Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,154 detections
Filters
Last updated
All Time
Detection languages
683
379
342
230
173
Contributors
630
378
354
145
119
Categories
841
831
746
393
348
Platforms
1,587
586
494
263
118
Products / Services
10,678
9,759
6,693
4,421
3,749
2,154
MITRE Techniques
655
561
383
337
286
CVEs
32
20
8
7
6
IDS Classtypes
65
32
23
19
14
IDS Protocols
47
38
30
30
12
This rule detects potential device code phishing attempts where a user accesses a commonly abused Platform-as-a-Service (PaaS) platform (Cloudflare Workers, Vercel, Amplify) and subsequently attempts to log in via the Microsoft device login endpoint within a 5-minute window. This sequence of events is indicative of an adversary luring a user to a malicious site hosted on a PaaS platform to capture a device code, which is then used to authenticate to Microsoft services.
This rule detects network connections to suspicious domains or IP addresses associated with potentially compromised or malicious VPN infrastructure. Specifically, it looks for connections to 'vpn-fortinet.com', 'ivanti-vpn.org', 'forticlient-vpn.de', or the IP address '194.76.226.93'. These indicators may suggest attempts to establish command and control, exfiltrate data, or engage in other malicious activities via compromised VPN services.
Identifies suspicious URI request patterns potentially indicative of CVE-2026-4681 exploitation attempts against PTC PLM solutions. This rule looks for these specific patterns within web traffic logs from various sources (access logs, IIS, Apache).
This rule detects network connections or DNS queries to a specific Internet Computer Protocol (ICP) domain and canister ID (tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io or tdtqy-oyaaa-aaaae-af2dq-cai). This pattern is associated with command and control (C2) activity, where compromised systems communicate with an adversary-controlled server.
Detects User-Agent rotation behavior from a single Source IP (c-ip) associated with more than 3 distinct
User-Agent (c-useragent) values within a 5-minute window. This behavior is characteristic of the Nuclei
'-random-agent' flag, which allows the scanner to bypass WAF (Web Application Firewall) detections by
using a different, valid browser User-Agent string for each request.
User-Agent (c-useragent) values within a 5-minute window. This behavior is characteristic of the Nuclei
'-random-agent' flag, which allows the scanner to bypass WAF (Web Application Firewall) detections by
using a different, valid browser User-Agent string for each request.
Detects outbound network connections to the known typosquatted C2 domain (`scan.aquasecurtiy.org`) or associated IP address (`45.148.10.212`) used by the TeamPCP threat actor. This infrastructure was utilized during the Trivy supply chain attack for exfiltrating stolen SSH keys, cloud credentials, and CI/CD secrets.
Detects HTTP POST requests targeting the Langflow public flow build endpoint, which is vulnerable to unauthenticated Remote Code Execution (CVE-2026-33017).
Detects outbound web requests to the Anthropic API containing the specific beta header required to upload files. This can be abused by attackers to exfiltrate sensitive data from the Claude sandbox to an attacker-controlled Anthropic account.
Detects access to the claude.com open redirect endpoint pointing to external domains. Attackers can abuse this trusted domain to bypass ad validation and email filters to deliver malicious payloads, such as prompt injections.
Detects the presence of HTML tags within the URL query parameters of Claude chat application pre-fill URLs. Attackers can use this to embed invisible instructions (prompt injection) that the AI processes but the user does not see in the chat interface.
Detects DNS queries to Solana RPC endpoints associated with GlassWorm/ForceMemo blockchain-based C2. The malware queries up to 9 Solana RPC endpoints to retrieve C2 instructions from on-chain transaction memos. A Python process resolving any of these domains is anomalous outside of cryptocurrency development environments.
Detects network traffic matching the specific URI structure used by LeakNet for command-and-control beaconing. This behavior has been consistently observed across multiple LeakNet incidents following initial access.
This rule detects network connections or email URLs that contain domains associated with the 'ShinyHunters' threat group's infrastructure. The rule specifically looks for a predefined list of domains known to be used by ShinyHunters for phishing or other malicious activities. It correlates email URL information with device network events to identify potential compromise attempts.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
Correlates phishing email delivery with subsequent communication to attacker-controlled domains.
Detects HTTP/HTTPS traffic where the User-Agent string is explicitly set to 'MicroStealer/1.0', which is used by the malware when communicating with Discord webhooks or its C2.
Detects command and control (C2) communication to a specific Telegram Bot API endpoint hardcoded in the LampoRAT malware. This activity is associated with the Boggy Serpens (MuddyWater) threat actor.
Detects C2 communication from Boggy Serpens (MuddyWater) backdoors like Nuso and BlackBeard, which use non-standard HTTP status codes (201, 202, 418) to receive commands from known C2 servers.
Detects potential data exfiltration by the BlackBeard backdoor, associated with Boggy Serpens (MuddyWater). The malware abuses the HTTP 'Expires' header in client requests to exfiltrate encrypted system data to its command and control server. The 'Expires' header is a standard response header, so its presence in a request is highly anomalous.
Detects web requests for specific JavaScript file names that are part of the DarkSword iOS exploit chain. The presence of these requests strongly suggests a device is being targeted with the exploit kit.
Detects the C2 communication of the Slopoly PowerShell backdoor, used by the Hive0163 group. It looks for specific HTTP POST requests containing a JSON body with characteristic keys.
Page 82 of 103