Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects network traffic indicative of an adversary using the Ethereum blockchain as a dead-drop C2 channel. The rules identify specific JSON-RPC methods (eth_getTransactionByHash, eth_call) typically associated with querying blockchain data for C2 instructions, as well as non-browser processes initiating these requests to external endpoints.
Detects unauthenticated HTTP POST requests targeting the FortiGate administrative API (/api/v2/), which may indicate exploitation attempts related to CVE-2025-25249. The rule specifically looks for requests lacking authentication headers (Cookie or Authorization).
Detects outbound HTTP requests to the Telegram Bot API containing hardcoded bot tokens and chat IDs associated with the malicious 'indexed-btree' npm package campaign. This indicates active data exfiltration or command-and-control communication.
Detects HTTP requests directed at the 'noah-ssh.com.cn' domain targeting '/api.php' with a specific 13-digit millisecond timestamp pattern. This behavior is indicative of a relay or dispatcher mechanism associated with SilverFox SEO poisoning campaigns, used to manage or redirect traffic.
This rule detects HTTP requests to the Microsoft device login endpoint (/devicelogin) that originate from a non-Microsoft referrer domain. This behavior is highly indicative of Adversary-in-the-Middle (AiTM) phishing attacks targeting OAuth device code flows, where a malicious proxy site redirects users to the legitimate Microsoft login page while attempting to capture session tokens.
Detects suspicious network traffic to Ethereum Sepolia testnet RPC endpoints (Alchemy and Infura) indicative of the 'indexed-btree' malware campaign. The rule monitors for characteristic C2 polling patterns, specifically requests involving malicious contract addresses and specific RPC methods (eth_call, eth_getStorageAt) associated with this activity.
Detects outbound HTTP POST requests to known public Ethereum RPC gateways (Alchemy and Infura) containing embedded, hardcoded API keys or references to specific contract addresses associated with the 'indexed-btree' malware campaign. This pattern indicates a compromised host leveraging legitimate Web3 infrastructure for Command and Control (C2) communication.
This rule detects potential exploitation attempts against SonicWall SMA1000 appliances, specifically targeting the /wsproxy endpoint using a custom 'SMA Connect Agent' user agent string. This behavior is associated with SSRF vulnerabilities (CVE-2026-15409 and CVE-2026-15410) identified as being utilized by the threat actor group UTA0533 in campaigns involving INC Ransomware.
Detects high-volume HTTP GET requests containing the 'SetupCompleted' URI pattern directed at PaperCut servers, which is indicative of automated exploitation attempts targeting authentication bypass vulnerabilities.
Detects network traffic consistent with automated penetration testing frameworks such as Nuclei, ffuf, or sqlmap. This rule monitors HTTP user-agent strings and triggers an alert if high-frequency scanning activity from a single source is observed within a 60-second window, which is indicative of automated reconnaissance or vulnerability scanning.
Detects attempts to exploit the Langflow 'validate/code' endpoint, which is associated with CVE-2025-3248. The rule monitors HTTP POST requests to this endpoint for specific character patterns within the request body, indicative of malicious payloads attempting to achieve code execution.
Detects repeated HTTP POST requests containing 'ScreenConnect' in the URI, originating from external networks. This pattern is indicative of automated scanning activity attempting to exploit potential authentication bypass or session hijacking vulnerabilities (such as CVE-2026-84869) in ConnectWise ScreenConnect instances.
Detects an attempt to exploit CVE-2025-3248, an unauthenticated remote code execution vulnerability in Langflow. The rule identifies POST requests to the '/api/v1/validate/code' endpoint that contain base64 encoded strings in the request body, which are characteristic of malicious Python payloads designed to execute arbitrary code.
This rule detects network traffic indicative of N0va Phishkit verification or session initialization. It looks for specific GET request URI parameters (/api/verification/init?session=, flow=, prompt_profile=) that align with the initial handshake phase of this phishing kit, which is often used for credential and session cookie theft.
This rule detects network traffic indicative of N0va Phishkit verification or session initialization. It looks for specific GET request URI parameters (/api/verification/init?session=, flow=, prompt_profile=) that align with the initial handshake phase of this phishing kit, which is often used for credential and session cookie theft.
Detects HTTP downloads from GitHub involving specific repositories and archive naming patterns commonly associated with the 'NightEagle GhostContainer' threat activity. These patterns involve downloading ZIP files disguised as development or resource packages (e.g., 'mirror-js', 'browserthemes', 'resource-pack').
Detects specific malformed HTTP request patterns associated with the Casbaneiro (Metamorfo) banking trojan. The rules identify suspicious beaconing attempts, including specific URI structures ('/$p', '/$or?u=') and malformed headers (missing Host header combined with specific Content-Length anomalies).
This rule detects network traffic originating from potential Casbaneiro or Ousaban malware that uses HTTP 302 redirects to redirect non-targeted IP addresses to Google or YouTube. This behavior is used as a geofencing and sandbox evasion technique to prevent security analysts and automated systems from seeing the actual malicious payload.
This rule detects potential command and control (C2) activity associated with the Koktevrat malware, specifically looking for WebSocket handshake requests (HTTP GET with 'Upgrade' header) to domain names that follow a generated pattern (8-27 alphanumeric characters ending in .icu or .cfd).
Detects attempts to bypass authentication on Nacos servers, including the use of spoofed Nacos-Server User-Agent headers, suspicious API query patterns missing required access tokens, and the subsequent use of forged JWT tokens signed with default keys.
Detects unauthenticated HTTP POST requests targeting the FortiGate administrative API (/api/v2/), which may indicate exploitation attempts related to CVE-2025-25249. The rule specifically looks for requests lacking authentication headers (Cookie or Authorization).
Page 32 of 116