconds, which is characteristic of automated reconnaissance and network scanning behavior.
Detects successful exploitation attempts targeting Vite development servers via chained access-control bypass vulnerabilities (CVE-2025-30208, CVE-2025-31125, CVE-2024-45811). The rule identifies malicious GET requests using the /@fs/ endpoint with specific query parameters, resulting in a successful HTTP 200 response, while originating from non-internal IP addresses.
Detects attempts to access sensitive files like environment variables (.env), cloud provider credentials (AWS/Azure), or Terraform state files via a web server interface, specifically targeting Vite development server deployments.
This rule detects inbound HTTP requests targeting a Vite development server that attempt to access the '.env' configuration file via the '//@fs/' path, which is a known technique for sensitive file exposure in misconfigured Vite environments.
This rule detects inbound HTTP requests targeting a Vite development server that attempt to access the '.env' configuration file via the '//@fs/' path, which is a known technique for sensitive file exposure in misconfigured Vite environments.
This rule detects inbound HTTP requests targeting a Vite development server that attempt to access the '.env' configuration file via the '//@fs/' path, which is a known technique for sensitive file exposure in misconfigured Vite environments.
Detects high-volume bursts of HTTP GET requests against specific paths associated with a Vite development server (/@vite/client, /@fs/, /src/) on port 5173. This pattern is indicative of automated reconnaissance or vulnerability scanning targeting an exposed development environment.
Detects high-volume bursts of HTTP GET requests against specific paths associated with a Vite development server (/@vite/client, /@fs/, /src/) on port 5173. This pattern is indicative of automated reconnaissance or vulnerability scanning targeting an exposed development environment.
Detects rapid ICMP (ping) traffic directed towards specific internal and external hosts, characteristic of the RedTail Linux malware attempting to perform network discovery or validate connectivity to command-and-control infrastructure.
Detects outbound network traffic to the Telegram Bot API where the request body contains keywords associated with cryptocurrency wallet software (e.g., MetaMask, Phantom, Tron). This behavior is indicative of a malicious script, possibly embedded in a Google Docs sidebar or similar web-based application, exfiltrating host/browser information or wallet-related data to an attacker-controlled Telegram bot.
Page 68 of 110