Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,594 detections
Filters
Last updated
All Time
Detection languages
2,463
65
36
12
11
Contributors
991
707
594
140
61
Categories
2,159
1,453
1,273
576
444
Platforms
2,418
272
203
71
63
Products / Services
10,670
9,758
6,693
4,421
3,749
2,594
MITRE Techniques
808
512
383
246
210
CVEs
18
12
12
12
10
IDS Classtypes
1,144
447
282
188
105
IDS Protocols
1,378
413
318
209
34
Detects HTTP GET requests to Backblaze B2 storage hosting specific archive files identified as payloads for the RustyShade/RustyMove malware family, often used by the APT36 threat group.
Detects HTTP traffic containing the 'User-token' header, which is indicative of command-and-control (C2) communication patterns associated with the curlRAT backdoor, often attributed to North Korean threat actors such as APT37, Lazarus, or Kimsuky.
This rule detects potential exploitation attempts targeting the CAPWAP (Control and Provisioning of Wireless Access Points) protocol in FortiOS or FortiSwitchManager. The rule identifies suspicious UDP traffic on port 5246 containing an oversized payload (greater than 1400 bytes), which is characteristic of the exploitation pattern for CVE-2025-25249.
Detects outbound network connections (HTTPS/TLS) to known malicious domains used by TA419 for AitM (Adversary-in-the-Middle) phishing campaigns. These domains are identified as part of a spoofed OneDrive document/file sharing theme intended to steal user credentials.
Detects DNS queries, HTTP host headers, and TLS SNI traffic associated with known credential-phishing domains used by the threat actor TA419. The rule monitors for communication to a specific list of domains identified as malicious or used in phishing campaigns.
Detects outbound HTTPS traffic to domains using file-sharing or cloud-sync themed keywords in combination with specific top-level domains (TLD) often associated with suspicious infrastructure. The rule specifically excludes well-known legitimate services such as OneDrive, SharePoint, Dropbox, Box, iCloud, and Google, and includes a detection threshold to minimize alerts for incidental traffic.
Detects outbound HTTPS traffic to domains using file-sharing or cloud-sync themed keywords in combination with specific top-level domains (TLD) often associated with suspicious infrastructure. The rule specifically excludes well-known legitimate services such as OneDrive, SharePoint, Dropbox, Box, iCloud, and Google, and includes a detection threshold to minimize alerts for incidental traffic.
This rule detects established TLS connections to external hosts that utilize a specific self-signed certificate associated with TA419 phishing infrastructure. The rule specifically flags connections presenting a TLS certificate with Subject and Issuer fields containing 'C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI'.
This rule detects established TLS connections to external hosts that utilize a specific self-signed certificate associated with TA419 phishing infrastructure. The rule specifically flags connections presenting a TLS certificate with Subject and Issuer fields containing 'C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI'.
This rule detects established TLS connections to external hosts that utilize a specific self-signed certificate associated with TA419 phishing infrastructure. The rule specifically flags connections presenting a TLS certificate with Subject and Issuer fields containing 'C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI'.
This rule detects established TLS connections to external hosts that utilize a specific self-signed certificate associated with TA419 phishing infrastructure. The rule specifically flags connections presenting a TLS certificate with Subject and Issuer fields containing 'C=US, ST=Kansas, L=Millsstad, O=Castro Inc, CN=CI'.
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
Detects outbound HTTP requests or TLS traffic to known C2 domains associated with APT28/UAC-0001 related to the CVE-2026-21509 campaign.
Detects unauthenticated HTTP POST requests to the /prompt endpoint of a ComfyUI instance, which is indicative of an attempt to remotely execute workflows on an exposed instance.
Detects inbound HTTP POST requests to the /generate endpoint of a Hugging Face Text Generation Inference (TGI) server. Such requests indicate attempts to use or interact with the inference API, potentially without authentication, which could lead to unauthorized resource utilization or model interaction if the service is not properly secured.
This rule detects external reconnaissance attempts targeting MLflow Tracking Servers by monitoring for inbound HTTP GET requests to the default MLflow API path '/api/2.0/mlflow/'. This behavior is indicative of an adversary scanning for exposed machine learning infrastructure, potentially to facilitate subsequent unauthorized access or exploitation of the tracking server.
Detects outbound HTTP traffic from internal hosts directed toward a known IP address identified as hosting AdaptixC2 infrastructure, specifically associated with the distribution of a trojanized 'mscopilot.exe' executable.
This rule detects established TLS connections to external domains that exhibit characteristics often associated with phishing campaigns. Specifically, it looks for domain names in the SNI field that contain common brand names (e.g., microsoft, google, paypal) combined with typical login-related keywords (e.g., login, verify, auth) on high-churn or suspicious Top-Level Domains (TLDs) such as .top, .xyz, or .icu.
Detects network traffic associated with Adversary-in-the-Middle (AiTM) phishing kits that impersonate Microsoft and Google login pages. The rules identify the presence of specific HTML elements (like Cloudflare Turnstile anti-bot gates) and authentication session cookie headers served from non-authorized/non-official domains, indicating a reverse-proxy phishing attack.
Page 9 of 124