Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects outbound network traffic to the Telegram Bot API characteristic of malware command and control (C2). This rule specifically identifies Python-based requests using the 'python-requests' user agent performing common Telegram API operations (getUpdates, sendDocument, sendPhoto, getFile) typical of C2 frameworks like HEAVYGRAM or CHOSEN BRICK.
Detects outbound HTTP GET requests to a specific C2 domain 'luizestrelhashapr.online' masquerading as CSS file fetches. The request pattern uses a specific path '/google_api/' followed by predefined alphanumeric filenames, consistent with the KREMLIN malware browser extension's C2 polling mechanism.
Detects outbound HTTP GET requests to a specific C2 domain 'luizestrelhashapr.online' masquerading as CSS file fetches. The request pattern uses a specific path '/google_api/' followed by predefined alphanumeric filenames, consistent with the KREMLIN malware browser extension's C2 polling mechanism.
Detects specific outbound HTTP POST requests to a known Amatera Stealer command and control domain. The rule looks for the unique URI path '/T.@w' and a specific 'Command: GetEndpoints' header structure commonly used by this malware family to beacon to its C2 infrastructure.
This rule detects outgoing HTTP requests to 'apimantax.otax.fun' attempting to initiate a WebSocket upgrade connection. This is characteristic of the Mantax Otax v2 malware family establishing a Command and Control (C2) channel.
Detects HTTP POST requests to gapidriver.com/api/rest.php containing stager-specific status messages like 'build started', 'launch error', or 'all builds loaded', indicating NeedleStealer malware command-and-control activity.
Detects HTTP POST requests to gapidriver.com/api/rest.php containing stager-specific status messages like 'build started', 'launch error', or 'all builds loaded', indicating NeedleStealer malware command-and-control activity.
Detects repeated manual HTTP GET requests from many distinct source IPs to a canary token resource. The URI pattern follows a format indicative of a tracked canary token resource, and the threshold of 49 unique source IPs accessing the resource within a prolonged period suggests potential unauthorized reconnaissance or probing activities.
Detects high-frequency, repeated access to a specific fraud-tracking or canary token link by sources utilizing rotating VPNs or proxies over an extended period. This behavior is indicative of automated probing or credential validation attempts associated with the Phantom Deal campaign.
Detects high-frequency, repeated access to a specific fraud-tracking or canary token link by sources utilizing rotating VPNs or proxies over an extended period. This behavior is indicative of automated probing or credential validation attempts associated with the Phantom Deal campaign.
Detects an attempt to exploit CVE-2026-24858 in FortiCloud SSO by sending a crafted SAML authentication request that lacks a signature. This vulnerability allows an attacker to bypass authentication by providing an unsigned SAML response.
Detects high-frequency requests to the RubyGems legacy API key endpoint, which may indicate attempts to harvest or bruteforce developer API keys. The rule specifically monitors for request patterns involving variations like .yaml, .json, or parameter-based variants often observed in scanning activities.
This rule detects potential Server-Side Request Forgery (SSRF) attempts targeting specific UK council ModernGov websites (e.g., Lambeth, Wandsworth, Southwark). It looks for outbound HTTP requests from non-browser clients (specifically identifying 'Ruby' in the User-Agent string) to these specific gov.uk domains, with a threshold to catch repeated attempts.
This rule detects potential Server-Side Request Forgery (SSRF) attempts targeting specific UK council ModernGov websites (e.g., Lambeth, Wandsworth, Southwark). It looks for outbound HTTP requests from non-browser clients (specifically identifying 'Ruby' in the User-Agent string) to these specific gov.uk domains, with a threshold to catch repeated attempts.
Detects an HTTP POST request targeting the host 'tt.yeyoujs.com' at the URI path '/api/agent/enroll', containing a specific Python aiohttp User-Agent string. This pattern is characteristic of a C2 agent attempting to register or enroll with an external command-and-control server.
This rule monitors incoming HTTP requests for the presence of the Base64-encoded string 'rO0AB', which is the standard header for serialized Java objects. The presence of this header in an HTTP request body is a strong indicator of a Java deserialization exploitation attempt.
This rule detects common patterns associated with Expression Language (EL) injection attacks in HTTP traffic. These patterns typically attempt to invoke Java reflection, runtime execution, or process creation through vulnerable applications utilizing templating engines or expression evaluators (e.g., OGNL, Spring Expression Language). Attackers use these to achieve remote code execution (RCE).
This rule detects HTTP requests containing an invalid or malformed 'Transfer-Encoding' header value. Such malformations are often used in HTTP Request Smuggling (HRS) attacks to cause desynchronization between a front-end load balancer/proxy and a back-end web server, potentially allowing an attacker to smuggle requests, bypass security controls, or perform cache poisoning.
This rule monitors for HTTP header folding, a legacy evasion technique where header fields are split across multiple lines by using whitespace characters (tabs or spaces). This technique may be used by adversaries to bypass security controls such as web application firewalls or load balancers by smuggling malicious payloads or obfuscating traffic.
Detects repeated HTTP request field length anomalies which may indicate attempts to exploit buffer overflows, memory corruption vulnerabilities, or parser abuse against web services.
Detects anomalous outbound HTTP requests to the Google OAuth token endpoint that mimic the behavior of the JSCeal malware. The rule identifies requests that lack standard browser-based User-Agent strings and omit the 'code_verifier' parameter, which is typically required in legitimate PKCE-enabled OAuth flows, indicating potential automated token theft.
Page 46 of 116