Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
This rule monitors network traffic for TLS SNI and HTTP URI indicators associated with known typo-squatted or spoofed Google Drive and Google Meet phishing domains. It also detects the download of a specific ZIP archive used as a phishing lure.
Detects DNS queries and TLS SNI traffic associated with known lookalike domains used by the threat actor TA419 for organization impersonation, which are commonly utilized in spearphishing campaigns.
This rule detects outbound network connections directed at a known IP address associated with Akira ransomware infrastructure. The rule specifically monitors for communication with 64.227.4.134, which has been identified as a C2 node utilizing GOST tunnels. This behavior is indicative of established C2 connectivity by Akira ransomware actors.
Detects a multi-stage compromise sequence involving anomalous authentication followed by VPN session establishment and a burst of outbound connections from Citrix ADC/Gateway appliances. Tightened to reduce false positives from legitimate admin access, routine VPN sessions, and authorized appliance telemetry/updates.
Detects TLS connections to a specific, potentially adversary-controlled ScreenConnect relay infrastructure endpoint. Adversaries frequently abuse legitimate remote access tools like ScreenConnect for command and control purposes.
Detects potential reconnaissance or port scanning activities against firewall or UTM management interfaces from external IP addresses. The rule identifies sources that trigger a high volume of blocked or denied attempts across multiple management ports (e.g., SSH, HTTP/S, GUI ports) within a one-hour window.
The following analytic identifies DNS queries from internal hosts to dynamic domain providers. It leverages DNS query logs from the `Network_Resolution` data model and cross-references them with a lookup file containing known dynamic DNS providers. This activity is significant because attackers often use dynamic DNS services to host malicious payloads or command-and-control servers, making it crucial for security teams to monitor. If confirmed malicious, this activity could allow attackers to bypass firewall blocks, evade detection, and maintain persistent access to the network.
Detects HTTP POST requests directed at Grav CMS endpoints where the __unique_form_id__ parameter contains directory traversal sequences (e.g., ../). This behavior is indicative of attempted exploitation of CVE-2026-42608, aimed at bypassing file system restrictions to write files to unauthorized locations outside the application's expected form data directory.
Detects outbound network connections from Citrix NetScaler appliances that exhibit high periodic regularity (beaconing behavior) towards rare external destinations. This pattern is indicative of potential command and control (C2) communication, possibly following the exploitation of vulnerabilities like CVE-2026-88771/88772.
Detects potential exploitation attempts targeting unpatched Citrix NetScaler ADC or Gateway devices, specifically looking for unauthenticated requests to management or sensitive endpoints that contain command execution indicators. This rule is designed to identify activity associated with vulnerabilities similar to CVE-2026-88771.
Detects incoming HTTP POST requests with unusually large payloads or malformed URI structures directed at Citrix NetScaler Gateway authentication endpoints, which are characteristic of exploitation attempts against CVE-2026-88771.
Detects core NetScaler service processes (nsppe, httpd, aslearning) initiating outbound network connections to external, non-private IP addresses. This behavior is indicative of post-exploitation C2 beaconing activity on a compromised NetScaler appliance.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Detects potential exploitation attempts targeting unpatched Citrix NetScaler ADC or Gateway devices, specifically looking for unauthenticated requests to management or sensitive endpoints that contain command execution indicators. This rule is designed to identify activity associated with vulnerabilities similar to CVE-2026-88771.
Detects anomalous HTTP GET requests to the Microsoft Teams trap-exp/tokens endpoint that do not carry the expected 'Teams' user-agent string. This pattern is indicative of the DragonForce backdoor attempting to illicitly request Skype authentication tokens.
This rule detects potential DNS tunneling or beaconing activity by monitoring DNS queries for patterns commonly associated with command and control traffic. It flags anomalous DNS behavior including excessively long query strings, usage of TXT or NULL record types, frequent NXDOMAIN responses, or high volumes of such queries from a single host, which are indicative of data exfiltration or C2 communication via the DNS protocol.
Detects repeated crashes or restarts of the Citrix NetScaler packet engine (nsppe) correlated with a concurrent spike in inbound DTLS traffic. This pattern is indicative of potential memory-overflow exploitation attempts (consistent with CVE-2026-88772) targeting the VPN virtual server functionality, leading to a Denial of Service (DoS) condition.
Detects TLS connections to a specific, potentially adversary-controlled ScreenConnect relay infrastructure endpoint. Adversaries frequently abuse legitimate remote access tools like ScreenConnect for command and control purposes.
Detects HTTP proxy traffic containing specific header or cookie patterns associated with the Evilginx2 or BigBear adversary-in-the-middle (AiTM) phishing frameworks. These frameworks use these artifacts to proxy connections and facilitate the theft of session tokens for MFA bypass.
Detects DNS queries and TLS SNI traffic associated with known lookalike domains used by the threat actor TA419 for organization impersonation, which are commonly utilized in spearphishing campaigns.
Detects outbound TCP traffic on port 443 destined for a hardcoded IP address associated with ValleyRAT C2 activity. The rule specifically monitors for established connections with a small payload size (5 bytes) that lack standard TLS handshake characteristics (no SNI), and applies a threshold to mitigate noise. This behavior is indicative of C2 heartbeats from malicious implants using DLL side-loading techniques.
Page 14 of 312