Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,152 detections
Filters
Last updated
All Time
Detection languages
683
377
342
230
173
Contributors
630
378
354
145
119
Categories
839
831
746
393
348
Platforms
1,585
586
494
263
118
Products / Services
10,670
9,758
6,693
4,421
3,749
2,152
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
Detects attempts to bypass authentication on Citrix NetScaler Gateway or management interfaces by using alternate URI paths, double-encoding, or path traversal techniques to reach restricted administrative endpoints. This is consistent with exploitation attempts targeting vulnerabilities like CVE-2026-19490.
Detects the initiation of VPN or ICA sessions on Citrix NetScaler devices where there is no record of a corresponding successful AAA (Authentication, Authorization, and Accounting) login event from the same source IP address within a one-hour lookback window. This pattern may indicate potential authentication bypass attempts, such as those associated with recent vulnerabilities in NetScaler products.
Detects potential reconnaissance or port scanning activities against firewall or UTM management interfaces from external IP addresses. The rule identifies sources that trigger a high volume of blocked or denied attempts across multiple management ports (e.g., SSH, HTTP/S, GUI ports) within a one-hour window.
Detects inbound network connections to NetScaler ADC management console interfaces (nsconfig, NetScaler AAA) from untrusted, external IP addresses. This rule identifies internet-facing exposure of critical management infrastructure, which is a common prerequisite for exploiting vulnerabilities such as CVE-2026-88771.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Detects a multi-stage compromise sequence involving anomalous authentication followed by VPN session establishment and a burst of outbound connections from Citrix ADC/Gateway appliances. Tightened to reduce false positives from legitimate admin access, routine VPN sessions, and authorized appliance telemetry/updates.
This rule identifies MikroTik devices running vulnerable versions of RouterOS (specifically those older than 7.24) that are susceptible to CVE-2026-84411. This vulnerability involves an integer underflow in the web management HTTP handling, which can lead to unauthenticated remote code execution or denial of service.
Detects potential Cobalt Strike or Sliver command and control (C2) beaconing behavior by analyzing network proxy, firewall, and flow logs for common C2 URI patterns, known malicious JA3/JA3S TLS fingerprints, and consistent periodic communication intervals (low jitter) characteristic of automated beacons.
Detects potential exploitation attempts against CVE-2026-76504, an authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager. The rule monitors web server logs for requests to 'j_security_check' that include URL-encoded characters (specifically %6a, representing 'j'), which is a known pattern used to bypass security filters.
This rule monitors network traffic from CommonSecurityLog data to detect bidirectional communication between NetScaler appliances and known malicious infrastructure associated with the CVE-2026-88772 campaign, which is indicative of command-and-control activity.
Detects a multi-stage compromise sequence involving anomalous authentication followed by VPN session establishment and a burst of outbound connections from Citrix ADC/Gateway appliances. Tightened to reduce false positives from legitimate admin access, routine VPN sessions, and authorized appliance telemetry/updates.
This rule detects potentially compromised accounts by correlating risky Entra ID sign-ins to Citrix NetScaler with subsequent VPN session establishment followed by rapid, high-volume outbound connection activity from the source IP address. This pattern is indicative of a threat actor using compromised credentials to gain access via VPN and immediately perform internal network scanning or data staging.
Detects a multi-stage compromise sequence involving anomalous authentication followed by VPN session establishment and a burst of outbound connections from Citrix ADC/Gateway appliances. Tightened to reduce false positives from legitimate admin access, routine VPN sessions, and authorized appliance telemetry/updates.
The following analytic identifies DNS queries from internal hosts to dynamic domain providers. It leverages DNS query logs from the `Network_Resolution` data model and cross-references them with a lookup file containing known dynamic DNS providers. This activity is significant because attackers often use dynamic DNS services to host malicious payloads or command-and-control servers, making it crucial for security teams to monitor. If confirmed malicious, this activity could allow attackers to bypass firewall blocks, evade detection, and maintain persistent access to the network.
Detects HTTP POST requests directed at Grav CMS endpoints where the __unique_form_id__ parameter contains directory traversal sequences (e.g., ../). This behavior is indicative of attempted exploitation of CVE-2026-42608, aimed at bypassing file system restrictions to write files to unauthorized locations outside the application's expected form data directory.
Detects outbound network connections from Citrix NetScaler appliances that exhibit high periodic regularity (beaconing behavior) towards rare external destinations. This pattern is indicative of potential command and control (C2) communication, possibly following the exploitation of vulnerabilities like CVE-2026-88771/88772.
Detects potential exploitation attempts targeting unpatched Citrix NetScaler ADC or Gateway devices, specifically looking for unauthenticated requests to management or sensitive endpoints that contain command execution indicators. This rule is designed to identify activity associated with vulnerabilities similar to CVE-2026-88771.
Detects DNS lookups and outbound network connections to known command and control (C2) and staging domains associated with the STAC4924 campaign. The rule performs strict matching on domain names to ensure that subdomains are identified while avoiding false positives from partial string matches within URLs.
Detects potential reconnaissance or port scanning activities against firewall or UTM management interfaces from external IP addresses. The rule identifies sources that trigger a high volume of blocked or denied attempts across multiple management ports (e.g., SSH, HTTP/S, GUI ports) within a one-hour window.
Detects core NetScaler service processes (nsppe, httpd, aslearning) initiating outbound network connections to external, non-private IP addresses. This behavior is indicative of post-exploitation C2 beaconing activity on a compromised NetScaler appliance.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Page 5 of 103