Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects an attempt to exploit CVE-2021-33045 in Dahua devices, where an attacker sends a malicious JSON-RPC request to bypass authentication by leveraging the 'Loopback' login type and targeting the '127.0.0.1' address in the 'ipAddr' parameter.
This rule monitors for network traffic related to known fake GitHub pages and malicious loader sites impersonating LastPass Authenticator. It detects attempts to access specific malicious domains and organization pages on GitHub, as well as the delivery of malicious pages containing spoofed trust badges and branding, commonly used in phishing campaigns.
Detects network activity associated with the EtherHiding technique, where adversaries leverage the Polygon blockchain to resolve command-and-control (C2) infrastructure and communicate with malicious smart contracts. This rule identifies specific JSON-RPC requests ('eth_call') using SloppyRAT contract selectors and DNS queries for blockchain-related RPC endpoints.
Detection of network traffic associated with the delivery of the Rapuncel information stealer. The rules monitor for large ZIP archives masquerading as LastPass Authenticator installers and detect attempts to reach out to external domains for DLL sideloading artifacts (TitanStorage.dll and ProManager.dll).
Detects high-frequency POST requests to the JFrog Artifactory '/access/api/v1/tokens' endpoint, which is indicative of mass exploitation attempts targeting vulnerabilities (CVE-2026-82329) against administrative token management.
This rule detects SQL injection attempts targeting the BuddyBoss members REST endpoint, specifically identifying exploitation patterns associated with the 'sqlmap' tool. The rule monitors for specific URL parameters including 'member_type', 'search_terms', and 'scope' in combination with an 'sqlmap' user-agent, indicating an automated exploitation attempt against the application.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by monitoring for a two-stage pattern: a SignalR negotiation POST request followed by a WebSocket upgrade request to a suspicious domain structure. The pattern specifically targets lookalike domains featuring a random subdomain of at least 12 alphanumeric characters, which is indicative of ORAX-style AiTM infrastructure.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by monitoring for a two-stage pattern: a SignalR negotiation POST request followed by a WebSocket upgrade request to a suspicious domain structure. The pattern specifically targets lookalike domains featuring a random subdomain of at least 12 alphanumeric characters, which is indicative of ORAX-style AiTM infrastructure.
This rule detects potential Adversary-in-the-Middle (AiTM) activity by monitoring for a two-stage pattern: a SignalR negotiation POST request followed by a WebSocket upgrade request to a suspicious domain structure. The pattern specifically targets lookalike domains featuring a random subdomain of at least 12 alphanumeric characters, which is indicative of ORAX-style AiTM infrastructure.
This rule detects potential command and control (C2) communication related to the GhostContainer malware. It inspects HTTP POST requests directed at Microsoft Outlook Web Access (OWA) paths containing a suspicious 'x-owa-urlpostdata' header. The presence of this specific header, followed by a base64-encoded string of significant length, indicates an attempt to deliver C2 commands or exfiltrate data through OWA infrastructure.
This rule detects HTTP requests directed at Microsoft Exchange Outlook Web Access (OWA) that contain suspicious 'fakePath' and 'fakePageName' parameters in the URI. These parameters are indicators of the 'GhostContainer' malware attempting to establish a socket forwarding proxy through the web server to facilitate command and control communications.
This rule detects HTTP requests directed at Microsoft Exchange Outlook Web Access (OWA) that contain suspicious 'fakePath' and 'fakePageName' parameters in the URI. These parameters are indicators of the 'GhostContainer' malware attempting to establish a socket forwarding proxy through the web server to facilitate command and control communications.
Detects HTTP downloads from GitHub involving specific repositories and archive naming patterns commonly associated with the 'NightEagle GhostContainer' threat activity. These patterns involve downloading ZIP files disguised as development or resource packages (e.g., 'mirror-js', 'browserthemes', 'resource-pack').
Detects HTTP downloads from GitHub involving specific repositories and archive naming patterns commonly associated with the 'NightEagle GhostContainer' threat activity. These patterns involve downloading ZIP files disguised as development or resource packages (e.g., 'mirror-js', 'browserthemes', 'resource-pack').
Detects incoming HTTP GET requests targeting Vite development server environments that utilize suspicious query parameters typically associated with vulnerability exploitation (e.g., directory traversal or sensitive file access). The rule specifically flags requests where the User-Agent string contains bot keywords but excludes verified IP ranges, suggesting an attempt to bypass security filters by spoofing crawler identities.
Detects incoming HTTP GET requests targeting Vite development server environments that utilize suspicious query parameters typically associated with vulnerability exploitation (e.g., directory traversal or sensitive file access). The rule specifically flags requests where the User-Agent string contains bot keywords but excludes verified IP ranges, suggesting an attempt to bypass security filters by spoofing crawler identities.
Detects path traversal attempts against a Vite development server by monitoring for various forms of URI encoding (single/double) and suspicious path patterns (e.g., /etc/passwd, .env, .git/config, /@fs/). The rule tracks these attempts using flowbits and alerts when a successful HTTP 200 response is received after a matching traversal request.
Detects path traversal attempts against a Vite development server by monitoring for various forms of URI encoding (single/double) and suspicious path patterns (e.g., /etc/passwd, .env, .git/config, /@fs/). The rule tracks these attempts using flowbits and alerts when a successful HTTP 200 response is received after a matching traversal request.
Detects attempts to access sensitive files like environment variables (.env), cloud provider credentials (AWS/Azure), or Terraform state files via a web server interface, specifically targeting Vite development server deployments.
Detects an exploitation attempt against the Vite Development Server (CVE-2026-39364) where an attacker uses specific query parameters to bypass file access restrictions and disclose sensitive files. The rule triggers on GET requests containing suspicious import-related query parameters and checks the resulting response to ensure a successful 200/206 status code and non-HTML content type.
Detects an exploitation attempt against the Vite Development Server (CVE-2026-39364) where an attacker uses specific query parameters to bypass file access restrictions and disclose sensitive files. The rule triggers on GET requests containing suspicious import-related query parameters and checks the resulting response to ensure a successful 200/206 status code and non-HTML content type.
Page 40 of 116