Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects unauthorized or suspicious POST requests to the Cisco Firepower Management Center (FMC) web interface that lack standard authentication headers (Cookie, Authorization, or X-Api-Token). This pattern is consistent with exploit attempts targeting CVE-2026-20079.
Detects SMTP MAIL FROM/Reply-To headers, DNS queries, or TLS SNI matches for known Business Email Compromise (BEC) lookalike domains (e.g., service-nowinc.com, domainlify.net) used for phishing or spoofing organizational identities.
Detects SMTP MAIL FROM/Reply-To headers, DNS queries, or TLS SNI matches for known Business Email Compromise (BEC) lookalike domains (e.g., service-nowinc.com, domainlify.net) used for phishing or spoofing organizational identities.
Detects attempts to bypass AWS IMDSv2 security protections via the LiteLLM /config/pass_through_endpoint, where attackers inject the 'x-pass-X-aws-ec2-metadata-token' header to potentially strip authentication requirements.
Detects attempts to bypass AWS IMDSv2 security protections via the LiteLLM /config/pass_through_endpoint, where attackers inject the 'x-pass-X-aws-ec2-metadata-token' header to potentially strip authentication requirements.
Detects a multi-stage authentication bypass attempt against LiteLLM MCP endpoints. The rule tracks an initial malformed Authorization Bearer token request to the /mcp/ endpoint, followed by a server response returning a 200 OK status code accompanied by an 'mcp-session-id' header, confirming the exploitation of CVE-2026-59822.
Detects incoming HTTP requests to sensitive LiteLLM endpoints (/mcp and /guardrails) which are typically intended for internal or controlled use. Exposing these to the public internet may allow unauthorized individuals to interact with, enumerate, or exploit the LiteLLM framework's capabilities.
Detects network activity associated with the Mantax/Otax Android malware family, specifically identifying C2 communication to the domain apimantax.otax.fun via TLS SNI and HTTP host headers, as well as potential dynamic C2 configuration retrieval via GitHub using the OkHttp client.
This rule detects command-and-control (C2) communication patterns associated with the 'soraki-proxy.workers.dev' domain, a Cloudflare Workers-hosted proxy service. Additionally, it identifies potential malicious mTLS implants by flagging non-standard TLS handshakes that use self-signed or auto-generated certificates missing standard organization (O) fields in the subject DN.
This rule detects command-and-control (C2) communication patterns associated with the 'soraki-proxy.workers.dev' domain, a Cloudflare Workers-hosted proxy service. Additionally, it identifies potential malicious mTLS implants by flagging non-standard TLS handshakes that use self-signed or auto-generated certificates missing standard organization (O) fields in the subject DN.
This rule detects SQL injection attempts targeting the BuddyBoss members REST endpoint, specifically identifying exploitation patterns associated with the 'sqlmap' tool. The rule monitors for specific URL parameters including 'member_type', 'search_terms', and 'scope' in combination with an 'sqlmap' user-agent, indicating an automated exploitation attempt against the application.
This rule detects potential command and control (C2) communication related to the GhostContainer malware. It inspects HTTP POST requests directed at Microsoft Outlook Web Access (OWA) paths containing a suspicious 'x-owa-urlpostdata' header. The presence of this specific header, followed by a base64-encoded string of significant length, indicates an attempt to deliver C2 commands or exfiltrate data through OWA infrastructure.
Detects outbound HTTP requests from the internal network to the domain 'adminmenueditor.com'. This domain has been associated with a compromised software supply chain attack targeting the Admin Menu Editor Pro WordPress plugin, which was used to distribute malicious code to users.
Detects DNS queries and TLS SNI traffic related to known malicious domains used by threat actor groups Storm-3121 and Storm-3032 in passkey-themed phishing campaigns.
Detects anomalous network traffic patterns where internal assets interact with Microsoft Graph API and Entra ID (login.microsoftonline.com) authentication endpoints from distinct external destination IPs within a short time window. This behavior is indicative of potential attacker infrastructure rotation during C2 or post-authentication phases.
Detects outbound network traffic from internal hosts to the Microsoft Graph API (graph.microsoft.com) originating from Python HTTP clients (requests or urllib libraries). This pattern can indicate automated data exfiltration from an internal environment to a cloud-based service, or the use of Microsoft Graph API for command and control purposes.
This rule detects network traffic directed at a potentially compromised server associated with the Admin Menu Editor Pro plugin, specifically looking for HTTP requests that indicate an attempt to download a malicious update.
Detects TCP connections on standard web ports from internal hosts to known IronToll C2 IPs on Tencent/Alibaba Cloud. Scoped to web ports and an established handshake, with a per-source hourly alert cap to reduce repeat noise.
Detects TCP connections on standard web ports from internal hosts to known IronToll C2 IPs on Tencent/Alibaba Cloud. Scoped to web ports and an established handshake, with a per-source hourly alert cap to reduce repeat noise.
Detects country-coded lure path requests (/eg, /ma) followed by a cloaking differential response (desktop UA blocked with 404, mobile UA served content). Fixed a regex bug where the original pattern matched any path merely starting with 'eg' or 'ma' (e.g. /egg.jpg, /mail, /manifest.json) instead of the exact path segment.
Detects sensitive data exfiltration attempts (PII, credit card, OTP) via HTTP POST requests to suspicious lookalike domains, followed by a WebSocket connection to known IronToll C2 infrastructure.
Page 70 of 110