Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,154 detections
Filters
Last updated
All Time
Detection languages
683
379
342
230
173
Contributors
630
378
354
145
119
Categories
841
831
746
393
348
Platforms
1,587
586
494
263
118
Products / Services
10,683
9,759
6,695
4,421
3,750
2,154
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
Detects exploitation attempts against LB-LINK routers via parameter injection in the 'set_LimitClient_cfg' endpoint (CVE-2023-26801) and subsequent command-and-control behavior, including outbound connections to known RondoDox staging IPs and DNS queries for associated malicious domains.
Detects a web session that proxies an enterprise authorisation endpoint while also handling session-cookie names associated with authenticated access. This rule identifies suspicious activity indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker proxies authentication requests and steals session cookies.
Detects stealth port scan techniques for reconnaissance evasion
This rule detects WebSocket upgrade requests targeting Multi-Context Protocol (MCP) endpoints on AutoGen Studio default ports (8080/8081). It specifically flags connections originating from non-loopback addresses where the HTTP Origin header does not contain expected local indicators ('localhost', '127.0.0.1', '::1'), which may indicate unauthorized cross-origin access or remote exploitation attempts against the local development environment.
This rule detects network traffic indicative of command and control (C2) activity using the WebSocket protocol targeting a specific suspicious destination IP (38.60.253.35). The rule identifies WebSocket connections or traffic containing specific URL parameters ('a=w64', 't=ws_') commonly associated with malicious tooling or C2 communication patterns.
Detects HTTP requests to the SaaS platforms 'holabrief.com' or 'loopedin.io' that contain common URL redirection parameters, characteristic of an open-redirect abuse tactic used in phishing campaigns. These platforms are leveraged as intermediate hops to obfuscate the final destination of phishing links. The rule identifies the initial request and suggests correlation with subsequent traffic to unknown destinations to confirm a two-hop redirection chain.
Detects phishing emails that spoof specific healthcare domains (nhs.uk, mayoclinic.org, clevelandclinic.org) using invoice or payment-related subjects, characterized by DMARC/DKIM/SPF authentication failures. The detection correlates these emails with a subsequent user network request to known open-redirect or intermediary SaaS platforms (holabrief.com, loopedin.io) within a 10-minute window, indicating a likely credential harvesting or malware delivery sequence.
Detects anomalous outbound TCP network connections on port 8084 originating from non-browser processes to known CDN providers (Akamai, Microsoft). This behavior is characteristic of VSHELL RAT C2 beaconing using domain blending techniques to mask communications within expected network noise.
This rule detects a high frequency of successful network connections from a single device to multiple unique destination IP addresses within a one-hour window. The targeted ports (445, 139, 3389, 22, 21) are commonly used for remote administrative access, file transfers, and remote shell services, which are frequently leveraged by adversaries for lateral movement. The threshold of 3 unique targets in an hour may indicate automated scanning or credential brute-forcing activity across the network.
Detects network flows to RustDesk relay server ports (21115, 21116, 21117) characterized by anomalous connection patterns. The rule identifies hosts exhibiting rapid, repeated connection attempts or connections to multiple distinct relay IP addresses within a short timeframe. This behavior is consistent with the 'rustdesk-session-permission-pocs' technique, which may indicate an attacker attempting to establish a remote session while bypassing the standard permission handshake exchange required by the application.
Detects Node.js processes associated with NodeBB making outbound network connections to suspicious paths (/users/, /activities/, /inbox, /.well-known/webfinger). This activity may indicate exploitation of the NodeBB ActivityPub plugin (attributedTo UID spoofing), where an attacker forces the application to fetch attacker-controlled URIs.
Detects network connections attempting to exfiltrate data via Discord webhooks. This rule specifically looks for POST requests to the Discord API webhook endpoint.
Detects FTP traffic with suspicious URLs referencing potentially insecure or legacy protocols.
Detects exploitation attempts against the Ray AI framework's unauthenticated /api/jobs/ endpoint (CVE-2023-48022). The rule identifies specific Python requests using a known malicious contact address ('rondo2012@atomicmail.io') and detects the delivery of fileless payloads (rondo.wfh.sh) associated with the RondoDox / ShadowRay campaign originating from known malicious infrastructure.
Detects outbound network communication from node.exe to the domain 'stitch-production.org'. This domain is associated with the 'Miasma' (also known as Mini Shai-Hulud) campaign, which uses malicious npm packages with post-install scripts to steal developer credentials, including Git, Docker, SSH, and cloud service configuration files.
This rule detects DNS queries to known public tunneling service domains, such as devtunnels.ms, loophole.site, loca.lt, and bore.pub, originating from processes other than the legitimate developer tunneling tools (devtunnel.exe, code.exe, code-tunnel.exe). This activity is highly indicative of unauthorized remote access or command-and-control communication.
Detects many unique, high-entropy URL paths that each receive a small number of requests before redirecting to authentication. This behavior is indicative of adversaries like Volt Typhoon (Tycoon) using one-time session paths for each victim in phishing campaigns.
This rule detects the use of JSON-RPC 'eth_call' by a non-browser process during network connection events. It specifically looks for network activity where the process is not a known web browser (Chrome, Edge, Firefox) and the network traffic or command line contains the string '"method":"eth_call"'. This behavior is often associated with malware or cryptocurrency-related threats attempting to resolve dynamic commands or addresses.
This rule monitors network logs (from proxies and firewalls) for web traffic (HTTP GET requests) containing suspicious JavaScript code injection patterns in the request context or message fields. It specifically looks for common XSS indicators such as <script tags, eval(), document.write(), fromCharCode(), and atob().
Detects non-browser HTTP POST requests containing both 'access_token' and step-style parameters (e.g., 'step', 'stage', 'counter' followed by a number) in proxy or firewall telemetry. This rule specifically targets patterns associated with malware communication, such as SessionGate, Remus, or AnimateClipper, by excluding common browser user agents.
This rule monitors Cisco Unified Communications Manager (UCM) environments for multiple stages of an attack chain, including potential Server-Side Request Forgery (SSRF) attempts against administrative interfaces, suspicious file modifications by service accounts, indicators of privilege escalation, and anomalous outbound network connections from core Cisco processes.
Page 67 of 103