Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,733 detections
Filters
Last updated
All Time
Detection languages
909
387
164
127
68
Contributors
479
417
201
177
61
Categories
20,440
11,814
5,871
5,145
4,864
1,733
Platforms
822
436
329
274
206
Products / Services
498
378
118
96
79
MITRE Techniques
433
327
225
196
196
CVEs
12
12
10
10
6
IDS Classtypes
1
1
IDS Protocols
2
Detects file being transferred via ScreenConnect RMM
Detects command execution via ScreenConnect RMM
This rule detects suspicious error messages generated by various SQL database systems (Oracle, MySQL, SQL Server, SQLite) that are indicative of an attempted SQL injection attack. The rule looks for specific syntax error messages that are commonly returned when an attacker probes for SQL injection vulnerabilities.
Detects when a stored procedure in MSSQL is configured for automatic execution upon SQL Server startup using `sp_procoption`. This can be used by adversaries to establish persistence.
Detects potential OGNL Injection exploitation attempts in JVM-based applications, which could lead to Remote Code Execution (RCE). This rule specifically looks for error messages indicating OGNL parsing failures, such as 'org.apache.commons.ognl.OgnlException' or 'ExpressionSyntaxException', which are common indicators when an attacker attempts to inject malicious OGNL expressions. This type of vulnerability has been exploited in high-profile cases like Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134).
Detects the deletion of a backup catalog on Windows systems. This action can be performed by adversaries to inhibit system recovery, making it harder to restore systems after an attack, such as a ransomware incident.
Detects exceptions in the Velocity template renderer, which likely indicates dynamic rendering of user-controlled input. This vulnerability, known as Server-Side Template Injection (SSTI), can lead to Remote Code Execution (RCE) if successfully exploited.
This rule detects when an application or file is prevented from running by AppLocker. It specifically looks for AppLocker event IDs 8004, 8007, 8022, and 8025, which indicate that an executable, script, or other file type was blocked from execution based on configured AppLocker policies. This is a critical control for preventing unauthorized software execution, especially in environments where users might attempt to run unapproved applications or scripts.
Detects errors in NodeJS applications related to process execution, specifically looking for the keyword 'node:child_process'. These errors, especially if triggered by user input, may indicate an attempted Remote Code Execution (RCE) vulnerability exploitation.
This rule identifies when an application is deleted in Azure. This could indicate an attempt by an adversary to remove traces of their activity, disrupt services, or impact the availability of applications.
Detects events generated by user-mode applications when they call the CveEventWrite API, indicating that a known vulnerability is potentially being exploited. Microsoft started using this log in January 2020, notably with CVE-2020-0601 (a Windows CryptoAPI vulnerability). However, the rule's description notes that this log has historically seen limited use for reporting CVEs.
Detects the installation of suspicious applications by monitoring the Windows Shell-Core event log for EventID 28115, which indicates a shortcut being added to the app resolver cache. The rule specifically looks for known suspicious application names like Zenmap, AnyDesk, Wireshark, and OpenVPN in the 'Name' or 'AppID' fields.
Detects process execution related exceptions in JVM based applications, which can often indicate Remote Code Execution (RCE) attempts. The rule specifically looks for keywords like 'Cannot run program', 'java.lang.ProcessImpl', and 'java.lang.ProcessBuilder' in application error logs.
This rule detects the creation or modification of AppX packages in suspicious file system locations. Adversaries may place malicious AppX packages in common temporary or public directories to evade detection or achieve persistence. The rule specifically looks for Event ID 854 from the 'appxdeployment-server' service, indicating an AppX package being added to the processing pipeline, and checks if the package's path contains known suspicious locations such as public user directories, temporary folders, or desktop/downloads folders.
This rule detects potential local file read vulnerabilities in JVM-based applications by looking for specific keywords in application error logs. It triggers when a 'FileNotFoundException' occurs in conjunction with path traversal payloads like '/../../..'. This combination suggests an attacker is attempting to read arbitrary files from the system by manipulating input paths, which could lead to sensitive information disclosure.
Detects potential XML External Entity (XXE) exploitation attempts in JVM-based applications by looking for specific XML parsing error keywords in application error logs. These errors, such as 'SAXParseException' and 'DOMException', can indicate that an attacker is trying to manipulate XML input to access local files, perform server-side request forgery (SSRF), or execute other malicious actions. The rule is designed to identify issues where an application expects to work with XML and the parser might not be initialized safely.
This rule detects the installation of Microsoft Installer (MSI) packages from suspicious file system locations. It specifically looks for MsiInstaller events (Event IDs 1040 and 1042) where the installation source path contains known suspicious directories such as Windows temporary folders, remote shares (indicated by '\\'), Desktop, PerfLogs, or Public user folders. The rule includes filters to reduce false positives from legitimate applications like WinGet or specific update health tools.
Detects when the deployment of an AppX package is blocked by an AppLocker policy. This indicates an attempt to install or run an unauthorized application package, which could be a defense evasion attempt or an attempt to introduce malicious software.
This rule detects various suspicious exceptions within Django web applications. These exceptions, such as 'SuspiciousOperation' and its subclasses (e.g., 'DisallowedHost', 'InvalidSessionKey', 'RequestDataTooBig'), as well as 'PermissionDenied', often indicate attempts to exploit vulnerabilities, bypass security controls, or engage in other malicious activities against the web application. Monitoring these exceptions can help identify potential attacks like web parameter tampering, session hijacking attempts, or unauthorized access attempts.
This rule detects potential JNDI (Java Naming and Directory Interface) injection exploitation attempts within JVM-based applications. It specifically looks for keywords related to LDAP lookups ('com.sun.jndi.ldap.') and the Log4j JndiManager ('org.apache.logging.log4j.core.net.JndiManager') in application error logs. Such patterns are commonly associated with vulnerabilities like Log4Shell, where attackers inject malicious JNDI lookup strings to achieve remote code execution.
Detects suspicious Ruby on Rails exceptions that could indicate exploitation attempts. These exceptions often occur when an attacker is probing a web application for vulnerabilities or attempting to bypass security controls like CSRF tokens, or sending malformed requests.
Page 80 of 83