Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
Identifies NetScaler ADC or Gateway software versions in the inventory that are known to be vulnerable to CVE-2026-88771 and CVE-2026-88772, despite having received the patch for CVE-2026-19490.
Detects outbound HTTP GET requests to specific GitHub repository paths hosted on raw.githubusercontent.com, which are associated with the Kimsuky threat actor's 'Operation GitPower'. These paths indicate the retrieval of malicious payloads or scripts from adversary-controlled repositories.
Detects network activity associated with DPRK-affiliated threat actors, specifically connections to known hardcoded C2 IP addresses and DNS queries for malicious o-r.kr subdomains utilized for command and control.
Detects command-line activity attempting to disable, unbind, or remove NetScaler AppFW (Web Application Firewall) profiles, signatures, or security policies. This activity is indicative of defense evasion following the exploitation of CVE-2026-88771 or CVE-2026-88772 to suppress security alerting on follow-on malicious activity.
Detects anomalous web request patterns against Citrix NetScaler ADC or Gateway devices, characterized by excessively long URLs or request contexts combined with high-frequency parameter variation from a single source. This behavior is indicative of potential fuzzing or exploit attempts targeting web application vulnerabilities, specifically input validation flaws in edge infrastructure.
Detects high volumes of DTLS/UDP session-initiation traffic targeting NetScaler VPN virtual servers that are immediately followed by appliance-level error logs or crashes. This behavior is indicative of active probing or exploitation attempts, such as those associated with CVE-2026-88772, where malicious payloads cause service instability.
Detects outbound HTTP POST requests that contain a JPEG file signature ('FF D8 FF') in the body but lack a 'Content-Type' header. This pattern is indicative of potential C2 communication from a loader or malware family attempting to exfiltrate or receive data disguised as an image file while bypassing basic header-based inspection.
Detects network traffic associated with Wazza phishkit anti-bot gates, including beacon communications, TLS SNI patterns, fingerprint iframe URIs, and challenge-platform requests.
Detects network traffic (DNS, TLS SNI, and HTTP) associated with Wazza phishkit infrastructure, specifically looking for malicious domains like boegl-krysl.eu and coppietersrecherche.eu, as well as Cloudflare workers.dev domains used for beaconing and lures.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Detects HTTP responses and TLS client connections associated with Adobe-themed device code phishing lure pages hosted on workers.dev, utilizing specific patterns and keywords such as 'Confirm to open document', 'VERIFICATION CODE', and long hyphenated domain structures.
Detects a multi-stage Wazza phishkit communication chain over HTTP, involving initial configuration retrieval, token minting, token firing, and subsequent redirection with signed tokens.
This rule detects a high frequency of SMB (port 445) connection attempts from a single internal source host to a large number of distinct internal destination hosts within a short timespan. This activity is indicative of internal network scanning, host discovery, or automated lateral movement attempts using SMB.
Detects unauthorized attempts to access the Ray Dashboard Job Submission API, which is vulnerable to remote code execution (CVE-2023-48022). Attackers can leverage this API endpoint to execute arbitrary commands on the Ray cluster.
This rule detects HTTP POST requests targeting Adobe Commerce or Magento checkout, customer, or admin endpoints that contain suspicious syntax patterns indicative of Server-Side Template Injection (SSTI). These patterns ({{...}}, {%...%}, ${...}) are common in various template engines and, when injected into application inputs, can lead to Remote Code Execution (RCE) via CVE-2026-75650.
Detects attempts to exploit CVE-2026-83549 in SonicWall SMA1000 appliances, where an attacker sends a malicious HTTP request to the 'workplace' URI containing shell metacharacters such as ';', '|', '`', or '$(' to execute arbitrary OS commands.
This rule detects a potential heap overflow exploitation attempt against F5 BIG-IP Access Policy Manager (APM) by inspecting HTTP POST requests to the /oauth/token endpoint with an unusually large 'grant_type' field (exceeding 4096 bytes). This behavior is characteristic of an attempt to trigger the heap overflow vulnerability identified as CVE-2026-94127.
Detects unauthorized or external access attempts to the Ollama LLM API service (TCP port 11434). The rule specifically flags POST requests targeting the /api/generate or /api/chat endpoints, which are commonly exposed via misconfiguration or lack of authentication, potentially allowing remote command execution or model exploitation.
Broad triage/hunting rule to surface all requests to the j_security_check authentication endpoint on Cisco Catalyst SD-WAN Manager, in support of investigating CVE-2026-76504 (unauthenticated admin auth-bypass zero-day). Cisco advises reviewing serviceproxy-access.log and vmanage-server.log for requests to this endpoint from unknown or unauthorized source IPs. This rule matches ANY request to the endpoint and is NOT itself evidence of compromise -- every match requires manual review of source IP legitimacy against known/authorized administrative addresses.
Detects an exploitation attempt against PoeLLM or LiteLLM MCP test/connection endpoint using a python3 stdio payload that fetches data from port 81.
This rule monitors network traffic from CommonSecurityLog data to detect bidirectional communication between NetScaler appliances and known malicious infrastructure associated with the CVE-2026-88772 campaign, which is indicative of command-and-control activity.
Page 15 of 312