Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,154 detections
Filters
Last updated
All Time
Detection languages
683
379
342
230
173
Contributors
630
378
354
145
119
Categories
841
831
746
393
348
Platforms
1,587
586
494
263
118
Products / Services
10,683
9,759
6,695
4,421
3,750
2,154
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
This rule detects exploitation attempts targeting CVE-2026-0300 in Palo Alto Networks PAN-OS. It identifies suspicious network connections to User-ID Authentication Portal ports (6081, 6082) from external IP addresses, excluding RFC1918 and loopback ranges. Additionally, it looks for a specific anomalous User-Agent string associated with the CL-STA-1132 threat actor, which has been observed during exploitation of this vulnerability.
Detects unauthenticated Engine.IO WebSocket handshake attempts targeting the Peyara Remote Mouse service on TCP port 1313. These requests, characterized by specific URI query parameters, are often used as an initial phase for exploitation against vulnerable instances of the application.
Detects an unauthenticated WebSocket or Socket.IO handshake attempt targeting the Peyara Remote Mouse service on TCP port 1313. This behavior is associated with the exploitation of known remote code execution vulnerabilities in the service.
Detects DNS queries originating from endpoints to common URL shortening services such as bit.ly, goo.gl, and others. These services are frequently abused by adversaries for C2 communications, distributing malware, or phishing, as they can mask malicious destination URLs.
Detects exploitation attempts against Gitea instances where an attacker impersonates an admin user by injecting the 'X-WEBAUTH-USER' header. This vulnerability typically occurs when 'REVERSE_PROXY_TRUSTED_PROXIES' is misconfigured to trust all proxies ('*'), allowing unauthenticated users to gain administrative access via header manipulation. The rule covers web request headers, container logs for suspicious admin creation, and process execution arguments associated with the exploitation.
Detects outbound HTTP POST beaconing to known malicious C2 infrastructure (83.142.209.214) associated with the lambsys cryptominer campaign. The rule specifically looks for HTTP requests to /status.php or /setup_status.php utilizing the default Go HTTP client User-Agent, a common indicator of this specific malware.
USB worm and loader leveraging living-off-the-land binaries
Dridex C2Beacon
YARA
Banking trojan and loader using malicious Office macro delivery
Loader malware delivering follow-on ransomware payloads
This rule detects potentially malicious credential abuse patterns, such as credential stuffing or brute force attacks, originating from external IP addresses against edge appliance VPN or administrative interfaces. It identifies activity by correlating a high volume of failed authentication attempts followed by a successful login from the same external IP address.
Detects potential Command and Control (C2) infrastructure rotation and DNS exfiltration by correlating DNS-over-HTTPS (DoH) traffic to Google Public DNS (8.8.8.8) with concurrent outbound connections to a high count (>=5) of distinct external IP addresses within a one-hour window. This behavior is consistent with the Nightmare Eclipse/VerdantBamboo post-disclosure tactical shifts to obfuscate DNS queries and rotate C2 endpoints.
This rule monitors network traffic for activity related to the Tox decentralized protocol. It identifies specific domains (tox.chat) or known hex-encoded identifiers associated with Payouts King ransomware leak sites and ransom notes embedded in network requests or payloads.
Detects network, proxy, or DNS activity associated with .onion pseudo-top-level domains, which are typically used for Tor anonymity services. The rule distinguishes between generic access to the Tor network and specific high-confidence interactions with known malicious onion addresses associated with payout or extortion sites.
Open-source derived remote access trojan with plugin architecture
Correlates phishing email delivery with subsequent communication to attacker-controlled domains.
This rule monitors for high frequency network connections (more than 50 requests) initiated from internal endpoints to external (non-RFC1918) IP addresses over port 443. This pattern may indicate beaconing activity, command and control (C2) communication, or significant data exfiltration to an external host.
Detects Server-Side Request Forgery (SSRF) attempts exploiting URL parser inconsistencies. Attackers use a 'github.com@' prefix within a URL parameter to trick backend fetchers into connecting to unintended, potentially internal, hosts like 'metadata.google.internal', bypassing validation logic that incorrectly parses the URL authority.
This rule detects network connections from internal devices to identified APT Command and Control (C2) IP address ranges over common ports (8080, 443, 21, 22, 23, 25, 445). This traffic pattern is indicative of unauthorized external communication commonly associated with malware or adversary activity.
Detects anomalous high-rate outbound network scanning activity (targeting numerous distinct destination IPs and ports) originating from internal SOHO or edge devices (e.g., Cisco, Ubiquiti, Draytek hardware). This pattern is consistent with compromised devices acting as nodes within a botnet, such as the JDY cluster, conducting reconnaissance.
Detects outbound TCP traffic destined for known Tor relay ports (9001 and 9030) originating from internal RFC 1918 address space. This behavior is indicative of compromised edge devices or IoT hardware attempting to establish command and control (C2) communication via the Tor network, a tactic commonly used by threat actors to obfuscate their infrastructure and C2 traffic.
Detects Server-Side Request Forgery (SSRF) attempts targeting the Google Cloud Platform (GCP) metadata server (169.254.169.254). The rule inspects RequestURL and RequestContext fields for indicators of metadata API access, URL parameter manipulation, authority confusion payloads, and encoding bypass techniques often used to access cloud instance metadata for unauthorized credential or information harvesting.
Page 56 of 103