Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects HTTP requests containing malicious JDBC strings targeting PaperCut NG/MF print management software, which are indicative of attempts to exploit authentication bypass and remote code execution vulnerabilities (CVE-2026-81578, CVE-2026-82078).
This rule detects attempts to exploit the LiteLLM proxy pass-through endpoint to interact with the cloud Instance Metadata Service (IMDS). Specifically, it identifies configuration attempts to route traffic to the IMDS IP (169.254.169.254) and subsequent requests to retrieve IAM security credentials, which is indicative of a Server-Side Request Forgery (SSRF) attack to steal cloud identity tokens.
Detects HTTP GET requests to '/api.php?t=' containing a 13-digit timestamp identifier, followed by a response body containing 'download_link'. This pattern is indicative of the SilverFox malware relaying instructions or stage-two payload delivery.
Detects indicators of cross-site scripting (XSS) attacks aimed at stealing web session cookies. The rule covers the injection of malicious scripts into client responses, anomalous CORS preflight responses that could facilitate data exfiltration, and subsequent HTTP callbacks or beaconing containing cookie data to external endpoints.
Detects the Iron Man System kit's known template artifact path, and separately its randomized per-deployment admin-panel path shape combined with a Host header on a disposable TLD. Splitting these and requiring the disposable-TLD host on the generic admin-path rule avoids matching legitimate multi-tenant apps or hardened CMS installs that use similar random-path-plus-/admin/ obfuscation on ordinary domains.
Detects high-frequency access requests to SharePoint or OneDrive services using the 'python-httpx' library. This behavior is indicative of automated scraping or mass data retrieval often associated with malicious actors or unauthorized automated tools.
This rule detects high-frequency network activity directed toward the Microsoft Graph API (graph.microsoft.com) utilizing the 'python-httpx' user agent. This pattern matches known exfiltration activity associated with Storm-3121/Storm-3032 threat groups, where automated scripts are used to move data out of the environment via legitimate cloud service APIs.
Detects HTTP POST requests targeting Cisco Firepower Management Center (FMC) that contain strings associated with internal service account processes or configuration files, indicative of an attempt to exploit CVE-2026-20316.
Detects unauthorized HTTP Basic authentication attempts targeting Cisco Firepower Management Center (FMC) using hardcoded service account credentials associated with CVE-2026-20316.
Detects outbound network traffic to the Telegram Bot API characteristic of malware command and control (C2). This rule specifically identifies Python-based requests using the 'python-requests' user agent performing common Telegram API operations (getUpdates, sendDocument, sendPhoto, getFile) typical of C2 frameworks like HEAVYGRAM or CHOSEN BRICK.
This rule detects outgoing HTTP requests to 'apimantax.otax.fun' attempting to initiate a WebSocket upgrade connection. This is characteristic of the Mantax Otax v2 malware family establishing a Command and Control (C2) channel.
This rule monitors HTTP POST requests for patterns indicative of armored malware (specifically StealC) beaconing to a Command and Control (C2) server. The rule looks for established connections that use POST requests while avoiding common patterns found in standard web traffic (like JSON, XML, or standard form data) and having a specific request body size threshold. The thresholding mechanism helps reduce noise by only alerting when multiple occurrences are observed within a short time frame, suggesting automated beaconing behavior.
Detects network indicators associated with 'ClickFix' social engineering campaigns. The rules identify connections to known malicious domains and IP addresses involved in serving fake CAPTCHA prompts or error-resolution instructions, as well as the delivery and subsequent transmission of specific overlay cookies ('cookie-captcha-complete') used in these attacks.
Detects outbound HTTP POST beaconing behavior to a known C2 IP address associated with the StealC malware and ClickFix campaign. This rule monitors for established connections to the hardcoded infrastructure used for exfiltrating data or receiving commands.
Detects network indicators associated with the StealC information stealer, including DNS lookups for identified C2 domains, HTTPS traffic to known C2 endpoints, and suspicious POST requests using multipart/form-data indicative of credential or session data exfiltration.
Detects outbound HTTP POST requests directed at a known StealC command-and-control IP address. The rule identifies suspicious beaconing behavior by looking for POST requests that lack a standard User-Agent, do not utilize common HTTP content types, and contain a request body exceeding 16 bytes, suggesting custom binary protocol usage.
Detects outbound HTTP POST requests directed at a known StealC command-and-control IP address. The rule identifies suspicious beaconing behavior by looking for POST requests that lack a standard User-Agent, do not utilize common HTTP content types, and contain a request body exceeding 16 bytes, suggesting custom binary protocol usage.
Detects anomalous HTTP CONNECT proxy handshake requests and responses associated with Tengu malware. The rule monitors for 'HTTP/1.1 200 Connection Established' and 'HTTP/1.1 407 Proxy Auth Required' responses initiated from internal hosts, as well as outgoing HTTP CONNECT requests containing a 'Proxy-Authorization' header that match established Tengu bot proxy patterns.
Detects the Iron Man System phishing kit via its HTTP fingerprint: a request-header rule (ETag/Server/Via combo) checked on the external server's response, and three request-side rules checking for the kit's hashed asset paths and favicon when an internal host requests them from an external site. Fixed a direction bug on the three request-side rules that had source/destination reversed (they previously required an external host to request the path from an internal server, which would rarely if ever fire).
Detects the Iron Man System phishing kit via its HTTP fingerprint: a request-header rule (ETag/Server/Via combo) checked on the external server's response, and three request-side rules checking for the kit's hashed asset paths and favicon when an internal host requests them from an external site. Fixed a direction bug on the three request-side rules that had source/destination reversed (they previously required an external host to request the path from an internal server, which would rarely if ever fire).
Detects unauthorized or suspicious POST requests to the Cisco Firepower Management Center (FMC) web interface that lack standard authentication headers (Cookie, Authorization, or X-Api-Token). This pattern is consistent with exploit attempts targeting CVE-2026-20079.
Page 41 of 116