Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects HTTP requests directed at Microsoft Exchange Outlook Web Access (OWA) that contain suspicious 'fakePath' and 'fakePageName' parameters in the URI. These parameters are indicators of the 'GhostContainer' malware attempting to establish a socket forwarding proxy through the web server to facilitate command and control communications.
Detects unauthorized exfiltration of sensitive information, such as camera credentials or location data, directed to the Telegram Bot API as part of the 'Operation CameraSwarm' campaign.
Detects unauthorized exfiltration of sensitive information, such as camera credentials or location data, directed to the Telegram Bot API as part of the 'Operation CameraSwarm' campaign.
This rule detects attempts to exploit CVE-2021-33044, a vulnerability in Dahua hardware that allows an attacker to bypass authentication by sending a specially crafted request to the global.login endpoint.
This rule detects attempts to exploit CVE-2021-33044, a vulnerability in Dahua hardware that allows an attacker to bypass authentication by sending a specially crafted request to the global.login endpoint.
Detects an attempt to exploit CVE-2021-33045 in Dahua devices, where an attacker sends a malicious JSON-RPC request to bypass authentication by leveraging the 'Loopback' login type and targeting the '127.0.0.1' address in the 'ipAddr' parameter.
Detection of specific indicators associated with the GhostCode phishing kit, including scripts utilizing PBKDF2/AES-GCM for redirection decryption and a characteristic URL path pattern (/scanna/).
Detects incoming HTTP requests attempting to exploit a path traversal vulnerability in the GitLab Commits API (CVE-2026-85706). The rule looks for URI patterns containing directory traversal sequences (e.g., ../) targeting the repository commits endpoint.
Detects incoming HTTP requests to the WSO2 admin API endpoint that utilize a JSON Web Token (JWT) with the 'alg=none' algorithm, indicating an attempt to bypass authentication via JWT token forgery (CVE-2026-5430).
Detects incoming HTTP requests to the WSO2 admin API endpoint that utilize a JSON Web Token (JWT) with the 'alg=none' algorithm, indicating an attempt to bypass authentication via JWT token forgery (CVE-2026-5430).
Detects attempts to exploit a vulnerability in WSO2 API Manager and Traffic Manager that allows for authentication bypass by utilizing a malformed JWT with the 'alg=none' header. Attackers can leverage this to impersonate users or bypass security controls by providing a crafted Bearer token in the Authorization header.
Detects attempts to exploit a vulnerability in WSO2 API Manager and Traffic Manager that allows for authentication bypass by utilizing a malformed JWT with the 'alg=none' header. Attackers can leverage this to impersonate users or bypass security controls by providing a crafted Bearer token in the Authorization header.
This rule detects HTTP GET requests to a specific URI path ('/wp-content/uploads/init/') on the domain 'wasmer.app', which is associated with Kimsuky (APT43) C2 beaconing activity. The presence of a token parameter in the URI and the structure of the request indicates an established connection for command and control purposes.
Detects HTTP POST requests to the Dropbox API endpoint (/2/files/upload) that appear to be unauthorized file uploads, specifically identifying patterns associated with the Kimsuky threat group. The rule triggers on both the presence of suspicious directory naming conventions (_lns/) in the Dropbox-API-Arg header and the use of hardcoded Authorization bearer tokens, both characteristic of Kimsuky's data exfiltration techniques.
Detects HTTP POST requests to the Dropbox API endpoint (/2/files/upload) that appear to be unauthorized file uploads, specifically identifying patterns associated with the Kimsuky threat group. The rule triggers on both the presence of suspicious directory naming conventions (_lns/) in the Dropbox-API-Arg header and the use of hardcoded Authorization bearer tokens, both characteristic of Kimsuky's data exfiltration techniques.
Detects specific malformed HTTP request patterns associated with the Casbaneiro (Metamorfo) banking trojan. The rules identify suspicious beaconing attempts, including specific URI structures ('/$p', '/$or?u=') and malformed headers (missing Host header combined with specific Content-Length anomalies).
Detects specific malformed HTTP request patterns associated with the Casbaneiro (Metamorfo) banking trojan. The rules identify suspicious beaconing attempts, including specific URI structures ('/$p', '/$or?u=') and malformed headers (missing Host header combined with specific Content-Length anomalies).
This rule detects network traffic originating from potential Casbaneiro or Ousaban malware that uses HTTP 302 redirects to redirect non-targeted IP addresses to Google or YouTube. This behavior is used as a geofencing and sandbox evasion technique to prevent security analysts and automated systems from seeing the actual malicious payload.
This rule detects network traffic originating from potential Casbaneiro or Ousaban malware that uses HTTP 302 redirects to redirect non-targeted IP addresses to Google or YouTube. This behavior is used as a geofencing and sandbox evasion technique to prevent security analysts and automated systems from seeing the actual malicious payload.
This rule detects potential command and control (C2) activity associated with the Koktevrat malware, specifically looking for WebSocket handshake requests (HTTP GET with 'Upgrade' header) to domain names that follow a generated pattern (8-27 alphanumeric characters ending in .icu or .cfd).
This rule detects potential command and control (C2) activity associated with the Koktevrat malware, specifically looking for WebSocket handshake requests (HTTP GET with 'Upgrade' header) to domain names that follow a generated pattern (8-27 alphanumeric characters ending in .icu or .cfd).
Page 35 of 116