Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,154 detections
Filters
Last updated
All Time
Detection languages
683
379
342
230
173
Contributors
630
378
354
145
119
Categories
841
831
746
393
348
Platforms
1,587
586
494
263
118
Products / Services
10,678
9,759
6,693
4,421
3,749
2,154
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
Correlates phishing email delivery with subsequent communication to attacker-controlled domains.
This rule identifies potential network scanning or high-volume communication by detecting a large number of connections (50 or more) between a single source IP and a single destination IP within a 5-minute time window. It aggregates connection details such as total connections, sent bytes, and received bytes from the CommonSecurityLog.
KQL Query
This rule detects potential HTTP/2 Rapid Reset or similar denial-of-service (DoS) attacks by identifying an unusually high number of streams and total requests within a single HTTP/2 network connection over a one-minute interval. Such behavior is indicative of an attacker attempting to exhaust server resources by rapidly opening and closing streams.
This rule detects a high number of distinct URLs and total network connections originating from a single remote IP address within a one-minute time window. This behavior can be indicative of various malicious activities such as data exfiltration, command and control (C2) communication, or network scanning. The threshold for distinct URLs is set to greater than 100 and total connections greater than 500.
Detects web requests containing the specific user-agent or custom secret headers used by the Moika campaign beacon to retrieve its stage 2 payload.
Detects HTTP requests containing specific URL query parameter combinations (`ia=` and `df=`) or POST bodies containing `a=iz&b=`, which are unique to the JS.MonoGlyphRAT check-in and beaconing protocol.
Detects outbound network connections from web server processes to steamcommunity.com, which is used by this malware to fetch steganographically encoded C2 payloads from profile comments.
Detects web traffic indicating client-side injection loading JavaScript from the known malicious domain hello-mywordl.info, which is associated with a WordPress malware campaign.
Detects outbound web requests or GitHub API interactions containing the specific description string "Miasma: The Spreading Blight". This string is used as a signature by the Miasma malware (a Shai-Hulud variant involved in the @redhat-cloud-services npm supply chain attack) when creating malicious GitHub repositories to exfiltrate stolen credentials.
Detects network connections or web requests to the specific malicious GitHub repository paths used to host the 5th and 6th stage payloads of the Miasma malware (a Shai-Hulud variant).
This rule detects unusual network connection patterns characterized by a high volume of connections to a remote IP address within a 5-minute window, combined with anomalous connection durations. Specifically, it flags scenarios where there are more than 1000 connections and either the 95th percentile of connection durations is very short (less than 50ms) or the 5th percentile of connection durations is very long (greater than 30000ms). These patterns can indicate activities such as network scanning, denial-of-service attempts, or command and control communication.
This rule detects exploitation attempts targeting CVE-2026-0300 in Palo Alto Networks PAN-OS. It identifies suspicious network connections to User-ID Authentication Portal ports (6081, 6082) from external IP addresses, excluding RFC1918 and loopback ranges. Additionally, it looks for a specific anomalous User-Agent string associated with the CL-STA-1132 threat actor, which has been observed during exploitation of this vulnerability.
Detects DNS requests or network connections to the typosquatted domain and hardcoded IP associated with the DAEMON Tools supply chain attack, as well as additional network relations tied to the installer.
Detects truncated 'whostmgrsession' cookies missing the comma delimiter, which is a necessary step for attackers to inject cleartext CRLF payloads into cPanel session files and bypass authentication. This rule specifically looks for the 'whostmgrsession' cookie in web or proxy logs where the cookie value matches a regex pattern indicating the absence of the expected comma delimiter, a characteristic of the CVE-2026-41940 exploitation.
Detects the generation of pre-authentication session cookies via intentionally failed login attempts to the `login_only` endpoint. This detects the initial staging phase of the CVE-2026-41940 exploit chain.
Detects DNS lookups and outbound network connections to known PhantomRaven command and control (C2) infrastructure, including specific domains and IP addresses. The rule also specifically identifies potential data exfiltration attempts to the '/mozbra.php' endpoint.
Detects the Node.js process making external DNS requests to api64.ipify.org, a behavior used by the PhantomRaven payload to discover the host's public IP address.
Detects DNS queries or network connections to known PhantomRaven Wave 5 command-and-control infrastructure (domains and IP addresses). This rule identifies communication with specific malicious domains and IP addresses associated with the PhantomRaven campaign, indicating potential compromise or attempted communication with adversary infrastructure.
CVE-2026-0300 Scanner Tool User-Agent
Cortex XDR
Detects the use of the CVE-2026-0300 scanner tool by its distinct User-Agent string attempting to identify vulnerable PAN-OS Captive Portals.
Detects the initial staging phase of the CVE-2026-41940 exploit chain, where an attacker intentionally generates a pre-authentication session file on the target server via failed POST requests to the login_only endpoint.
Page 79 of 103