Open-source detection rules, indexed and cross-referenced.
Sigma, YARA, Suricata, Elastic, Splunk, Falco, Wazuh and more, searchable from one box. One schema across formats, every rule linked back to the file it came from.
Tracked sources
sort
- 01 Azure/Azure-Sentinel 1928
- 02 Bert-JanP/Hunting-Queries-Detection-Rules 455
- 03 chainguard-dev/osquery-defense-kit 270
- 04 chronicle/detection-rules 410
- 05 elastic/detection-rules 2220
- 06 elastic/protections-artifacts 4416
- 07 Emerging Threats Open 51696
- 08 falcosecurity/rules 96
- 09 Neo23x0/signature-base 5909
- 10 panther-labs/panther-analysis 1024
- 11 reversinglabs/reversinglabs-yara-rules 1240
- 12 SigmaHQ/sigma 3807
- 13 socfortress/Wazuh-Rules 2235
- 14 splunk/security_content 2194
- 15 Wazuh Core Ruleset 4420
Newest detections
42887 et-open hidden · include- EXPL_SignDrop_CLFS_LPE_Nov26 neo23x0-signature-base 2026-11-13
- EXPL_SignDrop_Payload_DLL_Nov26 neo23x0-signature-base 2026-11-13
- SUSP_CLFS_Auth_File_Redirect_Exploit_Nov26 neo23x0-signature-base 2026-11-13
- Windows BITS Upload Activity splunk-security-content 2026-11-10
- Process command line references a PowerShell probe-file name (possible payload hidden as __PSScriptPolicyTest_) · win.eventdata.commandLine = (?i)__PSScriptPolicyTest_ socfortress-wazuh-rules 2026-11-07
- Sysmon config reload failed at step '' · rule 200640 socfortress-wazuh-rules 2026-11-07
- Sysmon config reload warning at step '' · rule 200641 socfortress-wazuh-rules 2026-11-07
- Sysmon configuration changed: (hash ) · win.system.eventID = 16 socfortress-wazuh-rules 2026-11-07
- Sysmon fatal error () · win.system.eventID = 255, win.eventdata.description = Exit process|Failed to allocate socfortress-wazuh-rules 2026-11-07
- Sysmon lost events (driver queue full). · win.system.eventID = 255, win.eventdata.iD = QUEUE socfortress-wazuh-rules 2026-11-07
- Sysmon lost process telemetry (driver queue full). · win.system.eventID = 255, win.eventdata.iD = QUEUE socfortress-wazuh-rules 2026-11-07
- Sysmon service entered the stopped state · win.system.providerName = Service Control Manager, win.system.eventID = 7036 socfortress-wazuh-rules 2026-11-07
- Sysmon service state changed to Stopped (Sysmon ) · win.eventdata.state = Stopped socfortress-wazuh-rules 2026-11-07
- Sysmon service terminated unexpectedly (System event , crash count ). Endpoint telemetry is blind until it restarts. · win.system.providerName = Service Control Manager, win.system.eventID = 7031$|^7034 socfortress-wazuh-rules 2026-11-07
- Sysmon watchdog alive; Sysmon still · sysmon_watchdog.heartbeat_due = true socfortress-wazuh-rules 2026-11-07
Most-covered techniques
top 20One technique, every rule mapped to it, grouped by source.
T1190
Exploit Public-Facing Application
6712
T1568
Dynamic Resolution
5971
T1566
Phishing
1867
T1059
Command and Scripting Interpreter
1504
T1071
Application Layer Protocol
1120
T1027
Obfuscated Files or Information
906
T1078
Valid Accounts
774
T1041
Exfiltration Over C2 Channel
733
T1218
System Binary Proxy Execution
638
T1562
Impair Defenses
554
T1098
Account Manipulation
551
T1059.001
Command and Scripting Interpreter: PowerShell
535
T1105
Ingress Tool Transfer
443
T1003
OS Credential Dumping
378
T1685
Disable or Modify Tools
366
T1059.004
Command and Scripting Interpreter: Unix Shell
364
T1548
Abuse Elevation Control Mechanism
363
T1055
Process Injection
361
T1021
Remote Services
359
T1110
Brute Force
337
Most-covered CVEs
top 12Ranked by how many sources cover the CVE, not how many rules mention it.
CVE-2025-59287
Windows Server Update Service (WSUS) Remote Code Execution Vulnerability
8
CVE-2024-1709
Authentication bypass using an alternate path or channel
24
CVE-2024-1708
Improper limitation of a pathname to a restricted directory (“path traversal”)
19
CVE-2025-55182
A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and…
16
CVE-2022-22965
A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding.
14
CVE-2025-31324
Missing Authorization check in SAP NetWeaver (Visual Composer development server)
14
CVE-2024-3400
PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect
13
CVE-2025-53770
Microsoft SharePoint Server Remote Code Execution Vulnerability
13
CVE-2021-44228
Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints
109
CVE-2026-109618
RCE via OOM corruption
20
CVE-2026-109619
RCE via stale global state
18
CVE-2021-34527
Windows Print Spooler Remote Code Execution Vulnerability
17