Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,154 detections
Filters
Last updated
All Time
Detection languages
683
379
342
230
173
Contributors
630
378
354
145
119
Categories
841
831
746
393
348
Platforms
1,587
586
494
263
118
Products / Services
10,670
9,758
6,693
4,421
3,749
2,154
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
Detects core NetScaler service processes (nsppe, httpd, aslearning) initiating outbound network connections to external, non-private IP addresses. This behavior is indicative of post-exploitation C2 beaconing activity on a compromised NetScaler appliance.
Detects outbound network traffic associated with the Azazel operation, including connections to identified C2 infrastructure, open directory/upload listeners, domain-specific staging servers, and exfiltration attempts to MEGA cloud storage endpoints.
Detects potential exploitation attempts targeting unpatched Citrix NetScaler ADC or Gateway devices, specifically looking for unauthenticated requests to management or sensitive endpoints that contain command execution indicators. This rule is designed to identify activity associated with vulnerabilities similar to CVE-2026-88771.
This rule detects potential DNS tunneling or beaconing activity by monitoring DNS queries for patterns commonly associated with command and control traffic. It flags anomalous DNS behavior including excessively long query strings, usage of TXT or NULL record types, frequent NXDOMAIN responses, or high volumes of such queries from a single host, which are indicative of data exfiltration or C2 communication via the DNS protocol.
Detects repeated crashes or restarts of the Citrix NetScaler packet engine (nsppe) correlated with a concurrent spike in inbound DTLS traffic. This pattern is indicative of potential memory-overflow exploitation attempts (consistent with CVE-2026-88772) targeting the VPN virtual server functionality, leading to a Denial of Service (DoS) condition.
Detects HTTP proxy traffic containing specific header or cookie patterns associated with the Evilginx2 or BigBear adversary-in-the-middle (AiTM) phishing frameworks. These frameworks use these artifacts to proxy connections and facilitate the theft of session tokens for MFA bypass.
Detects DNS lookups and outbound network connections to known command and control (C2) and staging domains associated with the STAC4924 campaign. The rule performs strict matching on domain names to ensure that subdomains are identified while avoiding false positives from partial string matches within URLs.
Detects network connection attempts by known AI agent or development-related runtime processes (python, node, etc.) to external endpoints that are not contained within a defined allowlist of LLM and infrastructure providers. This is intended to identify potential data exfiltration or unauthorized command and control communication originating from LLM-powered applications.
Detects anomalous web request patterns against Citrix NetScaler ADC or Gateway devices, characterized by excessively long URLs or request contexts combined with high-frequency parameter variation from a single source. This behavior is indicative of potential fuzzing or exploit attempts targeting web application vulnerabilities, specifically input validation flaws in edge infrastructure.
Detects DNS resolution attempts for newly registered or suspicious top-level domains (e.g., .xyz, .top, .live) that mimic corporate Identity Provider (IdP) or Single Sign-On (SSO) login portals. This behavior is characteristic of Adversary-in-the-Middle (AiTM) phishing kits like EvilProxy or Tycoon2FA, intended to capture user session tokens. Note: This rule monitors for initial domain contact and should be correlated with subsequent authentication logs to identify potential session hijacking.
This rule detects a high frequency of SMB (port 445) connection attempts from a single internal source host to a large number of distinct internal destination hosts within a short timespan. This activity is indicative of internal network scanning, host discovery, or automated lateral movement attempts using SMB.
Broad triage/hunting rule to surface all requests to the j_security_check authentication endpoint on Cisco Catalyst SD-WAN Manager, in support of investigating CVE-2026-76504 (unauthenticated admin auth-bypass zero-day). Cisco advises reviewing serviceproxy-access.log and vmanage-server.log for requests to this endpoint from unknown or unauthorized source IPs. This rule matches ANY request to the endpoint and is NOT itself evidence of compromise -- every match requires manual review of source IP legitimacy against known/authorized administrative addresses.
This rule monitors network traffic from CommonSecurityLog data to detect bidirectional communication between NetScaler appliances and known malicious infrastructure associated with the CVE-2026-88772 campaign, which is indicative of command-and-control activity.
Detects potential exploitation attempts targeting unpatched Citrix NetScaler ADC or Gateway devices, specifically looking for unauthenticated requests to management or sensitive endpoints that contain command execution indicators. This rule is designed to identify activity associated with vulnerabilities similar to CVE-2026-88771.
Detects potential exploitation attempts targeting unpatched Citrix NetScaler ADC or Gateway devices, specifically looking for unauthenticated requests to management or sensitive endpoints that contain command execution indicators. This rule is designed to identify activity associated with vulnerabilities similar to CVE-2026-88771.
Detects anomalous lateral movement behavior where a successful NetScaler VPN or gateway session is followed immediately by internal remote service logons (RDP, SSH, WinRM) or network connections from the same source IP. This pattern is indicative of potential exploitation of Citrix NetScaler vulnerabilities (e.g., CVE-2026-88771, CVE-2026-88772) or credential abuse to move laterally into the internal environment.
Detects unauthorized access, reading, or downloading of sensitive NetScaler system files, including configuration files (ns.conf), licensing files, and cryptographic material (private keys/certificates). This activity often indicates post-exploitation reconnaissance, staging, or data theft attempts following initial access.
This rule performs a point-in-time IOC hunt within CommonSecurityLog data to detect indicators associated with NeedyMantis. It monitors for specific C2 infrastructure domains ('tripswithengine.com') and a hardcoded user-agent string ('Firefox/21.0') in proxy, firewall, or network logs, which are characteristic of this threat actor's activity.
The following analytic detects file transfers flagged as malware that occurred over non-standard ports (other than 80 and 443). Adversaries may attempt to bypass protocol-based detection or use alternate ports to blend in with other traffic. This analytic identifies these non-conventional flows and surfaces potential evasion techniques. If confirmed malicious this indicate potential malware delivery or other nefarious activity.
Detects DNS lookups and outbound network connections to known command and control (C2) and staging domains associated with the STAC4924 campaign. The rule performs strict matching on domain names to ensure that subdomains are identified while avoiding false positives from partial string matches within URLs.
Detects HTTP beacon traffic patterns indicative of Cobalt Strike malleable C2 profiles using default URI paths and User-Agent strings. This rule identifies common default configurations often left unchanged during adversarial deployment, allowing for the detection of beacon communication over HTTP.
Page 6 of 103