Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,456
11,839
5,876
5,155
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects the use of a specific magic string ('sxcdewqaz!@#') commonly associated with the Fire Ant implant to trigger or activate reverse-tunneling capabilities over TCP ports 443, 541, 8443, and 10443.
Detects SMTP MAIL FROM/Reply-To headers, DNS queries, or TLS SNI matches for known Business Email Compromise (BEC) lookalike domains (e.g., service-nowinc.com, domainlify.net) used for phishing or spoofing organizational identities.
Detects an HTTP GET request to 'dl.php' containing an 'f' parameter (target file) and an 'k' parameter (access token), followed by a response body starting with the 'MZ' header, indicating the successful download of a Windows PE executable as part of a potential phishing campaign stage-2 payload delivery.
Detects an HTTP GET request to 'dl.php' containing an 'f' parameter (target file) and an 'k' parameter (access token), followed by a response body starting with the 'MZ' header, indicating the successful download of a Windows PE executable as part of a potential phishing campaign stage-2 payload delivery.
Detects sustained beaconing behavior originating from the internal network to known malicious HVNC (Hidden Virtual Network Computing) C2 infrastructure. The rule identifies repeated connection attempts (5 or more TCP SYNs within a 180-second window) targeting specific hardcoded IP addresses on non-standard ports (27015/27017), indicative of a compromised host maintaining persistent C2 communication.
Detects sustained beaconing behavior originating from the internal network to known malicious HVNC (Hidden Virtual Network Computing) C2 infrastructure. The rule identifies repeated connection attempts (5 or more TCP SYNs within a 180-second window) targeting specific hardcoded IP addresses on non-standard ports (27015/27017), indicative of a compromised host maintaining persistent C2 communication.
This rule detects attempts to exploit a vulnerability in the WordPress Super Forms plugin (CVE-2026-14894). The rule monitors for malicious file upload requests containing embedded PHP code or attempts to bypass filename extensions for PHP files via the super_submit_form AJAX action.
Detects incoming HTTP POST requests targeting the 'admin-ajax.php' endpoint with parameters associated with a malicious file upload exploit against Elementor Pro (CVE-2026-32475). The rule specifically looks for the 'elementor_pro_forms_send_form' action and the presence of PHP file extensions within form fields, indicating an attempt to upload a web shell.
Detects inbound network traffic originating from IP addresses known to be associated with an exploit campaign targeting the Super Forms plugin (CVE-2026-14894). The rule acts as an indicator of compromise (IoC) match for potential exploitation attempts directed at internal network infrastructure.
Detects Server-Side Request Forgery (SSRF) attempts targeting an MLflow server where an attacker-controlled HTTP redirect response forces the server to reach out to the cloud instance metadata service at 169.254.169.254. This rule specifically looks for HTTP 30x redirect status codes where the Location header contains the sensitive metadata service IP address.
Detects Server-Side Request Forgery (SSRF) attempts targeting an MLflow server where an attacker-controlled HTTP redirect response forces the server to reach out to the cloud instance metadata service at 169.254.169.254. This rule specifically looks for HTTP 30x redirect status codes where the Location header contains the sensitive metadata service IP address.
Detects outbound network traffic associated with the Tailscale VPN protocol, specifically identifying potential unauthorized or personal tailnet communication channels. The detection monitors for TLS SNI strings ending in '.ts.net' and WireGuard handshakes on UDP port 41641. These indicators are common to all Tailscale client activity and require environment-specific exclusions of sanctioned Tailscale infrastructure to minimize noise.
Detects potential exfiltration activity by identifying HTTP POST/PUT requests to known suspicious domains, including specific operator-controlled hosts and anonymous file sharing services, as well as the use of HTTP Range headers for bulk API data exfiltration.
Detects indicators of cross-site scripting (XSS) attacks aimed at stealing web session cookies. The rule covers the injection of malicious scripts into client responses, anomalous CORS preflight responses that could facilitate data exfiltration, and subsequent HTTP callbacks or beaconing containing cookie data to external endpoints.
Detects Server-Side Request Forgery (SSRF) attempts against Grafana instances using the 'X-Grafana-URL' header. The rule identifies requests attempting to access internal network ranges, link-local addresses, or cloud metadata endpoints (e.g., 169.254.169.254, localhost) via the Grafana MCP interface, particularly when non-GET HTTP methods are used to potentially mutate internal resources.
Detects high-frequency TCP/445 connection attempts (a 'connect sweep') characteristic of automated SMB share enumeration, which is commonly used for lateral movement reconnaissance. The rule triggers when a threshold of 40 connection requests occurs from a single source within a 30-second window, specifically targeting SMB-related lateral movement behaviors.
Detects network activity associated with the ProRAM C2 infrastructure. The rule monitors for DNS resolutions, TLS SNI field matches, and specific HTTP WebSocket upgrade patterns directed towards the 'clash-verge-upgrade.com' domain.
Detects high-rate scanning and automated service probing patterns consistent with network reconnaissance. This includes tracking TCP SYN floods to external segments, excessive HTTP/login requests, and automated fingerprinting probes (e.g., favicon or admin panel enumeration). The rule accounts for common uptime monitoring services to minimize false positives.
Detects high-rate scanning and automated service probing patterns consistent with network reconnaissance. This includes tracking TCP SYN floods to external segments, excessive HTTP/login requests, and automated fingerprinting probes (e.g., favicon or admin panel enumeration). The rule accounts for common uptime monitoring services to minimize false positives.
Detects HTTP traffic patterns associated with the JSCeal malware family, specifically focusing on the exfiltration of crypto wallet information and account balances. The rule identifies communication to suspicious domains, unauthorized access to balance field names, and the masquerading of traffic to impersonate legitimate exchanges like Binance.
Detects HTTP traffic patterns associated with the JSCeal malware family, specifically focusing on the exfiltration of crypto wallet information and account balances. The rule identifies communication to suspicious domains, unauthorized access to balance field names, and the masquerading of traffic to impersonate legitimate exchanges like Binance.
Page 77 of 110