Open-source detection rules, indexed and cross-referenced.

Sigma, YARA, Suricata, Elastic, Splunk, Falco, Wazuh and more, searchable from one box. One schema across formats, every rule linked back to the file it came from.

81872 detections 15 sources 561 ATT&CK techniques

Tracked sources

sort

Newest detections

42812 et-open hidden · include

Most-covered techniques

top 20

One technique, every rule mapped to it, grouped by source.

T1190 Exploit Public-Facing Application 6667 T1568 Dynamic Resolution 5963 T1566 Phishing 1866 T1059 Command and Scripting Interpreter 1485 T1071 Application Layer Protocol 1106 T1027 Obfuscated Files or Information 901 T1078 Valid Accounts 753 T1041 Exfiltration Over C2 Channel 733 T1218 System Binary Proxy Execution 637 T1059.001 Command and Scripting Interpreter: PowerShell 530 T1562 Impair Defenses 530 T1098 Account Manipulation 525 T1105 Ingress Tool Transfer 432 T1003 OS Credential Dumping 376 T1548 Abuse Elevation Control Mechanism 362 T1685 Disable or Modify Tools 361 T1055 Process Injection 359 T1059.004 Command and Scripting Interpreter: Unix Shell 359 T1021 Remote Services 358 T1110 Brute Force 334

Most-covered CVEs

top 12

Ranked by how many sources cover the CVE, not how many rules mention it.

CVE-2025-59287 Windows Server Update Service (WSUS) Remote Code Execution Vulnerability 8 CVE-2024-1709 Authentication bypass using an alternate path or channel 24 CVE-2024-1708 Improper limitation of a pathname to a restricted directory (“path traversal”) 19 CVE-2025-55182 A pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0, 19.1.1, and 19.2.0 including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and… 16 CVE-2022-22965 A Spring MVC or Spring WebFlux application running on JDK 9+ may be vulnerable to remote code execution (RCE) via data binding. 14 CVE-2025-31324 Missing Authorization check in SAP NetWeaver (Visual Composer development server) 14 CVE-2024-3400 PAN-OS: Arbitrary File Creation Leads to OS Command Injection Vulnerability in GlobalProtect 13 CVE-2025-53770 Microsoft SharePoint Server Remote Code Execution Vulnerability 13 CVE-2021-44228 Apache Log4j2 JNDI features do not protect against attacker controlled LDAP and other JNDI related endpoints 109 CVE-2021-34527 Windows Print Spooler Remote Code Execution Vulnerability 17 CVE-2023-23397 Microsoft Outlook Elevation of Privilege Vulnerability 17 CVE-2022-30190 Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability 13

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.