Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects unauthorized and potentially unauthenticated POST requests directed at the completion API endpoints (/api/v1/generate and /run/textgen) of the Oobabooga text-generation-webui, which is commonly used to host Large Language Models (LLMs). Such access, if not secured, could allow an external actor to interact with the model or potentially exploit the underlying infrastructure.
This rule detects POST requests to the '/v2/repository/index' endpoint of a Triton Inference Server. This endpoint is part of the Model Repository control API and is typically used to manage or inspect models. Unauthorized access to this API can be indicative of reconnaissance or exploitation attempts against the inference server.
This rule detects unauthorized and unauthenticated attempts to access the Ray Dashboard API '/api/jobs' endpoint. An absence of an Authorization header in these requests indicates potential reconnaissance or exploitation attempts against an exposed Ray cluster management interface.
Detects incoming HTTP GET requests to common Jupyter Notebook endpoints ('/tree' or '/api/kernels') that do not include a token in the URI. This behavior is indicative of an adversary attempting to interact with or explore an insecurely configured Jupyter Notebook server that lacks authentication.
Detects high-frequency requests from automated scripting tools like 'python-requests', 'aiohttp', or 'Scrapy' targeting sensitive directories or files often associated with administrative panels or application configurations (e.g., admin, .env, wp-admin). The rule triggers when a threshold of 10 requests is reached within a 60-second window, indicating potential automated vulnerability or information gathering activity.
Detects multiple inbound HTTP requests targeting known vulnerable application paths (e.g., cgi-bin, .env files, actuator gateways, path traversal, WordPress plugins, PHP eval files, and various server administration consoles) from a single source within a short timeframe. This behavior is indicative of an automated scanner or exploit chain attempting to identify and compromise public-facing applications.
Detects unauthenticated POST requests directed at the '/v1/completions' endpoint of a vLLM server. This behavior is indicative of potential unauthorized access or exploitation attempts against an exposed LLM inference API that lacks authentication controls.
Detects unauthenticated HTTP POST requests targeting the '/v1/graphql' endpoint of a Weaviate vector database. This pattern is indicative of reconnaissance or exploitation attempts against exposed Weaviate API instances.
Detects network traffic associated with Adversary-in-the-Middle (AiTM) phishing kits that impersonate Microsoft and Google login pages. The rules identify the presence of specific HTML elements (like Cloudflare Turnstile anti-bot gates) and authentication session cookie headers served from non-authorized/non-official domains, indicating a reverse-proxy phishing attack.
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
This rule detects anomalous GET requests to PHP files within the WordPress themes directory that match the specific pattern used by the DragonForce threat actor for secondary C2 beaconing. The detection identifies requests that lack typical WordPress request indicators like cookies or specific form fields, suggesting non-browser, programmatically generated C2 traffic.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects network exploitation attempts targeting CVE-2026-82329 in JFrog Artifactory. The rule identifies path traversal, malicious Java deserialization payloads, and unauthorized access attempts to sensitive administrative API endpoints.
Detects high-frequency, sequential outbound GET requests to short URL patterns, potentially indicating a sandbox escape attempt or automated command-and-control activity where shortened links are used to download multi-stage payloads.
Detects incoming HTTP requests to an Artifactory deployment that utilize 'X-Forwarded-Host' and 'X-Forwarded-Scheme' headers in a manner consistent with HTTP cache poisoning attacks (CVE-2026-66384), specifically identifying when the 'X-Forwarded-Host' header contains unexpected or non-internal network values.
Detects high-frequency requests to Hugging Face dataset repository commit and discussion endpoints, which may indicate the use of the platform as a dead drop resolver or for C2 polling.
This rule detects repeated access to the RubyGems legacy API key endpoint within a short timeframe from a single source. This behavior is indicative of automated credential harvesting, where an adversary attempts to brute force or cycle through various API keys to gain unauthorized access to RubyGems accounts.
Detects outbound HTTP POST requests containing an aggregated 'LOOT' variable in the body. The rule looks for markers indicating the exfiltration of Kubernetes-related credentials, such as service account tokens, bearer tokens, or configuration secrets, as well as common environment variable dumps like API keys.
Detects anomalous POST requests to the RubyGems API endpoint '/api/v1/gems' that include an 'Authorization' header and a 'Content-Type' of 'application/octet-stream'. This pattern suggests the automated upload of binary files, potentially indicating exfiltration of data disguised as Ruby gems.
Page 10 of 116