Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
Detects an abnormally high volume of configuration changes (15 or more within a 10-minute window) occurring on network appliances such as firewalls or security gateways, originated by a single source user or IP address. This behavior may indicate unauthorized administrative activity, mass policy updates, or malicious tampering.
Detects high-volume POST requests or traffic flagged by DLP mechanisms destined for known public generative AI platforms (e.g., OpenAI, Claude, Google Gemini). This rule identifies potential unauthorized transmission of sensitive or regulated data, such as PII or confidential information, to third-party AI services.
This rule detects an exploitation attempt targeting the ConnectWise ScreenConnect Path Traversal vulnerability (CVE-2024-1708). The detection monitors incoming HTTP traffic for attempts to traverse the file system by inspecting the URI for repeated '..' sequences within the '/App_Extensions/' directory, a hallmark of this vulnerability.
Detects incoming HTTP POST requests to the 'diffpatch' endpoint in Gitea that contain suspicious 'diff --git' patterns combined with path traversal sequences ('../') targeting 'hooks/' directories. This indicates an attempt to exploit CVE-2026-60004 to achieve unauthorized file system access or remote code execution via repository hooks.
This rule detects HTTP GET requests to known malicious domains or URI patterns associated with fake video-conferencing lures. These lures redirect users to download RMM (Remote Monitoring and Management) MSI installers, often masquerading as legitimate software like Adobe Reader or video conferencing tools, as part of a social engineering campaign for initial access.
Detects HTTP POST requests to Telegram Bot API and Discord webhooks containing large, Base64-encoded strings within request bodies, which may indicate exfiltration of reconnaissance data or sensitive information.
Detects HTTP POST requests directed at common Large Language Model (LLM) chat completion and completion endpoints that are not associated with authorized OpenAI or Azure OpenAI services. This behavior may indicate an attempt to exfiltrate potentially sensitive corporate or proprietary data to third-party or unauthorized Shadow-AI platforms.
Detects incoming HTTP POST requests to internal AI/LLM API endpoints containing common prompt injection strings, such as instructions to ignore previous system prompts or attempts to trigger jailbreak modes like 'DAN'.
Detects attempts to exploit a vulnerability (CVE-2026-68536) in the Apache MyFaces JSF resource handler. The rule monitors for malicious URI parameters ('ln' or 'library') that attempt Server-Side Request Forgery (SSRF) targeting cloud metadata services, path traversal, or URI-based injection attacks.
This rule detects attempts to exploit CVE-2026-93647, a Stored Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic Webclient. The exploit involves injecting malicious script tags or JavaScript event handlers into calendar fields such as SUMMARY, DESCRIPTION, or LOCATION. The detection monitors inbound TCP traffic on web ports used by the application, specifically looking for common XSS injection patterns within calendar-related fields.
Detects potential SQL injection attempts targeting Cisco AsyncOS Email Gateways via the SMTP DATA command. The rule monitors for malicious patterns, specifically those attempting to execute unauthorized commands or database queries (such as COPY TO PROGRAM or embedded SQL statements) within SMTP traffic.
Detects attempts to exploit an unauthenticated OS command injection vulnerability in Cisco ISE (CVE-2026-20130). The rule monitors inbound HTTP traffic for shell metacharacters and common command-line binaries in the URI or request body, indicating an attempt to execute arbitrary commands on the underlying host.
Detects network traffic patterns characteristic of the EternalBlue (MS17-010) exploit targeting the SMBv1 protocol. Specifically, it monitors for a malformed SESSION_SETUP request containing an unusually large payload, which is indicative of an attempt to trigger a buffer overflow in the SMB service.
Detects network requests to the domain 'cloud-ack.workers.dev', which is known to be used as a redirector for hosting Microsoft authentication lookalike pages to conduct phishing attacks.
Detects network traffic to the Telegram Bot API where the request URI contains indicators of sensitive data exfiltration such as 'cookie', 'session', 'password', or 'credential'. This pattern is often associated with adversary-in-the-middle (AiTM) phishing kits (e.g., Evilginx2) exfiltrating stolen session tokens or credentials to an attacker-controlled Telegram bot.
This rule detects high-frequency API endpoint access originating from a single source IP address within a one-minute window, where the User-Agent does not match common browser strings. This behavior is indicative of automated scanning, scraping, or brute-force enumeration of API resources by non-browser clients.
Detects unauthenticated network requests targeting MLflow Model Registry and Ajax API endpoints on port 5000. These requests are characteristic of unauthorized reconnaissance against exposed machine learning management services.
Detects unauthorized attempts to access exposed Chroma or Weaviate vector database APIs via standard HTTP requests (GET/POST) targeting known API endpoints for collections or objects. This may indicate an adversary conducting reconnaissance on publicly accessible database infrastructure.
Detects a high volume of HTTP POST requests to common login endpoints (e.g., /login or /wp-login.php) from a single source IP address within a short time frame, which is indicative of a credential stuffing or automated brute-force attack.
This rule detects potential command and control (C2) beaconing activity by monitoring for high-frequency POST requests to OpenAI and Google Generative Language chat completion API endpoints. The rule triggers when a source host makes 5 or more requests within a 60-second window, which may indicate automated polling for commands or exfiltrated data transfer using legitimate LLM infrastructure.
Detects a potential automated exploit sweep or brute-force attempt, identified by a high frequency of HTTP requests (GET or POST) directed to the same URI from a single source IP address within a short time frame.
Page 22 of 312