Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,154 detections
Filters
Last updated
All Time
Detection languages
683
379
342
230
173
Contributors
630
378
354
145
119
Categories
841
831
746
393
348
Platforms
1,587
586
494
263
118
Products / Services
10,683
9,759
6,695
4,421
3,750
2,154
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
This rule identifies network connections (DNS queries, HTTPS/WebSocket traffic) directed toward known suspicious domains associated with potentially malicious C2 infrastructure.
This rule detects attempts to perform Large Language Model (LLM) prompt injection via HTTP requests. It monitors proxy traffic for common jailbreaking or adversarial instruction patterns such as 'ignore previous instructions', 'bypass restrictions', or 'fictional environment' within URI parameters or request bodies. Such patterns are indicative of an attacker attempting to manipulate the behavior of an AI/LLM application.
This rule monitors network traffic for HTTP POST requests directed toward specific destination ports (443 or 8770) that return HTTP status codes in the 4xx range (client errors), excluding known legitimate URI paths. This pattern may indicate scanning activity, exploitation attempts, or unauthorized access attempts against internal services or misconfigured applications.
Detects outbound web traffic directed towards common password management services (e.g., 1Password, LastPass, Bitwarden) originating from user agents associated with AI and LLM tools (e.g., OpenAI, Claude, Copilot). This combination of destinations and user agents is highly anomalous and may indicate potential credential exfiltration or interaction with automated agents acting on behalf of a user to access sensitive vault data.
Detects high-frequency requests to sensitive management or API-related URL paths (/msp/, /api/, /wyse/, /wms/) that are not preceded by successful authentication attempts. This pattern is characteristic of automated exploitation attempts or unauthorized discovery against network management or configuration interfaces from external IP addresses.
This rule detects network activity involving known suspicious domains and the download of specific, potentially malicious files (archives and installers). The monitoring focuses on HTTP/proxy/DNS traffic where hostnames, URLs, or query parameters match indicators of malicious activity.
Detects DNS traffic patterns indicative of the Iodine DNS tunneling tool, specifically identifying version handshake queries or base32 encoded payloads commonly associated with the tool's C2 communication.
Detects outbound ICMP Type 8 (Echo Request) packets that contain an abnormally large payload (greater than 64 bytes). This behavior is characteristic of ICMP tunneling, where attackers encapsulate data within the payload of ICMP packets to bypass network security controls or establish covert command and control communication.
Detects outbound FTP STOR (Store) commands directed to external networks. This indicates that a host inside the local network is attempting to upload data to an external server. The rule uses a threshold to filter out isolated commands, triggering when 3 or more STOR commands are detected within 120 seconds, which is characteristic of data exfiltration or staging behavior.
Detects DNS traffic patterns indicative of the Iodine DNS tunneling tool, specifically identifying version handshake queries or base32 encoded payloads commonly associated with the tool's C2 communication.
This rule detects HTTP GET requests containing '/api/device/gate/' and the 'ngrok-skip-browser-warning' string in either the AdditionalExtensions, RequestClientApplication, csUriQuery, or csUserAgent fields. This pattern is indicative of traffic associated with ngrok, a legitimate reverse proxy tool that can be leveraged by threat actors for various malicious purposes, including C2, data exfiltration, or bypassing network restrictions. The rule consolidates logs from CommonSecurityLog, W3CIISLog, and DeviceNetworkEvents to identify such activity.
Detects POST requests to vLLM multimodal inference endpoints that contain 'video_url' fields pointing to external resources or specific video file extensions (.jp2, .mov, .mp4). This activity is indicative of exploitation attempts related to CVE-2026-22778, where an attacker might try to inject malicious video URLs to trigger vulnerabilities in the vLLM service.
This rule detects HTTP PUT requests with specific URL parameters ('buildtxd=', 'upload_id=', 'chunk_index=', 'total_chunks=') and a 'Mozilla/5.0' user agent, directed towards known malicious domains ('bestbuydomain.com', 'premierrentalpurchase.com'). This pattern is indicative of data exfiltration, potentially by malware uploading stolen data in chunks.
This rule detects network connections from internal hosts to identified C2 or phishing infrastructure associated with the threat actor group UNC1151 (also known as Ghostwriter). It monitors both host-based network events (via DeviceNetworkEvents) and centralized network security logs (via CommonSecurityLog) for traffic targeting a curated list of known malicious IP addresses.
Detects phishing attempts leveraging legitimate service redirectors such as Calendly and Google share URLs to deliver malicious photo-themed ZIP archives. The rule identifies suspicious redirect chains to Cloudflare-hosted (.cfd) domains and monitors for specific ZIP filename patterns commonly used in these campaigns to target the hospitality sector.
This rule identifies endpoints making network connections to a set of known suspicious or malicious IP addresses. It aggregates the number of connections and the variety of processes initiating these connections, allowing analysts to identify potential command and control (C2) communication patterns from compromised hosts.
Detects network communication with known malicious IP addresses or URLs associated with the 'govtop.one' infrastructure, which is commonly indicative of command and control activity or malware beaconing.
This rule monitors web request URLs and associated messages for common SQL injection characters and sequences, such as quotes and semicolons. It specifically targets requests involving the 'apiuser' account to identify potential attempts to manipulate or exploit backend database queries.
Detects network connections over SMB (port 445) targeting internal IP ranges initiated by common penetration testing or scripting tools (e.g., Python, msfconsole), or attempts containing known exploit strings such as 'eternalblue', 'ms17-010', or 'WinboxExploit'. This behavior is indicative of lateral movement, reconnaissance, or exploitation attempts within the network.
Detects network requests involving a file named 'cors_exploit_poc.html' in either the URL or the Referrer field. This filename is characteristic of proof-of-concept (PoC) code used to test for vulnerabilities in Cross-Origin Resource Sharing (CORS) policies, which could allow unauthorized cross-domain access to sensitive data.
Detects outbound network connection from a host to a known malicious IP and port associated with the exploitation of the GeoServer WFS vulnerability CVE-2024-36401. This rule identifies the potential post-exploitation callback, such as a curl command, following successful remote code execution.
Page 70 of 103