Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,537 detections
Filters
Last updated
All Time
Detection languages
3,970
998
598
428
233
Contributors
1,363
1,250
1,066
954
384
Categories
2,933
2,196
2,017
1,857
1,411
Platforms
39,936
7,266
6,537
3,866
3,647
Products / Services
4,107
2,418
1,587
270
254
MITRE Techniques
1,450
1,310
1,022
934
696
CVEs
46
46
33
18
12
IDS Classtypes
1,753
458
404
325
220
IDS Protocols
2,202
773
381
300
93
Detects inbound HTTP POST requests directed at common paths associated with self-hosted OpenAI-compatible LLM inference APIs, such as LocalAI or vLLM. This rule identifies potentially unauthorized or unintended public exposure of internal LLM infrastructure, which could lead to unauthorized model usage, information disclosure, or exploitation of the inference engine.
The following analytic detects file downloads involving executable, archive, or scripting-related file types that are commonly used in malware delivery.
These file types include formats like PE executables, shell scripts, autorun files, installers, and known testing samples such as EICAR.
This detection leverages Cisco Secure Firewall Threat Defense logs and enriches the results using a filetype lookup to provide context.
If confirmed malicious, these downloads could indicate the initial infection vector, malware staging, or scripting abuse.
These file types include formats like PE executables, shell scripts, autorun files, installers, and known testing samples such as EICAR.
This detection leverages Cisco Secure Firewall Threat Defense logs and enriches the results using a filetype lookup to provide context.
If confirmed malicious, these downloads could indicate the initial infection vector, malware staging, or scripting abuse.
This analytic detects intrusion events from known threat activity using Cisco Secure Firewall Intrusion Events.
It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where one or multiple Snort signatures
associated with a known threat or threat actor activity have been triggered within a one-hour time window. The detection uses a
lookup table (cisco_snort_ids_to_threat_mapping) to map Snort signature IDs to known threat actors and their techniques.
When multiple signatures associated with the same threat actor are triggered within the time window, and the count of
unique signatures matches or exceeds the expected number of signatures for that threat technique, an alert is generated.
This helps identify potential coordinated threat activity in your network environment by correlating related intrusion
events that occur in close temporal proximity.
Currently, this detection will alert on the following threat actors or malware families as defined in the cisco_snort_ids_to_threat_mapping lookup:
* AgentTesla
* Amadey
* ArcaneDoor
* AsyncRAT
* CastleRAT
* Chafer
* DCRAT
* LokiBot
* Lumma Stealer
* Nobelium
* Quasar
* Remcos
* Snake
* Static Tundra
* Xworm
To add or update threat actors, update the cisco_snort_ids_to_threat_mapping.csv lookup file with new or modified threat names and associated Snort signature IDs.
It leverages Cisco Secure Firewall Threat Defense IntrusionEvent logs to identify cases where one or multiple Snort signatures
associated with a known threat or threat actor activity have been triggered within a one-hour time window. The detection uses a
lookup table (cisco_snort_ids_to_threat_mapping) to map Snort signature IDs to known threat actors and their techniques.
When multiple signatures associated with the same threat actor are triggered within the time window, and the count of
unique signatures matches or exceeds the expected number of signatures for that threat technique, an alert is generated.
This helps identify potential coordinated threat activity in your network environment by correlating related intrusion
events that occur in close temporal proximity.
Currently, this detection will alert on the following threat actors or malware families as defined in the cisco_snort_ids_to_threat_mapping lookup:
* AgentTesla
* Amadey
* ArcaneDoor
* AsyncRAT
* CastleRAT
* Chafer
* DCRAT
* LokiBot
* Lumma Stealer
* Nobelium
* Quasar
* Remcos
* Snake
* Static Tundra
* Xworm
To add or update threat actors, update the cisco_snort_ids_to_threat_mapping.csv lookup file with new or modified threat names and associated Snort signature IDs.
This Splunk query analyzes web logs to identify and categorize user agents, detecting various types of unwanted applications. This activity can signify possible compromised hosts on the network.
Detects outbound network traffic from internal hosts to the domain 'skyleen.fr' over TLS/HTTPS, which is characteristic of credential exfiltration associated with the Sckit supply chain worm.
This rule detects HTTP GET requests initiated by the Windows PowerShell User-Agent where the destination host is a decimal-encoded IP address. This pattern is commonly associated with ClickFix-style social engineering attacks, where users are tricked into executing obfuscated PowerShell commands to download malicious payloads.
Detects network traffic associated with the ClickFix Traffic Distribution System (TDS), specifically targeting requests to known malicious domains like fsputnik.com and uasputnik.com, as well as associated fake Cloudflare verification lure pages.
Detects network traffic directed towards known public DNS over HTTPS (DoH) resolvers, such as Cloudflare, Google, and Quad9. Adversaries often abuse DoH to tunnel Command and Control (C2) communication, effectively blending in with legitimate web traffic to evade traditional DNS monitoring.
This rule detects outbound network traffic originating from internal assets attempting to establish an SSH connection to a known malicious C2 infrastructure (190.211.124.187). This behavior is indicative of the CARBONATO malware utilizing a reverse SSH tunnel for command-and-control communication.
Detects network traffic destined for api.telegram.org that follows the specific URL structure pattern associated with the CARBONATO Hermes Agent bot command-and-control channel.
Detects HTTP traffic where the Host header contains a decimal-encoded IP address, which is a technique often used in stager evasion and obfuscation (notably associated with 'ClickFix' or similar browser-based malvertising campaigns) to bypass domain-based filtering or reputation systems.
Detects potential credential stuffing activity by monitoring for a high volume of HTTP 401 (Unauthorized) or 403 (Forbidden) responses originating from a single source IP address within a 60-second window, specifically targeting URIs containing the path 'login'.
Detects anomalous network behavior where a source host initiates a high volume of DNS TXT record queries to an external domain within a short timeframe. Such patterns are indicative of data exfiltration or C2 communication tunneling through DNS protocol.
Detects unauthorized exfiltration of sensitive information, such as camera credentials or location data, directed to the Telegram Bot API as part of the 'Operation CameraSwarm' campaign.
Detects incoming HTTP traffic containing a custom 'X-Quad' header, which is indicative of exploitation attempts targeting PaperCut MF vulnerabilities (CVE-2026-82078/CVE-2026-81578). This header is associated with the deployment or interaction with a Java-based web shell to establish unauthorized access.
Detects HTTP POST requests originating from the internal network directed at a known suspicious C2 infrastructure IP address (156.227.0.13), indicating potential C2 check-in activity associated with AdaptixC2 malware.
This rule detects network traffic originating from internal hosts using a specific HTTP User-Agent string associated with the default configuration of the AdaptixC2 framework. This is a common indicator of a C2 implant performing heartbeat or command-and-control communication.
Detects HTTP GET requests to external servers for files identified as 'mscopilot.exe' or '65722.txt', which are associated with the AdaptixC2 framework/malware, indicating potential payload delivery or command and control activity.
Detects network traffic associated with Adversary-in-the-Middle (AiTM) phishing kits that impersonate Microsoft and Google login pages. The rules identify the presence of specific HTML elements (like Cloudflare Turnstile anti-bot gates) and authentication session cookie headers served from non-authorized/non-official domains, indicating a reverse-proxy phishing attack.
Detects high-volume outbound network traffic (exceeding 50MB) directed towards known consumer-grade cloud storage and anonymous file-sharing services. This activity can indicate data exfiltration, as these services are frequently abused to bypass security controls while masking data movement within legitimate-appearing traffic.
Detects high-frequency outbound HTTP/HTTPS connections to a single external destination characterized by consistent, small payload sizes. This pattern is indicative of automated command-and-control (C2) beaconing, commonly observed in frameworks like Cobalt Strike or Sliver.
Page 23 of 312