Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects HTTP traffic patterns associated with the JSCeal malware family, specifically focusing on the exfiltration of crypto wallet information and account balances. The rule identifies communication to suspicious domains, unauthorized access to balance field names, and the masquerading of traffic to impersonate legitimate exchanges like Binance.
Detects the download of a JavaScript module named JSCeal, which contains code indicative of an HTTPS interception proxy. The rule looks for Node.js-based server creation code combined with cryptographic operations like keypair generation, certificate creation, and PEM conversion, excluding common legitimate JavaScript libraries and CDNs.
Detects repeated HTTP requests targeting the '/cgi-bin/' path on Dahua camera web interfaces with a specific user-agent string ('CGI Brute'). This behavior is characteristic of an automated brute-force campaign attempting to gain unauthorized access to camera web administration interfaces.
Detects network activity (HTTP, TLS SNI, and DNS) associated with the domain 'noht1ng.top', which is linked to the GRAYRABBIT malware utilized by the threat actor UNC3569.
Detects network activity (HTTP, TLS SNI, and DNS) associated with the domain 'noht1ng.top', which is linked to the GRAYRABBIT malware utilized by the threat actor UNC3569.
Detects HTTP traffic involving the retrieval of 7z.exe or 7zp.dll payloads from a known Alibaba Cloud staging server associated with the UNC3569 threat actor and the GRAYRABBIT malware. The rule uses a threshold-based detection to identify repeated download attempts from the external IP 8.218.50.207.
Detects HTTP traffic involving the retrieval of 7z.exe or 7zp.dll payloads from a known Alibaba Cloud staging server associated with the UNC3569 threat actor and the GRAYRABBIT malware. The rule uses a threshold-based detection to identify repeated download attempts from the external IP 8.218.50.207.
Detects HTTP traffic involving the retrieval of 7z.exe or 7zp.dll payloads from a known Alibaba Cloud staging server associated with the UNC3569 threat actor and the GRAYRABBIT malware. The rule uses a threshold-based detection to identify repeated download attempts from the external IP 8.218.50.207.
Detects attempts to exploit CVE-2023-2825, a path traversal vulnerability in GitLab. The rule monitors HTTP GET requests to the /uploads/ endpoint containing directory traversal sequences (e.g., ../ or encoded variants) in the URI, indicating an effort to access restricted files on the system.
Detects mass automated POST requests directed at the 'super_submit_form' action within the 'admin-ajax.php' endpoint of the Super Forms WordPress plugin, indicative of exploitation attempts or vulnerability scanning against CVE-2026-14894.
Detects a malicious HTTP POST request targeting the Elementor Pro WordPress plugin's 'elementor_pro_forms_send_form' action. The rule looks for a specific attempt to bypass file upload restrictions by manipulating the array index of form fields to upload a PHP file via the 'admin-ajax.php' endpoint.
This rule detects inbound HTTP requests directed at known file paths associated with malicious PHP web shells commonly dropped within the Elementor plugin directory of WordPress installations, including attempts to pass parameters to the web shell for command execution.
This rule detects network communication associated with the REVSTEALER 'EtherHiding' technique. It monitors for POST requests to Polygon network RPC endpoints containing specific contract interaction signatures ('eth_call' with '0x4965e13f' and a specific contract address), as well as TLS connections to known malicious domains and fallback RPC providers used to resolve C2 instructions from blockchain data.
This rule detects network communication associated with the REVSTEALER 'EtherHiding' technique. It monitors for POST requests to Polygon network RPC endpoints containing specific contract interaction signatures ('eth_call' with '0x4965e13f' and a specific contract address), as well as TLS connections to known malicious domains and fallback RPC providers used to resolve C2 instructions from blockchain data.
Detects network requests originating from the Netch gateway tool or similar environments, attempting to fetch auto-configuration profiles for Shadowsocks from the external domain 'www.sheng886.top' using the '/api/v1/internal/shadowsocks/auto-config' endpoint. The rule specifically matches the Go-http-client user agent, which is common in automated scripts and Go-based proxy tools.
This rule detects HTTP GET requests for static image assets (jpg, jpeg, png, gif, webp, svg) where the Referer header originates from a .shop top-level domain. This behavior may indicate an unauthorized use of brand image assets, often associated with fraudulent e-commerce sites or phishing campaigns using lookalike or disposable infrastructure.
This rule detects HTTP GET requests for static image assets (jpg, jpeg, png, gif, webp, svg) where the Referer header originates from a .shop top-level domain. This behavior may indicate an unauthorized use of brand image assets, often associated with fraudulent e-commerce sites or phishing campaigns using lookalike or disposable infrastructure.
This rule detects HTTP GET requests for static image assets (jpg, jpeg, png, gif, webp, svg) where the Referer header originates from a .shop top-level domain. This behavior may indicate an unauthorized use of brand image assets, often associated with fraudulent e-commerce sites or phishing campaigns using lookalike or disposable infrastructure.
Detects high-volume, potentially malicious activity where a client requests a large number of distinct hostnames ending in .shop from a single destination IP address within a short time frame, which may indicate infrastructure used for phishing or fraudulent e-commerce storefronts similar to DoppelCart-style activity.
Detects high-volume, potentially malicious activity where a client requests a large number of distinct hostnames ending in .shop from a single destination IP address within a short time frame, which may indicate infrastructure used for phishing or fraudulent e-commerce storefronts similar to DoppelCart-style activity.
Detects high-frequency, repeated access to a specific fraud-tracking or canary token link by sources utilizing rotating VPNs or proxies over an extended period. This behavior is indicative of automated probing or credential validation attempts associated with the Phantom Deal campaign.
Page 50 of 116