Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,443
11,831
5,875
5,151
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
Detects the complete CVE-2026-21902 exploitation chain against Juniper Junos OS Evolved On-Box Anomaly Detection Framework. Requires all four steps: command creation, DAG creation, DAG instance scheduling, and commit.
Detects attempts to perform Indirect Prompt Injection (IDPI) by embedding malicious instructions for AI agents or Large Language Models (LLMs) within web content. This rule identifies when common prompt injection keywords are present in conjunction with CSS techniques used to hide the text from being rendered in a browser, a method used to evade human review while targeting automated systems.
Detects Indirect Prompt Injection (IDPI) attempts where malicious instructions are dynamically injected into the DOM using JavaScript or concealed within HTML data attributes. Attackers use these methods to bypass static analysis tools and deliver hidden prompts to AI/LLM agents that process raw web content.
Detects HTTP POST requests to the SolarWinds Web Help Desk (WHD) AjaxProxy endpoint that contain hex-encoded JSON keys or values (e.g., `\xNN`).
Attackers use this technique to bypass security filters and achieve remote code execution, as detailed in the exploit chain for CVE-2025-40552 and CVE-2025-40553.
Attackers use this technique to bypass security filters and achieve remote code execution, as detailed in the exploit chain for CVE-2025-40552 and CVE-2025-40553.
Detects attempts to exploit the authentication bypass vulnerability (CVE-2026-29000) in the pac4j-jwt library. An attacker can craft a JWE token containing an unsigned PlainJWT, which causes the library to skip signature verification. This is often indicated by a successfully authenticated token with an 'alg' (algorithm) claim of 'none'. This detection requires application logs to be configured to record the claims of successfully authenticated JWTs.
Detects successful administrative logins ('vmanage-admin') to a Cisco SD-WAN device from an IP address not on the authorized list. This could indicate exploitation of CVE-2026-20127, an authentication bypass vulnerability.
Triofox CVE-2025-12480
Suricata
Triofox CVE-2025-12480 - localhost Host header to admin setup pages
Detects attempts to inject path traversal or SQL-like syntax into the 'kid' (Key ID) parameter of a JSON Web Token (JWT) header. This may indicate an attempt to manipulate the server's key retrieval process to force signature validation with an improper key, potentially leading to an authentication bypass.
Detects potential JSON Web Token (JWT) algorithm confusion attacks. This occurs when an attacker sends a token signed with a symmetric algorithm (e.g., HS256) to a server expecting an asymmetric one (e.g., RS256). If the server is misconfigured, it may use its public key as the HMAC secret, allowing the attacker to forge valid tokens. The rule specifically looks for JWTs with symmetric HMAC-based algorithms (HS256, HS384, HS512) being sent to applications configured to exclusively use asymmetric key algorithms.
Detects potential JSON Web Token (JWT) authentication bypass attempts where the algorithm in the token header is explicitly set to "none". A vulnerable server might skip signature validation for such tokens, allowing an attacker to forge arbitrary claims and potentially gain unauthorized access or escalate privileges.
Detects HTTP requests to the 'compcheckresult.cgi' script containing the unique parameter 'vXm8DtMJG'. This pattern is a strong indicator of the RESURGE webshell, which is injected into the CGI script on compromised Ivanti Connect Secure devices to allow for remote command execution.
This rule detects potential exploitation attempts against Grandstream GXP1600 series IP phones related to CVE-2026-2329. It specifically looks for HTTP requests to the '/cgi-bin/api.values.get' endpoint where the 'request' parameter in the URI query string has a length greater than or equal to 65 characters, which could indicate an attempt to trigger a buffer overflow or similar vulnerability.
This rule detects potential exploitation attempts against Grandstream GXP1600 series IP phones targeting CVE-2026-2329. It specifically looks for HTTP requests to the `/cgi-bin/api.values.get` endpoint where the `request` parameter in the URI query string has a length greater than or equal to 65 characters, which is indicative of an oversized request parameter often used in buffer overflow or similar vulnerabilities.
Detects a Java process spawning a command shell to download a file using the certutil.exe utility. This behavior was observed in the exploitation of Apache ActiveMQ (CVE-2023-46604), where the threat actor used this technique to download a secondary payload.
This rule detects attempts to exploit CVE-2026-2329, a critical unauthenticated stack buffer overflow vulnerability in Grandstream GXP1600 VoIP phones. The detection is based on requests to the '/cgi-bin/api.values.get' URI path, which is associated with the vulnerability.
This rule detects HTTP requests targeting the '/cgi-bin/api.values.get' endpoint with a 'request' parameter, which is indicative of exploitation attempts for CVE-2026-2329 in Grandstream GXP1600 series IP phones. This vulnerability allows for information disclosure.
This rule detects attempts to exploit CVE-2026-2329, a critical unauthenticated stack buffer overflow vulnerability in Grandstream GXP1600 series VoIP phones. The detection logic specifically looks for HTTP requests to the '/cgi-bin/api.values.get' endpoint, with a particular focus on the 'request' parameter within the query string. A request parameter with a length greater than or equal to 65 characters is indicative of a potential exploit attempt, as this length is likely to trigger the buffer overflow.
This rule detects suspicious Spring bean XML content, specifically looking for indicators related to the exploitation of Apache ActiveMQ CVE-2023-46604. It targets XML payloads that attempt to execute commands using 'ProcessBuilder' and download files via 'certutil -urlcache' from an HTTP source, consistent with observed attack patterns.
This rule detects attempts to exploit CVE-2026-2329, a critical unauthenticated stack buffer overflow vulnerability in Grandstream GXP1600 VoIP phones. The detection logic looks for HTTP requests to the vulnerable endpoint '/cgi-bin/api.values.get' and specifically for an oversized 'request' parameter where the first identifier before a colon is 65 characters or longer, indicating a likely buffer overflow attempt.
This rule detects outbound network connections from Ivanti EPMM appliances to known Out-of-Band (OOB) interaction services and tunneling platforms. This activity is often associated with automated reconnaissance and exploitation verification for vulnerabilities like CVE-2026-1281.
Detects HTTP requests to vulnerable Ivanti EPMM endpoints containing URI patterns associated with active exploitation of CVE-2026-1281 and CVE-2026-1340. The rule looks for specific URI paths and the presence of a 'gPath' parameter, which is indicative of an exploitation attempt.
Page 117 of 159