Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,438
11,829
5,872
5,150
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
Experimental CommonSecurityLog template for sensor-reported attempts associated with Cisco advisory cisco-sa-ise-rce-se7bYU57: CVE-2026-20307, CVE-2026-20176 and CVE-2026-20211. Cisco links Snort SIDs 67114, 67115, 67116 and 67130-67132. Configure exact exporter event IDs, sensor vendor/product and confirmed ISE management IPs. A match does not prove successful exploitation or root compromise.
This rule detects an exploitation attempt targeting a memory overflow vulnerability in Citrix NetScaler Gateway, specifically identifying oversized DTLS handshake length fields in UDP traffic. The rule triggers when a DTLS packet exceeds the specified size threshold, which is indicative of a buffer overflow attack intended to cause a service crash (Denial of Service).
Detects suspicious HTTP requests directed at SharePoint applications containing a malformed Register directive. The rule identifies attempts to leverage the 'publishingribbon' Tagprefix combined with unauthorized namespaces (e.g., System.Xaml, System.Windows.Data) to bypass the EditingPageParser.InitializeRegisterTable safelist check, a common technique for SharePoint remote code execution.
This rule detects unauthorized process creation from the SharePoint worker process (w3wp.exe). It specifically monitors for the spawning of command-line shells or scripting engines, which is indicative of exploitation activity such as remote code execution (RCE) attempts against SharePoint services, including deserialization attacks.
This rule detects unauthorized process creation from the SharePoint worker process (w3wp.exe). It specifically monitors for the spawning of command-line shells or scripting engines, which is indicative of exploitation activity such as remote code execution (RCE) attempts against SharePoint services, including deserialization attacks.
Detects an exploitation chain originating from a Chrome browser process, characterized by the execution of an anomalous child process followed by the creation of an executable file named 'chrome_cleanup.exe' within a short time window. This sequence is indicative of multi-stage exploitation, involving remote code execution via browser vulnerability and subsequent privilege escalation.
Detects high-frequency web requests from a single source IP containing URI patterns associated with known vulnerability exploits (e.g., directory traversal, remote code execution, or path injection). This rule identifies potential mass exploitation attempts against public-facing web applications by monitoring firewall logs for a threshold of suspicious URI activity.
Detects web requests targeting common LLM/AI inference API endpoints containing strings indicative of prompt injection attempts, such as attempts to bypass filters, exfiltrate system instructions, or force model behavior changes (e.g., DAN mode).
Detects web requests targeting sensitive Jenkins/CI-CD administrative and build-triggering endpoints, such as /script, /manage, and /job/*/build. These paths are high-value targets for reconnaissance and automated exploitation efforts. This rule identifies potentially malicious activity by monitoring for access to these specific paths, which should be correlated with frequency and source data to differentiate automated scanning from authorized administrative or system activities.
Detects unauthenticated POST requests to the TorchServe Management API '/models' endpoint containing a 'url=' parameter. This pattern is indicative of an attempt to perform remote model registration, which could be leveraged for Remote Code Execution (RCE) on the server hosting the TorchServe service.
Detects a suspicious sequence of events where a known web server process (e.g., IIS, Nginx, Apache) spawns a command shell process, followed shortly by the creation of a file with a web shell-like extension (.aspx, .jsp, .php) in the same environment. This pattern is indicative of an adversary exploiting a public-facing application to upload and potentially access a web shell.
This rule detects POST requests to the '/v2/repository/index' endpoint of a Triton Inference Server. This endpoint is part of the Model Repository control API and is typically used to manage or inspect models. Unauthorized access to this API can be indicative of reconnaissance or exploitation attempts against the inference server.
This rule detects unauthorized and unauthenticated attempts to access the Ray Dashboard API '/api/jobs' endpoint. An absence of an Authorization header in these requests indicates potential reconnaissance or exploitation attempts against an exposed Ray cluster management interface.
Detects multiple inbound HTTP requests targeting known vulnerable application paths (e.g., cgi-bin, .env files, actuator gateways, path traversal, WordPress plugins, PHP eval files, and various server administration consoles) from a single source within a short timeframe. This behavior is indicative of an automated scanner or exploit chain attempting to identify and compromise public-facing applications.
Detects unauthenticated HTTP POST requests targeting the '/v1/graphql' endpoint of a Weaviate vector database. This pattern is indicative of reconnaissance or exploitation attempts against exposed Weaviate API instances.
This rule detects potentially malicious POST requests to SharePoint endpoints (such as AddGallery.aspx) that include indicators of WebPartMarkup or ToolPane payloads. This activity attempts to bypass the SPUtility.EnsureAuthentication() check that is typically enforced on the ToolPane.aspx page, potentially allowing unauthorized code execution or configuration manipulation.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects exploitation attempts against CVE-2026-55040 on Microsoft SharePoint Server. This vulnerability allows an attacker to bypass authentication by sending a malformed JSON Web Token (JWT) with an 'alg: none' header or an empty signature. The SharePoint server incorrectly trusts the provided token, enabling unauthorized access to sensitive API and SOAP endpoints.
This rule detects attempts to exploit CVE-2026-5027 in Langflow by identifying path traversal sequences (such as '../', '..\', or absolute paths) within the query parameters of requests directed to the '/api/v2/files' endpoint.
Detects network exploitation attempts targeting CVE-2026-82329 in JFrog Artifactory. The rule identifies path traversal, malicious Java deserialization payloads, and unauthorized access attempts to sensitive administrative API endpoints.
Page 11 of 159