Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,683
9,759
6,695
4,421
3,750
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects DNS queries and TLS SNI traffic directed at known actor-controlled domains and subdomains associated with ScreenConnect remote management software usage in malicious RMM chains.
Detects DNS queries and TLS SNI traffic directed at known actor-controlled domains and subdomains associated with ScreenConnect remote management software usage in malicious RMM chains.
Detects network activity associated with the AMOS (Atomic macOS Stealer) malware, specifically identifying outbound HTTP POST requests to the '/api/t' URI path occurring on non-standard ports. The detection utilizes a threshold-based trigger to identify potential C2 communication heartbeats.
This rule detects network traffic patterns indicative of the Lumma Stealer 'ClickFix' phishing campaign. It identifies outbound requests to suspicious domains ending in .cyou utilizing specific user agents (WinHttp or Microsoft BITS), which are characteristic of malicious PowerShell scripts attempting to retrieve secondary payloads.
This rule detects HTTP POST requests to .php files containing suspicious PHP execution functions in the request body, such as 'system', 'eval', or 'shell_exec'. These patterns are indicative of an attempt to execute commands via an in-memory or injected PHP web shell on an F5 BIG-IP APM device.
Detects post-exploitation activity against Citrix NetScaler appliances associated with CVE-2026-8452. The rule specifically monitors for HTTP GET requests targeting PHP files within the /var/vpn/theme/ directory, accompanied by efforts to execute shell commands (bin/sh) via the web server.
Detects high-frequency DNS NXDOMAIN responses for domains exhibiting patterns indicative of Domain Generation Algorithms (DGA), specifically fixed-length, high-entropy character strings. This behavior is commonly associated with botnets attempting to locate command and control infrastructure.
Detects HTTP POST requests directed at common Machine Learning inference endpoints (e.g., /predict, /classify, /infer) where the request body claims to be a multipart form-data image upload (Content-Type: image/jpeg) but the actual binary data does not contain the standard JPEG file signature (FF D8 FF). This pattern is indicative of adversarial attempts to bypass security controls or provide malformed payloads to ML models.
Detects DNS queries attempting to resolve domains associated with malicious LLM-as-a-service platforms, specifically targeting domains containing 'wormgpt', 'fraudgpt', or 'evilgpt'. These platforms are often used by adversaries to facilitate automated social engineering, malware development, or other malicious activities.
Detects unauthenticated GET requests to known AI and machine learning infrastructure management endpoints (e.g., DCGM, Ray, Kubeflow) that are commonly exposed without authentication. These interfaces provide operational metrics, cluster status, or job management details, which can be leveraged for reconnaissance.
Detects outbound HTTP traffic to punycode-encoded domains (typically used to spoof legitimate sites) that contain characteristic boilerplate text often generated by LLMs in their responses. This combination is indicative of an automated phishing kit setup or a landing page generated by an AI assistant.
Detects unauthorized GET requests to common default paths associated with AI agent developer consoles and infrastructure, such as '/playground', '/api/predict', or '/_stcore'. These requests are identified by the absence of expected 'Authorization' or 'Cookie' headers, suggesting an unauthenticated probe or discovery attempt by an external actor looking for misconfigured or exposed AI development interfaces.
Detects attempts to exploit CVE-2026-48710 in Starlette frameworks where an attacker attempts to smuggle path or authority information via the HTTP Host header using character encoding variations like slashes or URL-encoded sequences.
Detects unauthenticated attempts to access Adobe Commerce/Magento REST API endpoints. This rule specifically looks for HTTP GET requests containing /rest/ and /V1/ paths without an Authorization header, which may indicate an attempt to exploit CVE-2026-71362.
This rule detects attempts to exploit a SQL injection vulnerability in Sangoma Switchvox (CVE-2026-9586) by inspecting HTTP POST request bodies and URIs for common SQL injection patterns such as UNION SELECT, SLEEP(), and DROP TABLE. This vulnerability allows an attacker to execute arbitrary SQL commands on the backend database.
This rule detects HTTP POST requests to the Apache Qpid Broker-J Management API that include a pre-set JSESSIONID in the cookie header during a login operation, indicating an attempt to exploit CVE-2026-92609 via session fixation.
Detects anomalous LDAP bind requests containing specific byte sequences characteristic of a potential authentication bypass exploit identified as CVE-2026-83059. The rule monitors LDAP traffic on standard ports for malformed bind operations that attempt to subvert authentication controls.
Detects suspicious LDAP modify or add operations targeting privileged DNs (orcladmin, OracleContext) on Oracle Internet Directory, indicative of exploitation attempts related to CVE-2026-83057.
Detects attempts to access administrative or configuration endpoints on Cisco Identity Services Engine (ISE) without providing valid authentication headers, cookies, or authorization tokens. This behavior is indicative of exploitation attempts targeting CVE-2026-20192 to gain unauthorized administrative access.
Detects high-volume RDP X.224 connection requests originating from a single source within a short timeframe, which is a strong indicator of a brute force or password spraying attack targeting Remote Desktop Protocol services.
Detects incoming HTTP POST requests that match the signature of the China Chopper web shell client, specifically looking for common evaluative functions (eval, assert, base64_decode) being passed to single-letter parameters, which is a hallmark of this specific web shell's communication pattern.
Page 19 of 124