Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
This rule detects network traffic indicative of the PEEP Browser RAT, specifically HTTP beacons targeting the URI path '/api/commands'. It monitors for unique HTTP headers ('X-PEEP-Agent-Id', 'X-PEEP-Agent-Key') and connections to known malicious infrastructure.
Detects Server-Side Request Forgery (SSRF) attempts against Grafana instances using the 'X-Grafana-URL' header. The rule identifies requests attempting to access internal network ranges, link-local addresses, or cloud metadata endpoints (e.g., 169.254.169.254, localhost) via the Grafana MCP interface, particularly when non-GET HTTP methods are used to potentially mutate internal resources.
Detects unauthenticated attempts to invoke Grafana API tools via the Model Context Protocol (MCP) by utilizing spoofed Mcp-Session-Id headers while bypassing bearer token authentication requirements. This primarily targets unauthorized access to API functionality on Grafana instances configured with bearer-token authentication (v1.1.0+).
Detects anomalous use of the 'X-Grafana-URL' header in conjunction with an 'Authorization: Bearer' token, indicative of an attempt to exfiltrate a service account token to an unauthorized or external domain, exploiting CVE-2026-15583.
Detects HTTP 301 redirection responses from a hardcoded IP address to an external domain associated with ProRAM command-and-control infrastructure.
This rule detects attempted exploitation of Adobe Commerce (Magento) via GraphQL, specifically targeting Template Property Poisoning through malicious 'styles' array injection as observed in the StyleSmuggler campaign (CVE-2025-54236).
Detects suspicious GET requests to the Magento '/customer/section/load/' endpoint with specific parameters ('sections=customer' and 'force_new_section_timestamp=true'). These requests are indicative of reconnaissance activity related to the StyleSmuggler campaign, potentially associated with exploitation of Magento vulnerabilities such as CVE-2025-54236.
Detects malicious traffic directed towards unpkg.com associated with the 'Beamglea' campaign. The rule specifically monitors for connections to known malicious npm-mirrored packages or pages serving fake Cloudflare CAPTCHA challenges, which are common tactics for credential theft and browser-based exploitation.
Detects network activity related to the Beamglea/ClickFix framework using api.keyval.org as a dead-drop resolver. The rule monitors for DNS resolutions, TLS SNI requests, and HTTP GET/PUT requests to the identified C2 infrastructure, which is used for retrieving and storing obfuscated redirect values.
Detects outbound HTTP traffic originating from a WordPress host containing specific signatures associated with the Mushr00w Uploader webshell, indicating command-and-control communication or data exfiltration.
Detects HTTP GET requests for executable or installer files (e.g., .exe, .msi) containing 'tradingview' in the URI, originating from suspicious external domains that are not associated with legitimate software providers such as TradingView, GitHub, SourceForge, Apple, Google, or Microsoft. This activity is indicative of JSCeal malvertising campaigns targeting users with fraudulent installers.
Detects HTTP GET requests for executable or installer files (e.g., .exe, .msi) containing 'tradingview' in the URI, originating from suspicious external domains that are not associated with legitimate software providers such as TradingView, GitHub, SourceForge, Apple, Google, or Microsoft. This activity is indicative of JSCeal malvertising campaigns targeting users with fraudulent installers.
Detects the download of a JavaScript module named JSCeal, which contains code indicative of an HTTPS interception proxy. The rule looks for Node.js-based server creation code combined with cryptographic operations like keypair generation, certificate creation, and PEM conversion, excluding common legitimate JavaScript libraries and CDNs.
Detects outbound network traffic from a potential backdoor known as 'Toy Ghouls' (bird-agent) to the ip-api.com service, likely used for geolocation-based reconnaissance or target validation.
This rule detects high-volume, potentially automated POST requests to specific WordPress plugin endpoints (Super Forms and Elementor Pro) used for form submissions and file uploads. A high frequency of these requests from a single source within a short timeframe suggests active reconnaissance or exploitation attempts against these vulnerable components.
Detects Server-Side Request Forgery (SSRF) attempts originating from the Grafana MCP (Model Context Protocol) process. The rule specifically monitors for instances where the 'grafana_api_request' tool is used in conjunction with a 'X-Grafana-URL' header targeting cloud metadata IP ranges (169.254.0.0/16), or where the host attempts to resolve GCP metadata domains ('metadata.google.internal'). This behavior is indicative of an attacker attempting to access cloud provider instance metadata to exfiltrate security credentials.
Detects anomalous use of the 'X-Grafana-URL' header in conjunction with an 'Authorization: Bearer' token, indicative of an attempt to exfiltrate a service account token to an unauthorized or external domain, exploiting CVE-2026-15583.
Detects HTTP 301 redirection responses from a hardcoded IP address to an external domain associated with ProRAM command-and-control infrastructure.
Detects evidence of malicious file tampering on public CDNs (bootcdn.net, bootcss.com, staticfile.org) associated with the Funnull campaign. The rules identify specific malicious file hashes and anomalous oversized file sizes that indicate the presence of injected malicious loaders within common JavaScript libraries.
Detects evidence of malicious file tampering on public CDNs (bootcdn.net, bootcss.com, staticfile.org) associated with the Funnull campaign. The rules identify specific malicious file hashes and anomalous oversized file sizes that indicate the presence of injected malicious loaders within common JavaScript libraries.
This rule detects an unauthenticated exploitation attempt against Magento GraphQL endpoints, specifically targeting the 'styles' parameter. The attack pattern involves sending a malformed request to the /graphql endpoint with an 'X-TRACE-' header, which is indicative of the StyleSmuggler vulnerability exploit.
Page 51 of 116