Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,443
11,831
5,875
5,151
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
This rule detects Windows Admin Center (WAC) creating a listening connection on its default port (6516) on internet-facing devices, specifically when the WAC version is not '2.6.4'. This could indicate an unpatched or vulnerable version of WAC exposed to the internet, potentially making it susceptible to exploitation.
Detects the exploitation of the WinRAR path traversal vulnerability (CVE-2025-8088) where a compression utility process creates script or shortcut files in the Windows Startup folder for persistence. This technique has been observed in use by the Amaranth-Dragon threat actor.
Detects successful POST requests to better-auth API key creation or update endpoints that appear to be unauthenticated. This pattern is indicative of exploitation of CVE-2025-61928, where an attacker can create or modify API keys for any user without a valid session.
Detects potential reverse shell activity originating from a Grandstream VoIP device. This is a high-fidelity indicator of compromise following the successful exploitation of CVE-2026-2329. This version uses DeviceNetworkEvents.
Detects exploitation attempts of CVE-2026-22769 by identifying PUT requests directed at the Tomcat Manager application deployment endpoint. This is used by UNC6201 to deploy malicious WAR files containing the SLAYSTYLE webshell.
Detects suspicious web requests to the Tomcat Manager on Dell RecoverPoint appliances. This technique is used by UNC6201 to exploit CVE-2026-22769 and upload malicious WAR files.
Detects suspicious child processes (e.g., shells, network utilities) spawned by the Ivanti EPMM web server process (java, tomcat, httpd). This behavior is a strong indicator of successful remote code execution, often following the exploitation of vulnerabilities like CVE-2026-1281 and CVE-2026-1340.
This query detects multiple patterns of post-exploitation activity related to SolarWinds WebHelpDesk (WHD) vulnerabilities. It first identifies devices where suspicious commands are executed from the WHD directory, and then retrieves all related suspicious activities from those devices. The detection logic includes identifying suspicious child processes spawned by the WHD java service, suspicious command execution from the WHD directory, and suspicious child processes of ToolsIQ.exe, a component known to be abused in WHD exploits.
This rule detects attempts to exploit Ivanti EPMM vulnerabilities CVE-2025-4427 and CVE-2025-4428. The first signature identifies requests to the '/api/v2/featureusage' endpoint containing patterns indicative of remote code execution (e.g., '${', 'Runtime', 'getRuntime', 'exec'). The second signature detects requests for a '.jsp' file named '403', which could indicate a backdoor or web shell deployment post-exploitation.
Detects HTTP GET requests to Ivanti EPMM endpoints containing the 'gPath' parameter, which is indicative of exploitation attempts against CVE-2026-1281 and CVE-2026-1340.
Detects files associated with the Cl0p ransomware group's exploitation of the Oracle E-Business Suite vulnerability (CVE-2025-61882).
Sleeper-style JSP backdoor: 403.jsp or similar with Runtime.getRuntime().exec or ProcessBuilder
Detects potential exploitation attempts against a buffer overflow vulnerability (CVE-2026-2329) in Grandstream VoIP phones. This rule identifies web requests targeting the vulnerable API endpoint '/cgi-bin/api.values.get' with an overly long query string (>64 bytes) or the use of multiple colons (>=3) which could indicate a ROP chain attempt. The detection is based on DeviceNetworkEvents from Microsoft Defender for Endpoint.
Detects a potential attempt to downgrade a password manager client's encryption to a legacy, non-authenticated mode (e.g., AES-CBC). A malicious or compromised server can send a specially crafted response during login or synchronization that forces the client to use weaker cryptography. This can compromise the integrity and confidentiality of the user's vault, enabling further attacks like vault modification or padding oracles.
This rule identifies command-line arguments that contain both a Markdown (.md) file extension and a suspicious URI scheme. This pattern is indicative of an attempt to exploit vulnerabilities, such as CVE-2026-20841, where specially crafted files are opened via the command line to trigger malicious links or actions through specific URI handlers.
Detects when fodhelper.exe, a legitimate Windows utility, is used to spawn processes other than cmd.exe or conhost.exe. This behavior is commonly associated with UAC bypass techniques where fodhelper.exe is abused to execute arbitrary commands with elevated privileges without a UAC prompt.
Detects exploitation of CVE-2026-25157 where the OpenClaw AI agent is manipulated to execute arbitrary commands via a malicious SSH target string. The vulnerability allows an attacker to inject command-line options like '-oProxyCommand' into the SSH client, leading to local command execution.
Detects instances where the Windows 11 Notepad process (Notepad.exe) spawns unexpected child processes. This behavior is a primary indicator of the CVE-2026-20841 exploitation via malicious Markdown links, which allows for remote code execution.
Detects Notepad.exe initiating outbound network connections, specifically over SMB (port 445) or to public IP addresses over HTTP/S. This behavior is highly anomalous and can indicate an attempt to exploit CVE-2026-20841 to trigger an NTLM relay attack for credential harvesting or to download a remote payload.
This rule detects potential exploitation attempts targeting Ivanti EPMM vulnerabilities (CVE-2025-4427/4428) and subsequent post-exploitation activities. It has two main parts:
1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts.
2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
1. Web Request Analysis: It identifies web requests to the `/api/v2/featureusage` endpoint that contain suspicious patterns indicative of command injection or expression language injection attempts.
2. Process Creation Analysis: It looks for unusual process creations where Java or Tomcat-related processes (`java.exe`, `javaw.exe`, `catalina.bat`, `catalina.sh`) spawn command-line interpreters (`cmd.exe`, `bash`, `sh`, `powershell.exe`) or processes whose command lines contain keywords like `sliver` or `implant`, suggesting the deployment of malicious implants or sleeper shells.
Detects exploitation of CVE-2026-24061, an authentication bypass in GNU telnetd, where the 'login' process is spawned with the '-f' flag to skip authentication and gain root access.
Page 118 of 159