Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects HTTP GET requests to external services 'trycloudflare.com' or 'workers.dev' that return a file content starting with the 'MZ' and 'PE' header signatures within the first 256 bytes, indicating a Windows executable payload download often associated with AvisLoader activity.
Detects HTTP GET requests to external services 'trycloudflare.com' or 'workers.dev' that return a file content starting with the 'MZ' and 'PE' header signatures within the first 256 bytes, indicating a Windows executable payload download often associated with AvisLoader activity.
Detects HTTP PUT requests that follow a specific pattern associated with MacSync Stealer's exfiltration mechanism. The rule identifies multipart data transmission by looking for specific URI parameters ('upload_id', 'chunk_index', 'total_chunks') used to piece together stolen ZIP files over an established HTTP connection.
Detects an unauthenticated remote code execution (RCE) attempt against Langflow via the /api/v1/validate/code endpoint. The rule monitors for POST requests containing code execution patterns such as eval, exec, os.system, or subprocess, indicating an attacker attempting to leverage the vulnerability to execute arbitrary commands.
Detects HTTP traffic originating from curl user agents attempting to communicate with known MacSync Stealer command-and-control URI patterns, specifically targeting GET check-in requests and POST payload exfiltration requests.
Detects outbound HTTP GET requests containing a .ps1 file extension in the URI, originating from a host without a specified User-Agent, and targeting domains other than Microsoft or Windows Update. This pattern is characteristic of a persistence mechanism executing a PowerShell script to download a secondary payload (e.g., via Net.WebClient).
Detects outbound network traffic to Microsoft Graph API originating from a user-agent string identified as 'python-httpx'. This behavior is characteristic of automated scripts or malicious tools using Python libraries to interact with Microsoft cloud services, potentially for data exfiltration or unauthorized API interaction.
Detects HTTP and TLS traffic patterns indicative of data exfiltration to Slack, specifically targeting hardcoded Slack API tokens, Slack channel IDs in HTTP request bodies, or traffic directed to hooks.slack.com, commonly associated with malicious npm packages.
Detects network traffic from internal hosts interacting with Ethereum Sepolia testnet contracts via common blockchain infrastructure providers (Alchemy, Infura) or JSON-RPC calls. These patterns are characteristic of 'indexed-btree' malware utilizing decentralized blockchain technology for command-and-control polling.
Detects network activity associated with a VBScript-based dropper attempting to retrieve payloads from known malicious infrastructure (cdn.imageurlgenerator.com) or abusing legitimate file hosting services (filemail.com) to bypass traditional security filters.
Detects an attempt to exploit a quote-injection vulnerability within the SharePoint ToolPane.aspx page, specifically targeting the Register directive to bypass SafeControls restrictions. This pattern is commonly used for remote code execution or unauthorized application behavior modifications by manipulating server-side parsing.
Detects network activity associated with the ORAX control-plane panel and management service. The rule identifies HTTP traffic containing OraxManage or OraxRDP service strings, SignalR negotiate handshakes directed to common ORAX management ports, and connections to identified ORAX C2 infrastructure domains and IP addresses.
This rule detects interaction between an internal host and the Vapi.ai API, typically used for automating AI-based voice phishing (vishing) calls. It identifies the initiation of a call via POST requests to the Vapi.ai API and subsequent callbacks from Vapi.ai to an attacker-controlled webhook endpoint used for tracking call status.
This rule detects a specific HTTP request pattern associated with the JWR-family Phishing-as-a-Service (PhaaS) platform. The detection looks for a WebSocket handshake initiation (GET request with specific URI segments 'webSocket/QT/' and a known hardcoded string) and an 'Upgrade' header, which are indicative of a command-and-control (C2) channel establishment.
Detects network activity associated with the GhostCode phishing kit, including HTTP requests to specific access-prefixed subdomains and DNS lookups for those domains. Additionally, it detects HTTP responses containing specific spoofed browser tab titles often used in these phishing campaigns.
Detects HTTP requests targeting the /terminal/ws endpoint of a Marimo notebook application, which indicates an attempt to exploit CVE-2026-39987, a pre-authentication Remote Code Execution vulnerability involving WebSocket connections.
Detects network activity associated with the SilkParasite botnet. The rule identifies inbound/outbound HTTP heartbeat check-ins using a specific URI pattern (/ping?h=) and direct TCP connections to a known malicious C2 IP address.
Detects network activity associated with the Psychedelic Stealer malware command-and-control (C2) communication patterns. The rule identifies specific API endpoints used for task polling, heartbeat pings, check-ins, and task acknowledgement, as well as connections to a known malicious C2 infrastructure, all characterized by the presence of a specific 'X-API-Key' header.
Detects network activity associated with RatHat FRP (Fast Reverse Proxy), including configuration fetching, deployment notifications, and command-and-control handshakes. These rules monitor for specific HTTP API endpoints and TCP patterns used by the tool to establish unauthorized reverse tunnels.
Detects network traffic associated with the RatHat malware family, which leverages the Gemini API to perform automated UI navigation on Android devices. The rule identifies both the outgoing prompt containing UI analysis instructions and the corresponding incoming API response containing coordinate-based navigation instructions.
Detects OAuth 2.0 authorization requests sent to login.microsoftonline.com using the 'prompt=none' parameter, where the redirect_uri domain is not a trusted Microsoft property. This is a common indicator of consent phishing or malicious OAuth application abuse where an attacker attempts to redirect authorization tokens to an adversary-controlled endpoint.
Page 22 of 116