Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
159 detections
Filters
Last updated
All Time
Detection languages
91
23
18
7
7
Contributors
46
40
17
14
9
Categories
20,402
11,796
5,865
5,145
4,864
Platforms
73
63
17
16
10
Products / Services
52
41
27
26
25
MITRE Techniques
48
46
37
28
27
CVEs
11
3
3
2
1
IDS Classtypes
6
1
IDS Protocols
7
This rule monitors Syslog entries for PostgreSQL 'CREATE_REPLICATION_SLOT' commands to identify potential exploitation attempts associated with CVE-2026-6471. It detects attempts to load logical decoding plugins using suspicious path structures, including path traversal sequences ('../', '..\'), absolute paths, or UNC paths, which are not present in a known-good allowlist of plugins.
Detects suspicious behavior from database accounts with replication privileges ('rolreplication=true'). The rule monitors for logins from unauthorized IP addresses, the execution of non-replication related SQL commands by these accounts, and the use of potentially malicious plugin names (containing path traversal characters) during replication slot creation.
Detects the execution of 'OmniQuery.pl' with command-line arguments indicative of direct database queries targeting sensitive authentication data (e.g., SELECT name, auth_data FROM users). This behavior suggests unauthorized access to database credentials or user information.
Detects the initialization of PostgreSQL logical replication slots using uncommon or unrecognized output plugins. Attackers may leverage logical replication plugins to exfiltrate data from a database by streaming changes as they occur, which can be an alternative to traditional mass-export techniques.
Detects attempts to modify internal PostgreSQL system catalog tables (pg_authid or pg_proc) to grant superuser privileges or alter authorization records. This activity is commonly associated with exploiting logical decoding plugins to achieve persistence or privilege escalation in PostgreSQL environments.
Detects suspicious behavior from database accounts with replication privileges ('rolreplication=true'). The rule monitors for logins from unauthorized IP addresses, the execution of non-replication related SQL commands by these accounts, and the use of potentially malicious plugin names (containing path traversal characters) during replication slot creation.
Detects suspicious behavior from database accounts with replication privileges ('rolreplication=true'). The rule monitors for logins from unauthorized IP addresses, the execution of non-replication related SQL commands by these accounts, and the use of potentially malicious plugin names (containing path traversal characters) during replication slot creation.
This rule monitors Syslog entries for PostgreSQL 'CREATE_REPLICATION_SLOT' commands to identify potential exploitation attempts associated with CVE-2026-6471. It detects attempts to load logical decoding plugins using suspicious path structures, including path traversal sequences ('../', '..\'), absolute paths, or UNC paths, which are not present in a known-good allowlist of plugins.
Detects direct SQL UPDATE operations on the pg_authid system table to modify privilege flags (e.g., rolsuper, rolcreaterole) without using the authorized ALTER ROLE statement. Such activity often indicates an attempt to escalate privileges or modify database user permissions in an unauthorized manner, bypassing standard auditing and role management processes.
Detects direct SQL UPDATE operations on the pg_authid system table to modify privilege flags (e.g., rolsuper, rolcreaterole) without using the authorized ALTER ROLE statement. Such activity often indicates an attempt to escalate privileges or modify database user permissions in an unauthorized manner, bypassing standard auditing and role management processes.
Detects the creation of a PostgreSQL replication slot using an unrecognized or potentially malicious logical decoding plugin. Adversaries may use custom or unauthorized plugins to exfiltrate database contents or intercept replication data streams, bypassing standard monitoring for common plugins like pgoutput or test_decoding.
Detects the creation of a PostgreSQL replication slot using an unrecognized or potentially malicious logical decoding plugin. Adversaries may use custom or unauthorized plugins to exfiltrate database contents or intercept replication data streams, bypassing standard monitoring for common plugins like pgoutput or test_decoding.
Detects the initialization of PostgreSQL logical replication slots using uncommon or unrecognized output plugins. Attackers may leverage logical replication plugins to exfiltrate data from a database by streaming changes as they occur, which can be an alternative to traditional mass-export techniques.
Detects attempts to modify internal PostgreSQL system catalog tables (pg_authid or pg_proc) to grant superuser privileges or alter authorization records. This activity is commonly associated with exploiting logical decoding plugins to achieve persistence or privilege escalation in PostgreSQL environments.
This rule monitors Syslog entries for PostgreSQL 'CREATE_REPLICATION_SLOT' commands to identify potential exploitation attempts associated with CVE-2026-6471. It detects attempts to load logical decoding plugins using suspicious path structures, including path traversal sequences ('../', '..\'), absolute paths, or UNC paths, which are not present in a known-good allowlist of plugins.
Detects direct SQL UPDATE operations on the pg_authid system table to modify privilege flags (e.g., rolsuper, rolcreaterole) without using the authorized ALTER ROLE statement. Such activity often indicates an attempt to escalate privileges or modify database user permissions in an unauthorized manner, bypassing standard auditing and role management processes.
Detects the creation of a PostgreSQL replication slot using an unrecognized or potentially malicious logical decoding plugin. Adversaries may use custom or unauthorized plugins to exfiltrate database contents or intercept replication data streams, bypassing standard monitoring for common plugins like pgoutput or test_decoding.
Detects the initialization of PostgreSQL logical replication slots using uncommon or unrecognized output plugins. Attackers may leverage logical replication plugins to exfiltrate data from a database by streaming changes as they occur, which can be an alternative to traditional mass-export techniques.
Detects the initialization of PostgreSQL logical replication slots using uncommon or unrecognized output plugins. Attackers may leverage logical replication plugins to exfiltrate data from a database by streaming changes as they occur, which can be an alternative to traditional mass-export techniques.
Detects suspicious behavior from database accounts with replication privileges ('rolreplication=true'). The rule monitors for logins from unauthorized IP addresses, the execution of non-replication related SQL commands by these accounts, and the use of potentially malicious plugin names (containing path traversal characters) during replication slot creation.
Detects the execution of psql.exe to query the Veeam Backup & Replication PostgreSQL database for stored credentials. This pattern is associated with credential theft techniques utilized during ransomware operations (e.g., Bumblebee, Akira) where sensitive configuration or credential data is retrieved and potentially later decrypted via DPAPI.
Page 4 of 8