Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects attempts to exploit CVE-2026-48710 in Starlette frameworks where an attacker attempts to smuggle path or authority information via the HTTP Host header using character encoding variations like slashes or URL-encoded sequences.
Detects unauthenticated attempts to access Adobe Commerce/Magento REST API endpoints. This rule specifically looks for HTTP GET requests containing /rest/ and /V1/ paths without an Authorization header, which may indicate an attempt to exploit CVE-2026-71362.
This rule detects attempts to exploit a SQL injection vulnerability in Sangoma Switchvox (CVE-2026-9586) by inspecting HTTP POST request bodies and URIs for common SQL injection patterns such as UNION SELECT, SLEEP(), and DROP TABLE. This vulnerability allows an attacker to execute arbitrary SQL commands on the backend database.
This rule detects HTTP POST requests to the Apache Qpid Broker-J Management API that include a pre-set JSESSIONID in the cookie header during a login operation, indicating an attempt to exploit CVE-2026-92609 via session fixation.
Detects attempts to access administrative or configuration endpoints on Cisco Identity Services Engine (ISE) without providing valid authentication headers, cookies, or authorization tokens. This behavior is indicative of exploitation attempts targeting CVE-2026-20192 to gain unauthorized administrative access.
Detects incoming HTTP POST requests that match the signature of the China Chopper web shell client, specifically looking for common evaluative functions (eval, assert, base64_decode) being passed to single-letter parameters, which is a hallmark of this specific web shell's communication pattern.
Detects outbound HTTP POST requests characteristic of Emotet malware command-and-control beaconing. The rule identifies communication to an external network using a specific URI pattern (4-16 alphanumeric characters), a 'Content-Type: application/octet-stream' header, and a legacy Internet Explorer 7.0 User-Agent, while explicitly excluding common non-binary or HTML response formats in the request body.
Detects common SQL injection patterns (such as UNION SELECT, tautologies, sleep functions, and information_schema queries) within HTTP URI parameters and HTTP POST request bodies, which are indicative of an attempt to manipulate backend database queries.
Detects HTTP traffic patterns characteristic of Qakbot (QBot) malware command-and-control (C2) communication. This rule monitors for POST requests to .php files featuring a specific hardcoded User-Agent (IE 7.0 on Windows NT 5.1), a 'Cookie' header, 'application/octet-stream' content type, and a request body length of at least 201 characters.
Detects specific JSON-RPC calls indicating C2 communication associated with the Graphalgo RAT. The rule identifies calls to the 'eth_call' method referencing specific function names like 'setCPubKey', 'serviceData', or a hardcoded Arbitrum Sepolia contract address used as a blockchain dead-drop mechanism.
Detects HTTP POST requests directed to the URI path '/api/credentials' over the non-standard TCP port 8133, which is indicative of AMOS (Atomic macOS) Stealer exfiltrating stolen credentials to a C2 server.
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying C2 communication patterns such as heartbeat beacons and agent tasking requests occurring over non-standard port 8133.
Detects unauthorized attempts to interact with the Docker API to create containers or pull images, specifically looking for patterns associated with the CARBONATO worm which utilizes the /containers/create endpoint with 'net-setup' parameters.
Detects incoming HTTP POST requests to the Docker API endpoint '/containers/create' containing 'Privileged: true' and a bind mount to the host filesystem ('/:/host'). This pattern is indicative of an attempt to deploy a privileged container with host access, which can be leveraged for container breakout or host system compromise.
This rule detects unauthorized attempts to create privileged containers via the Docker API, specifically identifying the use of the 'net-setup' string often associated with the CARBONATO worm. Such activity indicates potential propagation or lateral movement within a containerized environment by attempting to deploy containers with elevated permissions.
Detects network activity associated with the RatHat Android malware agent, including C2 tasking, Go agent 'frpc' tunnel configuration retrieval, tunnel deployment status reporting, and internal loopback C2 server communication.
Detects network activity associated with the RatHat Android malware, specifically identifying C2 data exfiltration API calls over FRP (FRP/Go Agent) tunnels and WebSocket handshake traffic for command-and-control communication.
Detects specific HTTP traffic patterns associated with the RatHat malware's FRP (Fast Reverse Proxy) reverse-tunneling deployment and C2 status reporting. The rule identifies the sequence of fetching configuration, initiating WebSocket tunnel links, and reporting deployment status to a remote command-and-control server.
Detects HTTP traffic from the Psychedelic Stealer malware as it exfiltrates stolen browser passwords and session tokens to a specific command-and-control endpoint, and identifies the staging of Chromium Web Data files ('wd_tmp.db') within HTTP POST requests.
Detects outbound network traffic to known public BNB Smart Chain (BSC) data seed nodes using JSON-RPC 'eth_call' methods or TLS connections. This pattern is indicative of malware using blockchain infrastructure as a dead drop resolver for C2 command retrieval or configuration updates.
This rule detects malicious HTTP POST requests attempting a path traversal attack against Grav CMS, specifically targeting the __unique_form_id__ parameter. The rule looks for directory traversal sequences ('..') following the parameter, which is characteristic of attempts to read sensitive files outside the intended web directory.
Page 13 of 116