Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,154 detections
Filters
Last updated
All Time
Detection languages
683
379
342
230
173
Contributors
630
378
354
145
119
Categories
841
831
746
393
348
Platforms
1,587
586
494
263
118
Products / Services
10,683
9,759
6,695
4,421
3,750
2,154
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
This rule detects network connections from internal hosts to a list of known malicious IP addresses associated with the Payroll Pirate campaign (attributed to Storm-2755 and Storm-2657). Identifying these connections indicates potential communication with adversary-controlled infrastructure.
Detects network communication to the malicious domain 'mitarchive.info' from common web browsers (Chrome, Edge, Firefox, Brave). This domain is associated with the StegoAd browser extension, which intercepts Google and WordPress login flows to exfiltrate stolen credentials and 2FA codes.
This rule detects potential rogue SD-WAN peering attempts by correlating successful SSH public key authentication using 'vmanage-admin' from known malicious IPs with subsequent network activity on SD-WAN control plane ports (e.g., 48373 for OMP, 830 for NETCONF). It also flags logs containing references to an 'evil_tenant.csv' artifact, which is associated with adversary persistence or unauthorized configuration management in SD-WAN environments.
Detects inbound network connections from a specific list of known suspicious or untrusted external IP addresses targeting sensitive management ports (SSH, NETCONF, and vManage-HTTPS-API). The rule identifies if the connection is made by a privileged account (e.g., admin, root) to highlight potential unauthorized management access attempts.
Detects exploitation attempts against CVE-2026-33017 in Langflow by monitoring for unauthenticated POST requests to the /api/v1/build_public_tmp/ endpoint, specifically using the identified exploit User-Agent, followed by outbound connections from the victim host to known attacker-controlled infrastructure.
Detects unauthenticated HTTP POST requests targeting Oracle PeopleSoft PSEMHUB and PSIGW endpoints that are characteristic of the CVE-2026-35273 remote code execution exploit gadget chain.
Detects outbound network traffic to api.telegram.org. This pattern is commonly observed in malware such as Sauron ransomware to establish command and control (C2) channels and perform data exfiltration by abusing the legitimate Telegram Bot API.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Detects network requests from the Firefox browser process containing URI patterns and parameters often associated with data exfiltration or browser-based reconnaissance, including suspicious leakage parameters and local proxy/loopback communication attempts on non-standard ports.
Detects DNS lookups or network connections from common web browsers to known malicious or suspicious domains (short.gy and chongdaotang.net), which are associated with legal-threat lure phishing campaigns designed for credential harvesting.
This rule monitors web traffic logs for requests targeting administrative URI paths or containing the username 'admin' in the 'X-WEBAUTH-USER' header. It specifically filters out requests originating from trusted reverse proxies, identifying potential attempts to bypass authentication by manually injecting administrative headers.
This rule uses regular expressions to identify distinct URL structures associated with the Tycoon2FA AiTM (Adversary-in-the-Middle) phishing kit. Specifically, it looks for URIs containing patterns like "?auth=" followed by a base64-encoded string or "/login?email=" followed by a base64-encoded string, which are indicative of the kit's operation to capture credentials or session tokens.
Detects network activity originating from popular web browsers (Chrome, Chromium, Edge, Brave) directed towards known malicious or suspicious browser extension domains. This rule flags beaconing, API requests, and remote configuration fetches associated with potentially malicious or unwanted browser extensions.
This rule monitors network logs (proxy, DNS, network) for connections to domains associated with the Unistream SDK. This SDK has been identified as a component of the BadBlocker malicious Chrome extension family, which facilitates unauthorized background activity. The rule serves as an indicator of potential command and control (C2) communication from a compromised host.
This rule monitors network logs for potential malicious activity by analyzing subdomain cardinality and identifying known phishing domains. It flags apex domains that exhibit high subdomain rotation (5 or more distinct subdomains within an hour), indicative of fast-flux DNS techniques, or that match a static list of known malicious/phishing infrastructure.
Detects potential exploitation of CVE-2026-0300 targeting PAN-OS and matches anomalous User-Agent string associated with CL-STA-1132 threat actor.
This rule monitors for two types of anomalous network behavior: first, it identifies connections to known domains from IP addresses not previously associated with those domains over a seven-day lookback period. Second, it identifies HTTP proxy responses (from Zscaler or Squid) where the content-length significantly deviates from the historical baseline for specific URLs. These patterns are potential indicators of C2 channel shifts or data exfiltration via web protocols.
This rule detects network connections to FTP servers (port 21) where the remote URL contains keywords associated with NetWare or Novell, along with suspicious whitespace patterns. This could indicate an attempt to exploit a known vulnerability related to whitespace handling in NetWare FTP servers, potentially the 'Squidbleed' vulnerability.
Detects abnormally long DNS queries characterized by repetitive alphanumeric patterns, which may indicate potential DNS tunneling activity used for C2 communication or data exfiltration. The rule flags DNS requests exceeding 60 characters with repeating label structures.
This rule detects network connections to phishing pages hosted on the workers.dev domain that are attempting to interact with EvilTokens device code API endpoints. These pages are known to implement developer hotkey prevention (F12 blocked, context menu disabled) to hinder in-browser analysis, indicating malicious intent.
This rule detects multiple outbound network connections to a specific set of known malicious C2 IP addresses on specific ports within a one-hour window. This behavior is indicative of a multi-payload delivery pattern associated with malware families such as Remcos, Agent Tesla, and RedLine.
Page 59 of 103