Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects potential exploitation attempts targeting the Splunk REST API (CVE-2026-20253) by monitoring for unauthenticated inbound requests to the /services/ path. It specifically looks for requests that lack the required Authorization or Cookie headers.
Detects network traffic matching the default HTTP check-in pattern of Mythic C2 agents. This rule monitors for POST requests using a specific hardcoded User-Agent string and Content-Type header commonly used in default Mythic agent configurations, indicating a potential active command-and-control session.
Detects outbound HTTP requests to known Alibaba OSS buckets hosting malicious AdaptixC2 payloads. This is associated with exploitation attempts against PaperCut MF software (referencing CVE-2026-82078 and CVE-2026-81578).
Detects an exploitation attempt against PaperCut MF software leveraging SQL injection to deliver a Java bytecode loader (identified by the 'cafebabe' magic bytes) via a POST request.
Detects repeated attempts to perform IIS 8.3 tilde short-filename enumeration. This reconnaissance technique exploits the legacy DOS 8.3 file naming convention to identify the existence and naming of files or directories on a Microsoft IIS web server.
Detects outbound HTTP requests to 'letsdiskuss.com' with a URI pattern of '/user/', which is characteristic of the 'STAC4924' loader utilizing a dead-drop resolver for command-and-control communication.
Detects network activity related to the 'Blinder Tunnel' C2 infrastructure. The rules identify a Chisel tunnel client initiating a WebSocket handshake (identifiable by the 'chisel-v3-channel' header) to external infrastructure and a DNS lookup for a specific domain (soroshpasargad.com) identified as a relay nameserver used by the threat actor CL-STA-1178.
Detects network activity related to the 'Blinder Tunnel' C2 infrastructure. The rules identify a Chisel tunnel client initiating a WebSocket handshake (identifiable by the 'chisel-v3-channel' header) to external infrastructure and a DNS lookup for a specific domain (soroshpasargad.com) identified as a relay nameserver used by the threat actor CL-STA-1178.
Detects network activity related to the 'Blinder Tunnel' C2 infrastructure. The rules identify a Chisel tunnel client initiating a WebSocket handshake (identifiable by the 'chisel-v3-channel' header) to external infrastructure and a DNS lookup for a specific domain (soroshpasargad.com) identified as a relay nameserver used by the threat actor CL-STA-1178.
Detects a suspicious sequence of events where Kubernetes API resources (namespaces, secrets, configmaps, pods, or nodes) are enumerated, followed by a search query against the Slack API, indicative of a potential reconnaissance phase or sandbox escape attempt.
Detects SQL injection exploitation attempts against MOVEit Transfer targeting the CVE-2023-34362 vulnerability, followed by the deployment and subsequent interaction with the 'human2.aspx' webshell associated with Cl0p ransomware mass-exploitation campaigns.
Detects HTTP GET requests for AgtaBackupAgent.msi or AgtaBackupAgent.version, which are indicative of the download phase of the AgtaBackup Remote Access Trojan (RAT).
Detects the 'HCENC1:' marker in HTTP request and response bodies, which is associated with RUSTYSHADE malware used by the APT36 (Transparent Tribe) threat group for Command and Control communications.
Detects outbound HTTP GET requests to the known malicious domain 'docsportal.in' attempting to retrieve second-stage payloads such as '161.php' or 'com.hta'. This pattern is associated with the SideCopy threat actor's malware delivery infrastructure.
Detects HTTP GET requests to Backblaze B2 storage hosting specific archive files identified as payloads for the RustyShade/RustyMove malware family, often used by the APT36 threat group.
Detects HTTP traffic containing the 'User-token' header, which is indicative of command-and-control (C2) communication patterns associated with the curlRAT backdoor, often attributed to North Korean threat actors such as APT37, Lazarus, or Kimsuky.
Detects network activity associated with a malicious NPM package (typosquatting) beaconing to a known C2 server (69.48.229.140) and performing command and control operations, including command polling and data exfiltration, specifically from a Node.js environment.
Detects unauthenticated HTTP POST requests to the /prompt endpoint of a ComfyUI instance, which is indicative of an attempt to remotely execute workflows on an exposed instance.
Detects inbound HTTP POST requests to the /generate endpoint of a Hugging Face Text Generation Inference (TGI) server. Such requests indicate attempts to use or interact with the inference API, potentially without authentication, which could lead to unauthorized resource utilization or model interaction if the service is not properly secured.
This rule detects external reconnaissance attempts targeting MLflow Tracking Servers by monitoring for inbound HTTP GET requests to the default MLflow API path '/api/2.0/mlflow/'. This behavior is indicative of an adversary scanning for exposed machine learning infrastructure, potentially to facilitate subsequent unauthorized access or exploitation of the tracking server.
Detects outbound HTTP traffic from internal hosts directed toward a known IP address identified as hosting AdaptixC2 infrastructure, specifically associated with the distribution of a trojanized 'mscopilot.exe' executable.
Page 5 of 116