Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,431 detections
Filters
Last updated
All Time
Detection languages
2,428
3
Contributors
747
554
405
315
183
Categories
1,914
1,291
689
671
449
Platforms
2,202
183
149
62
49
Products / Services
2,366
1,378
38
37
25
MITRE Techniques
537
454
342
308
301
CVEs
17
10
9
9
9
IDS Classtypes
1,098
452
204
154
102
IDS Protocols
2,431
868
408
324
97
Detects high-frequency POST requests to API endpoints, potentially indicative of automated fuzzing or brute-force parameter mutation attacks, by identifying 50 requests from a single source within a 10-second window.
Detects unauthenticated HTTP requests directed at management or schema APIs for common vector databases (Milvus, Weaviate, Qdrant). These requests lack the required Authorization header, potentially indicating unauthorized reconnaissance or attempts to exploit public-facing database management interfaces.
This rule detects attempts to exploit a command injection vulnerability (CVE-2026-49869) in the Kestra workflow automation platform. The rule monitors HTTP POST requests to the '/api/v1/flows' endpoint, identifying payloads that define flow types involving shell or execution plugins and contain suspicious command sequences (e.g., shell operators combined with common system utilities like nc, bash, or curl).
Detects an exploitation attempt against a known SQL injection vulnerability (CVE-2026-62262) in the Piwigo photo gallery application, specifically targeting the 'pwg.images.filteredSearch.create' method via the 'ratings' parameter. The detection monitors inbound HTTP traffic for common SQL injection patterns like UNION SELECT, SLEEP commands, and boolean-based injection payloads.
Detects network traffic patterns associated with a specific Cobalt Strike Malleable C2 profile (jquery-cookie), characterized by GET requests to URIs starting with /jquery- with a specific Cookie header structure and the absence of an Accept header.
Detects HTTP POST requests with 'photo' in the URI and Gzip-compressed body content, which is a known C2 communication pattern used by the IcedID banking trojan.
Detects HTTP traffic patterns associated with the default staging URIs of the PowerShell Empire C2 framework. This rule identifies inbound requests to specific .php files (admin/get, news, login/process) with a 'session=' cookie, which are characteristic of Empire agent beaconing behavior.
Detects network activity associated with the Psychedelic Stealer malware, including C2 check-ins, API-based tasking, and communication with known C2 infrastructure using specific URI patterns and headers like 'X-API-Key'.
Detects HTTP traffic originating from internal hosts to external destinations on port 8989, specifically targeting '/chat/completions' URI patterns. This activity is indicative of the CARBONATO/Hermes Agent leveraging LLM gateway infrastructure as a command-and-control (C2) channel.
Detects HTTP traffic associated with the NeedyMantis malware, specifically identifying initial beacons to a known C2 domain using a specific User-Agent, followed by command-and-control response headers that suggest the exfiltration of reconnaissance data via the Set-Cookie field.
Detects network patterns associated with NeedyMantis-style command-and-control (C2) activity. This includes specific HTTP GET requests with hardcoded User-Agent strings, cookie-based binary data transfer in server responses, and WebSocket communication attempting to establish binary protocol channels.
Detects outbound network requests to known infrastructure associated with the ClickFix Traffic Direction System (TDS), specifically targeting domains 'fsputnik.com' and 'uasputnik.com'. The rules monitor for requests to specific lure pages, tracker files, and established IP connections used by this malicious campaign to deliver fraudulent prompts or lures to victims.
Detects anomalous outbound HTTP/TLS requests to rutracker.org that contain a GUID-like identifier in the URI or deviate from normal user traffic patterns, which is characteristic of the 'VPN-for-X' browser extension acting as a command-and-control beacon.
This rule detects outgoing HTTP POST requests to the '/api/credentials' endpoint, which is characteristic of the AMOS (Atomic macOS Stealer) malware family communicating with its command-and-control server to exfiltrate stolen sensitive information.
Detects HTTP beaconing patterns and TLS SNI traffic associated with the Sauron Loader malware. The rules identify specific URI structures (including versioned resources and various configuration/profile endpoints), specific URL parameters used for session management, and characteristic User-Agent strings. Additionally, it monitors for connections to known command-and-control infrastructure via TLS SNI filtering.
Detects inbound command-and-control traffic to the MOVEit Transfer application targeting the LEMURLOOT web shell, and subsequent detection of gzip-compressed database exfiltration.
Detects high-volume account enumeration activity associated with the TeamFiltration tool, characterized by the use of legacy Microsoft Teams desktop client User-Agent strings (specific versions of Teams, Electron, and Chrome) within a short time window.
Detects NeedyMantis' initial C2 beacon: an HTTP GET to /library/zip/ on port 443, anchored to the URI root, carrying a client-originated 'Set-Cookie:' header (clients normally send 'Cookie:', never 'Set-Cookie:' -- this direction reversal is the core anomaly and is near-impossible for legitimate traffic) alongside an explicit 'Upgrade: websocket' header. Matching the literal header text (not just header-name presence) and anchoring the URI removes generic WebSocket apps and any unrelated path containing '/library/zip/' as a substring.
Detects HTTP response bodies containing indicators of 'ClickFix' social engineering lures. The rule monitors for JavaScript code designed to manipulate the user's clipboard (execCommand('copy') or clipboard.writeText) in conjunction with instructions for the user to execute the Windows Run dialog (Win+R), a common technique to trick users into executing malicious commands under the guise of solving a fake CAPTCHA or error.
This rule detects a multi-stage phishing redirection chain where a user visits a known survey platform (t.maze.co) followed immediately by a request to a Cloudflare Workers landing page (.workers.dev), a common pattern used by adversaries to obfuscate malicious delivery endpoints.
Detects unauthenticated POST requests to the TorchServe Management API '/models' endpoint containing a 'url=' parameter. This pattern is indicative of an attempt to perform remote model registration, which could be leveraged for Remote Code Execution (RCE) on the server hosting the TorchServe service.
Page 9 of 116