Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects successful exploitation attempts targeting Vite development servers via chained access-control bypass vulnerabilities (CVE-2025-30208, CVE-2025-31125, CVE-2024-45811). The rule identifies malicious GET requests using the /@fs/ endpoint with specific query parameters, resulting in a successful HTTP 200 response, while originating from non-internal IP addresses.
Detects incoming HTTP GET requests targeting Vite development server environments that utilize suspicious query parameters typically associated with vulnerability exploitation (e.g., directory traversal or sensitive file access). The rule specifically flags requests where the User-Agent string contains bot keywords but excludes verified IP ranges, suggesting an attempt to bypass security filters by spoofing crawler identities.
Detects incoming HTTP GET requests targeting Vite development server environments that utilize suspicious query parameters typically associated with vulnerability exploitation (e.g., directory traversal or sensitive file access). The rule specifically flags requests where the User-Agent string contains bot keywords but excludes verified IP ranges, suggesting an attempt to bypass security filters by spoofing crawler identities.
Detects an exploitation attempt against the Vite Development Server (CVE-2026-39364) where an attacker uses specific query parameters to bypass file access restrictions and disclose sensitive files. The rule triggers on GET requests containing suspicious import-related query parameters and checks the resulting response to ensure a successful 200/206 status code and non-HTML content type.
Detects an exploitation attempt against the Vite Development Server (CVE-2026-39364) where an attacker uses specific query parameters to bypass file access restrictions and disclose sensitive files. The rule triggers on GET requests containing suspicious import-related query parameters and checks the resulting response to ensure a successful 200/206 status code and non-HTML content type.
Detects high-volume bursts of HTTP GET requests against specific paths associated with a Vite development server (/@vite/client, /@fs/, /src/) on port 5173. This pattern is indicative of automated reconnaissance or vulnerability scanning targeting an exposed development environment.
Detects incoming HTTP requests attempting to exploit a path traversal vulnerability in the GitLab Commits API (CVE-2026-85706). The rule looks for URI patterns containing directory traversal sequences (e.g., ../) targeting the repository commits endpoint.
Detects outbound HTTP GET requests to a specific C2 domain 'luizestrelhashapr.online' masquerading as CSS file fetches. The request pattern uses a specific path '/google_api/' followed by predefined alphanumeric filenames, consistent with the KREMLIN malware browser extension's C2 polling mechanism.
Detects network traffic associated with the GhostCode phishing kit, specifically identifying API requests to a harvester service and subsequent responses indicating the activation of FlashProxy residential proxy services. These indicators suggest an attacker is leveraging proxy infrastructure to manage command-and-control communications and mask the source of malicious activity.
Detects incoming HTTP GET requests targeting known API endpoints associated with the GhostCode phishing kit. These endpoints (/api/harvester) are used by the phishing kit to poll for session details, device codes, or flow identifiers, characteristic of credential harvesting operations.
Detects HTTP POST requests to the Telegram Bot API (/sendPhoto) containing structured string patterns typical of exfiltrated Dahua camera credentials, including login, password, port, location, and channel information. This indicates an automated exfiltration attempt where stolen device credentials are sent to an adversary-controlled Telegram bot.
This rule detects HTTP traffic patterns consistent with a Golang-based Remote Access Trojan (RAT) beaconing to a command and control (C2) server. It monitors for specific fitness-themed URI paths used for C2 communication and identifies the use of a hardcoded domain ('monitorondomainwintgt') within both the HTTP Host header and the TLS SNI field.
This rule detects network traffic containing the 'HCENC1' signature prefix within the payload, which is associated with the RUSTYSHADE malware family. This pattern indicates an encrypted communication channel used for command and control (C2) purposes.
This rule detects network traffic containing the 'HCENC1' signature prefix within the payload, which is associated with the RUSTYSHADE malware family. This pattern indicates an encrypted communication channel used for command and control (C2) purposes.
Detects network beaconing activity associated with Transparent Tribe (APT36) Golang-based remote access trojans (RAT). The rule identifies specific HTTP POST requests to suspicious domains and URI paths ('/api/gym-facility', '/api/gym-membership') that mimic legitimate fitness-related traffic to blend in with environment noise.
This rule detects network traffic patterns associated with the PSNATCH malware exfiltrating data to GitHub. It specifically identifies HTTP requests to 'api.github.com' using the custom 'SmartUploader' User-Agent string, which is characteristic of this malware's exfiltration behavior.
This rule detects network traffic patterns indicative of the Transparent Tribe threat group using the GitHub API for command-and-control (C2) operations. It specifically identifies HTTP requests to GitHub's content API that attempt to access or exchange files named 'command.txt', 'results.txt', 'heartbeat.txt', or 'screenshot.png', which are known indicators of this actor's C2 communication strategy.
This rule detects suspicious outbound HTTP POST requests to a specific domain ('monitorondomainwintgt') containing known API endpoints ('/api/gym-facility', '/api/gym-membership', '/api/coach-instructions') often used by Golang-based Remote Access Trojans (RATs) for command-and-control communication.
Detects outbound HTTP requests to known Kimsuky command and control (C2) infrastructure associated with the Stella_Gary campaign. The rule monitors for specific URI patterns ('/unicorn/mort.php' or '/unicorn/uni.txt') commonly used by this threat actor for beaconing.
Detects specific malformed HTTP request patterns associated with the Casbaneiro (Metamorfo) banking trojan. The rules identify suspicious beaconing attempts, including specific URI structures ('/$p', '/$or?u=') and malformed headers (missing Host header combined with specific Content-Length anomalies).
This rule detects network traffic originating from potential Casbaneiro or Ousaban malware that uses HTTP 302 redirects to redirect non-targeted IP addresses to Google or YouTube. This behavior is used as a geofencing and sandbox evasion technique to prevent security analysts and automated systems from seeing the actual malicious payload.
Page 38 of 116