Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,154 detections
Filters
Last updated
All Time
Detection languages
683
379
342
230
173
Contributors
630
378
354
145
119
Categories
841
831
746
393
348
Platforms
1,587
586
494
263
118
Products / Services
10,683
9,759
6,695
4,421
3,750
2,154
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
Detects unauthorized HTTP requests to Gitea containing an 'X-WEBAUTH-USER' header set to 'admin'. This targets CVE-2026-20896, where a misconfigured reverse proxy trust setting allows external users to spoof authentication and gain administrative privileges.
This rule monitors network traffic for HTTP requests or DNS queries targeting 'nacos', a popular service discovery and configuration management platform. The rule specifically flags potential interaction attempts and identifies whether the activity includes login-related path patterns, which could indicate unauthorized access attempts or reconnaissance against a Nacos instance.
Detects outbound proxy requests to the Bing Search-by-Image endpoint where the imgurl parameter is used to perform a server-side request forgery (SSRF). Attackers use this to bypass security controls by forcing Microsoft services to fetch an external, malicious URL containing exfiltrated data within the path, as seen in the SearchLeak (CVE-2026-42824) exploit chain.
This rule detects outbound HTTP requests to Bing's 'searchbyimage' functionality that contain an image URL pointing to a domain outside of Microsoft or Bing. This behavior is associated with a potential data exfiltration technique (referenced as CVE-2026-42824) where internal information is encoded into an image URL and passed to an external, attacker-controlled, or third-party web service via the Bing search engine to bypass traditional network egress controls.
Detects outbound requests to the Bing 'searchbyimage' endpoint where the 'imgurl' parameter points to an external (non-trusted) domain. This pattern is indicative of potential SSRF exploitation, such as the described SearchLeak (CVE-2026-42824) vulnerability chain, where an attacker uses Bing's search functionality as a proxy to reach internal or restricted infrastructure.
Detects anomalous HTTP upgrade requests (h2c, websocket) targeting potentially vulnerable web infrastructure (e.g., nghttpx). The rule correlates abnormal 'Upgrade' header usage, suspicious request paths (/poisoned, /upgrade), and subsequent 400 error codes, which are indicative of HTTP request smuggling attempts aimed at desynchronizing frontend and backend request queues.
Detects malicious HTTP/1.1 Upgrade requests directed at nghttpx that include a Content-Length body. This combination is characteristic of a request smuggling attack, where an attacker injects a smuggled request into the backend connection. By poisoning the backend queue, the attacker can cause the nghttpx proxy to forward sensitive or malicious responses to victim clients sharing the same connection.
Campaign converting compromised FortiGate firewalls into credential stealers
Detects suspicious processes commonly associated with malicious activity establishing outbound network connections to Azure Web Apps domains. The rule aggregates connections to identify potential beaconing behavior by monitoring connection frequency and duration, flagging activity initiated by binaries frequently used for living-off-the-land attacks such as powershell.exe, rundll32.exe, and others.
Detects anomalous external scanning activity against internal web applications by monitoring for multiple requests to sensitive URI paths associated with vulnerability exploitation (e.g., cgi-bin, admin-ajax.php, .env, or command execution endpoints) originating from external IP addresses to internal network space.
This rule detects high-volume or repeated outbound connections to Mega cloud storage domains (mega.nz, mega.co.nz, etc.) by processes that are not identified as standard web browsers. Such activity may indicate data exfiltration, automated file staging, or unauthorized use of cloud storage services.
This rule detects potential exploitation attempts targeting the BeyondTrust Privileged Remote Access API by identifying unauthenticated POST requests directed at specific sensitive API endpoints (e.g., /api/, /remote-support/). It flags high-frequency or multi-path request patterns indicative of automated vulnerability scanning or exploitation attempts related to CVE-2026-1731, where the absence of authorization headers is a key indicator of unauthorized access.
This rule detects network connections to suspicious domains or IP addresses associated with potentially compromised or malicious VPN infrastructure. Specifically, it looks for connections to 'vpn-fortinet.com', 'ivanti-vpn.org', 'forticlient-vpn.de', or the IP address '194.76.226.93'. These indicators may suggest attempts to establish command and control, exfiltrate data, or engage in other malicious activities via compromised VPN services.
Detects anomalous, high-volume API requests to ServiceNow endpoints originating from the same source IP that lack valid authorization headers or session tokens, potentially indicating automated scanning, enumeration, or exploitation attempts.
This rule detects network communication with known malicious command-and-control (C2) infrastructure identified by specific domains and IP addresses. The detection logic calculates a confidence score based on the presence of identified malicious C2 domains or IPs, specific suspicious cookies (zd_cs_pm, euconsent-v2), and known C2 URI paths.
Detects Server-Side Request Forgery (SSRF) attempts exploiting URL parser differentials. Attackers append a double-slash sequence to a legitimate github.com blob URL to trick the backend into resolving an absolute local filesystem path. The rule specifically targets sensitive paths such as /proc/self/environ, /var/task/, and application source files to perform Local File Read (LFR) or access internal cloud metadata services.
Detects high-volume outbound network scanning activity from a single internal source device. The rule identifies anomalous behavior characterized by rapid connection attempts to a large number of distinct destination IPs and ports, consistent with scanning patterns observed in botnets like JDY, which often target edge network infrastructure (Cisco, Ubiquiti, Draytek).
Detects network connections initiated by Windows Nearby Sharing processes (quick_share.exe, nearby_sharing.exe, or NearbyShare.exe) to non-standard ports, potentially indicating unauthorized file transfers or exfiltration over unusual network channels.
Detects outbound web traffic directed towards common password management services (e.g., 1Password, LastPass, Bitwarden) originating from user agents associated with AI and LLM tools (e.g., OpenAI, Claude, Copilot). This combination of destinations and user agents is highly anomalous and may indicate potential credential exfiltration or interaction with automated agents acting on behalf of a user to access sensitive vault data.
This rule detects anomalous, high-frequency HTTP POST requests directed at sensitive API endpoints related to payment, billing, or administration. By calculating requests per minute and identifying unique source IP behavior, it aims to flag potential automated brute-force attacks, unauthorized API discovery, or data exfiltration attempts against critical system management interfaces.
Detects the use of the FTP STOR command to transfer files with sensitive extensions (.docx, .pdf, .xlsx, .zip, .7z) to external networks. This behavior is indicative of potential data exfiltration via an unencrypted alternative protocol.
Page 52 of 103