Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects incoming HTTP requests attempting to exploit a path traversal vulnerability in the GitLab Commits API (CVE-2026-85706). The rule looks for URI patterns containing directory traversal sequences (e.g., ../) targeting the repository commits endpoint.
Detects HTTP POST requests to gapidriver.com/api/rest.php containing stager-specific status messages like 'build started', 'launch error', or 'all builds loaded', indicating NeedleStealer malware command-and-control activity.
Detects HTTP traffic from internal hosts to the 'gapidriver.com' domain, specifically identifying the GapiUpdate stager behavior. The rule looks for authenticated GET requests to '/api/get.php' using a specific Bearer token and User-Agent, as well as status reporting to '/api/rest.php'.
Detects HTTP traffic from internal hosts to the 'gapidriver.com' domain, specifically identifying the GapiUpdate stager behavior. The rule looks for authenticated GET requests to '/api/get.php' using a specific Bearer token and User-Agent, as well as status reporting to '/api/rest.php'.
This rule detects potential exfiltration of sensitive files, specifically 'cert.pem' and 'private.key', via HTTP POST requests to the '/api/adbk/upload' endpoint. This pattern is characteristic of the RatHat malware attempting to exfiltrate device credentials to a Command and Control (C2) server.
This rule detects network traffic indicative of the HEAVYGRAM malware beaconing to Telegram's API. It identifies HTTP requests to api.telegram.org containing specific URI strings and parameters, which suggests the bot is performing check-in activities or sending status updates via a Telegram bot channel.
Detects network communications associated with the MovieReaper C2 framework. The rule identifies HTTP requests to specific fake cloud UI assets, connections to the domain 'deadhub.org', and fallback communication attempts to a known hardcoded IP address (193.23.118.155).
Detects attempts to bypass authentication on Nacos servers, including the use of spoofed Nacos-Server User-Agent headers, suspicious API query patterns missing required access tokens, and the subsequent use of forged JWT tokens signed with default keys.
Detects attempts to bypass authentication on Nacos servers, including the use of spoofed Nacos-Server User-Agent headers, suspicious API query patterns missing required access tokens, and the subsequent use of forged JWT tokens signed with default keys.
Detects attempts to bypass authentication on Nacos servers, including the use of spoofed Nacos-Server User-Agent headers, suspicious API query patterns missing required access tokens, and the subsequent use of forged JWT tokens signed with default keys.
Detects unauthenticated HTTP POST requests targeting the FortiGate administrative API (/api/v2/), which may indicate exploitation attempts related to CVE-2025-25249. The rule specifically looks for requests lacking authentication headers (Cookie or Authorization).
Detects an attempt to exploit CVE-2026-24858 in FortiCloud SSO by sending a crafted SAML authentication request that lacks a signature. This vulnerability allows an attacker to bypass authentication by providing an unsigned SAML response.
Detects outbound network traffic to the Telegram Bot API (api.telegram.org) indicative of long-polling command and control (C2) communication. This behavior is associated with the HEAVYGRAM malware and its use of Telegram as a C2 channel.
Detects outbound HTTP requests to the 'itorrents.org' repository for files with the '.torrent' extension, which may indicate the retrieval of malicious payload components associated with the MovieReaper supply chain campaign.
Detects network activity associated with the Handala Loader malware, specifically identifying attempts to download disguised shellcode or malicious payloads from deadhub.org and associated infrastructure. The rule monitors for specific URI patterns mimicking UI assets and fallback communication attempts to known C2 IP addresses.
Detects HTTP POST requests from Android devices identified as RatHat malware, specifically targeting exfiltration of sensitive data including credentials, cipher keys, and ADB certificate/key uploads via the malware's C2 API.
Detects incoming HTTP requests to sensitive LiteLLM endpoints (/mcp and /guardrails) which are typically intended for internal or controlled use. Exposing these to the public internet may allow unauthorized individuals to interact with, enumerate, or exploit the LiteLLM framework's capabilities.
Detects potential exfiltration activity by identifying HTTP POST/PUT requests to known suspicious domains, including specific operator-controlled hosts and anonymous file sharing services, as well as the use of HTTP Range headers for bulk API data exfiltration.
This rule monitors incoming HTTP requests for the use of PHP stream wrappers (e.g., php://, data://, expect://, etc.). Such wrappers are often leveraged by adversaries to perform Local File Inclusion (LFI) or to achieve Remote Code Execution (RCE) by manipulating input parameters in vulnerable web applications.
This rule detects potential OS command injection attempts in HTTP request parameters by monitoring for common shell command separators and subsequent execution of suspicious system binaries (e.g., sh, bash, curl, wget, python).
Detects HTTP traffic that contains an abnormal number of nested encoding layers, which is often used by attackers to evade network-based inspection signatures and WAF filters.
Page 42 of 116