Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
868 detections
Filters
Last updated
All Time
Detection languages
863
4
1
Contributors
411
156
140
93
29
Categories
401
373
235
168
150
Platforms
773
171
98
28
24
Products / Services
846
413
94
47
26
MITRE Techniques
136
123
110
98
83
CVEs
9
5
5
4
4
IDS Classtypes
362
189
90
64
55
IDS Protocols
2,431
868
408
324
97
Detects the handshake process for Blackwood/Chisel reverse SOCKS5 or TCP-over-HTTP tunneling to a known malicious Iranian-hosted C2 IP address. The detection matches specific HTTP headers used by the Chisel tool during its initialization phase.
Detects a network connection handshake indicating the use of Chisel, a fast TCP/UDP tunnel over HTTP, specifically identifying potential command-and-control beaconing activity.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Detects attempts to exploit Oracle WebLogic Server vulnerabilities, specifically those leveraging the T3 protocol to transmit malicious Java serialized payloads, as seen in CVE-2026-70756. The rule identifies suspicious T3 handshake patterns and the presence of common Java deserialization gadget chains.
This rule detects attempts to exploit CVE-2026-93647, a Stored Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic Webclient. The exploit involves injecting malicious script tags or JavaScript event handlers into calendar fields such as SUMMARY, DESCRIPTION, or LOCATION. The detection monitors inbound TCP traffic on web ports used by the application, specifically looking for common XSS injection patterns within calendar-related fields.
Detects potential SQL injection attempts targeting Cisco AsyncOS Email Gateways via the SMTP DATA command. The rule monitors for malicious patterns, specifically those attempting to execute unauthorized commands or database queries (such as COPY TO PROGRAM or embedded SQL statements) within SMTP traffic.
Detects network traffic patterns characteristic of the EternalBlue (MS17-010) exploit targeting the SMBv1 protocol. Specifically, it monitors for a malformed SESSION_SETUP request containing an unusually large payload, which is indicative of an attempt to trigger a buffer overflow in the SMB service.
This rule detects outbound network traffic originating from internal assets attempting to establish an SSH connection to a known malicious C2 infrastructure (190.211.124.187). This behavior is indicative of the CARBONATO malware utilizing a reverse SSH tunnel for command-and-control communication.
Detects high-frequency TCP connection attempts to WinRM (port 5985) originating from a single source host within the internal network. This pattern of behavior is often indicative of an adversary attempting to scan for or move laterally to multiple systems using WinRM.
Detects the specific TCP handshake pattern characteristic of the Fast Reverse Proxy (FRP) client (frpc) initiating a connection to a command-and-control server. The rule inspects established traffic for specific metadata strings ('privilege_key', 'run_id', 'pool_count') within the initial handshake payload.
Detects high-volume SSH authentication failures from a single source IP address within a short time frame, which is indicative of credential spraying or brute force activity.
Detects a high frequency of SSH connection attempts originating from a single source address within a short timeframe, specifically targeting the initial SSH handshake string. This is indicative of automated brute force or credential stuffing activity against SSH services.
Detects a single source IP address attempting to connect to multiple hosts over TCP port 3389 (RDP) within a short timeframe (10 attempts in 60 seconds). This behavior is indicative of a host scanning the network for accessible RDP services, a common precursor to lateral movement or brute force attacks.
Detects network activity associated with SectopRAT malware. The rule identifies C2 beaconing behavior on a non-standard port using a custom protocol with a specific 5-byte length header and 16-byte initialization vector, filtering out standard HTTP/TLS traffic.
Detects network activity (TCP, DNS, TLS, HTTP) associated with the UNC6240 threat actor's infrastructure, specifically targeting communications with known malicious IP addresses and domains used in a campaign leveraging PeopleSoft-related lures.
Detects established, bidirectional TCP connections between internal hosts and known infrastructure associated with the SIDEEYE backdoor on specific control and data ports (3333 and 3334).
Detects anomalous network traffic patterns characteristic of the PetitPotam exploit, specifically targeting the MS-EFSRPC interface on Windows SMB pipes. This behavior is used to force a remote system to initiate authentication to a specified target, facilitating NTLM relay attacks.
This rule detects a potential SYN flood denial-of-service attack, characterized by a high volume of TCP SYN packets directed at a target within a short timeframe. Such activity is indicative of attempts to exhaust server resources by leaving TCP handshakes incomplete.
Detects anomalous LDAP bind requests containing specific byte sequences characteristic of a potential authentication bypass exploit identified as CVE-2026-83059. The rule monitors LDAP traffic on standard ports for malformed bind operations that attempt to subvert authentication controls.
Detects suspicious LDAP modify or add operations targeting privileged DNs (orcladmin, OracleContext) on Oracle Internet Directory, indicative of exploitation attempts related to CVE-2026-83057.
Detects high-volume RDP X.224 connection requests originating from a single source within a short timeframe, which is a strong indicator of a brute force or password spraying attack targeting Remote Desktop Protocol services.
Page 2 of 42