Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,309 detections
Filters
Last updated
All Time
Detection languages
2,251
27
22
7
2
Contributors
910
584
506
125
48
Categories
20,453
11,837
5,876
5,154
4,865
2,309
Platforms
2,196
209
169
62
61
Products / Services
2,253
2,159
165
32
31
MITRE Techniques
713
422
390
187
184
CVEs
17
12
12
12
10
IDS Classtypes
995
426
281
190
98
IDS Protocols
1,291
401
281
117
45
Detects network activity related to the Beamglea/ClickFix framework using api.keyval.org as a dead-drop resolver. The rule monitors for DNS resolutions, TLS SNI requests, and HTTP GET/PUT requests to the identified C2 infrastructure, which is used for retrieving and storing obfuscated redirect values.
This rule detects potentially malicious network activity involving Dahua PTCP protocol packets that specifically request a loopback bind (127.0.0.1) using an inverted-STUN style mechanism. This behavior is indicative of an adversary attempting to bypass network segmentation or perform local service proxying/tunneling to maintain command and control or enable unauthorized access to internal services on the target device.
Detects outbound network traffic from internal hosts to the HiveMQ public broker using the MQTT protocol over TLS, a behavior associated with the Toy Ghouls mqtt-bird-agent C2 infrastructure.
Detects outbound HTTP traffic originating from a WordPress host containing specific signatures associated with the Mushr00w Uploader webshell, indicating command-and-control communication or data exfiltration.
Detects network traffic associated with the GemStone malicious browser extension, including initial registration to a command-and-control (C2) server on Cloudflare Workers, periodic heartbeat beacons, command polling, and external public IP address lookups for victim identification.
Detects HTTP GET requests for executable or installer files (e.g., .exe, .msi) containing 'tradingview' in the URI, originating from suspicious external domains that are not associated with legitimate software providers such as TradingView, GitHub, SourceForge, Apple, Google, or Microsoft. This activity is indicative of JSCeal malvertising campaigns targeting users with fraudulent installers.
Detects HTTP GET requests for executable or installer files (e.g., .exe, .msi) containing 'tradingview' in the URI, originating from suspicious external domains that are not associated with legitimate software providers such as TradingView, GitHub, SourceForge, Apple, Google, or Microsoft. This activity is indicative of JSCeal malvertising campaigns targeting users with fraudulent installers.
Detects anomalous TLS traffic directed at Binance or Bybit domains where the server certificate issuer is not from a known trusted certificate authority. This behavior is indicative of a Man-in-the-Middle (MITM) proxy interception, often associated with tools like JSCeal attempting to inspect or modify encrypted traffic to financial services.
Detects anomalous TLS traffic directed at Binance or Bybit domains where the server certificate issuer is not from a known trusted certificate authority. This behavior is indicative of a Man-in-the-Middle (MITM) proxy interception, often associated with tools like JSCeal attempting to inspect or modify encrypted traffic to financial services.
Detects the download of a JavaScript module named JSCeal, which contains code indicative of an HTTPS interception proxy. The rule looks for Node.js-based server creation code combined with cryptographic operations like keypair generation, certificate creation, and PEM conversion, excluding common legitimate JavaScript libraries and CDNs.
This rule detects IDS/IPS or vulnerability management alerts triggered by exploitation attempts targeting the Cisco IOS XR control plane, specifically related to CVE-2026-20212.
Detects outbound Telnet traffic initiating with a specific magic byte sequence ('|FF FB|') characteristic of the Fire Ant malware's command-and-control communication.
This rule detects IDS/IPS or vulnerability management alerts triggered by exploitation attempts targeting the Cisco IOS XR control plane, specifically related to CVE-2026-20212.
This rule detects high-volume, potentially automated POST requests to specific WordPress plugin endpoints (Super Forms and Elementor Pro) used for form submissions and file uploads. A high frequency of these requests from a single source within a short timeframe suggests active reconnaissance or exploitation attempts against these vulnerable components.
Detects inbound network traffic originating from IP addresses known to be associated with exploitation attempts targeting the Elementor Pro CVE-2026-32475 vulnerability. This rule monitors for connections to internal network assets from these identified threat actor sources.
Detects anomalous use of the 'X-Grafana-URL' header in conjunction with an 'Authorization: Bearer' token, indicative of an attempt to exfiltrate a service account token to an unauthorized or external domain, exploiting CVE-2026-15583.
Detects HTTP 301 redirection responses from a hardcoded IP address to an external domain associated with ProRAM command-and-control infrastructure.
Detects evidence of malicious file tampering on public CDNs (bootcdn.net, bootcss.com, staticfile.org) associated with the Funnull campaign. The rules identify specific malicious file hashes and anomalous oversized file sizes that indicate the presence of injected malicious loaders within common JavaScript libraries.
Detects evidence of malicious file tampering on public CDNs (bootcdn.net, bootcss.com, staticfile.org) associated with the Funnull campaign. The rules identify specific malicious file hashes and anomalous oversized file sizes that indicate the presence of injected malicious loaders within common JavaScript libraries.
Detects inbound network connections from known IP addresses associated with the StyleSmuggler malware distribution, which is used to inject malicious scripts into web applications.
Detects DNS lookups, TLS SNI headers, and HTTP Host headers associated with the known StyleSmuggler malware download domain '247.cdnflare.xyz'.
Page 80 of 110