Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
Detects network activity associated with the APT36 threat group, specifically HTTP requests for PowerShell stagers (irm/iex) from 'indiatodays.org' and TLS connections to that same domain, which is identified as a typosquat used for command and control or ingress tool transfer.
Detects incoming HTTP GET requests containing a specific URI path '/favorite_list_2x_m500_ico.jpg' associated with the Ted Backdoor, commonly used by North Korean state-sponsored threat actors including APT37, Lazarus Group, and Kimsuky for Command and Control (C2) beaconing.
Detects HTTP GET requests to raw.githubusercontent.com that include an 'Authorization: token' header, indicating the potential use of a GitHub Personal Access Token (PAT) for command and control or data exfiltration by the Kimsuky threat group.
Detects outbound HTTP GET requests to Pastebin.com with a path starting with /raw/. This pattern is commonly used by threat actors, including the Kimsuky APT group, to retrieve secondary payloads, configuration files, or malicious scripts from a public repository.
Detects anomalous HTTP GET requests to the Microsoft Teams trap-exp/tokens endpoint that do not carry the expected 'Teams' user-agent string. This pattern is indicative of the DragonForce backdoor attempting to illicitly request Skype authentication tokens.
Detects anomalous HTTP GET requests to the Microsoft Teams trap-exp/tokens endpoint that do not carry the expected 'Teams' user-agent string. This pattern is indicative of the DragonForce backdoor attempting to illicitly request Skype authentication tokens.
Detects anomalous HTTP GET requests to the Microsoft Teams trap-exp/tokens endpoint that do not carry the expected 'Teams' user-agent string. This pattern is indicative of the DragonForce backdoor attempting to illicitly request Skype authentication tokens.
Detects specific markers in UDP traffic on ports 3478, 5349, and 443 that are associated with the DragonForce malware's TRN1 C2 beaconing protocol. The rules identify session initiation, task polling, task acknowledgment, and result uploading behaviors.
Detects specific markers in UDP traffic on ports 3478, 5349, and 443 that are associated with the DragonForce malware's TRN1 C2 beaconing protocol. The rules identify session initiation, task polling, task acknowledgment, and result uploading behaviors.
Detects network activity associated with the DragonForce backdoor, specifically the use of MQTT for command and control. The rules monitor for unique 16-character client IDs used during registration on non-standard ports, subsequent command retrieval structures containing 'cmdnum', and DNS queries for the hardcoded broker 'broker.emqx.io'.
Detects network activity associated with the DragonForce backdoor, specifically the use of MQTT for command and control. The rules monitor for unique 16-character client IDs used during registration on non-standard ports, subsequent command retrieval structures containing 'cmdnum', and DNS queries for the hardcoded broker 'broker.emqx.io'.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects the creation or modification of scheduled tasks (crontab entries) initiated by processes commonly associated with Citrix NetScaler ADC/Gateway appliances (nsppe, httpd, nscollect). This behavior is often indicative of persistence mechanisms used by attackers following an initial exploit on an edge network device.
Detects DNS queries originating from NetScaler appliances that exhibit algorithmically generated domain (DGA) characteristics or utilize top-level domains (TLDs) frequently associated with malicious command and control infrastructure. This rule aims to identify potential post-exploitation C2 communication following a compromise of a NetScaler ADC or Gateway appliance.
This rule detects potential anti-forensic activity on Citrix ADC/NetScaler devices by monitoring for two primary indicators of log tampering: an unexpected drop in syslog volume to zero following a period of activity, or the execution of explicit commands intended to clear audit logs and configuration files.
Detects a sequence of potentially malicious activity targeting LLM-related API endpoints. The rule identifies a client IP performing rapid, distinct endpoint discovery, followed by a POST request to sensitive paths, and concluding with a spike in 5xx server-side errors, indicating potential exploitation attempts or fuzzing against Large Language Model interfaces.
This rule detects potentially compromised accounts by correlating risky Entra ID sign-ins to Citrix NetScaler with subsequent VPN session establishment followed by rapid, high-volume outbound connection activity from the source IP address. This pattern is indicative of a threat actor using compromised credentials to gain access via VPN and immediately perform internal network scanning or data staging.
Detects outbound HTTP POST requests destined for 'aware-cr1.com' targeting the URI '/api/beacon', which is indicative of command-and-control (C2) communication associated with the 2CLoader malware.
This rule detects HTTP GET requests to a specific IP address (62.60.226.185) attempting to download a file named 't0907.exe'. This pattern is associated with the delivery phase of the 2CLoader malware.
Detects potential exploitation attempts targeting CVE-2026-16232 in Check Point SmartConsole. The rule identifies specific authentication error messages indicating that a username length validation vulnerability is being triggered by a remote attacker attempting to bypass authentication.
Page 21 of 312