Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,443
11,831
5,875
5,151
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
Detects the SolarWinds Web Help Desk service process (java.exe) launching shell or installer processes to download payloads from suspicious domains. This behavior is consistent with the exploitation of CVE-2025-26399 as reported by Huntress.
Detects potential exploitation of Apache bRPC command injection vulnerability (CVE-2025-60021) via the /pprof/heap endpoint.
Detects a behavioral pattern associated with CastleLoader's anti-analysis technique, where a process initiates a DNS query that fails (NXDOMAIN) and is immediately followed by a successful network connection to a different destination. This can indicate an attempt to check for sandboxing or sinkholing environments.
This rule detects Office applications (Word, Excel, PowerPoint) or Windows Explorer making outbound WebDAV connections to external, non-private IP addresses on standard web ports (80, 443). This behavior is associated with exploitation of vulnerabilities like CVE-2026-21509, potentially by threat actors such as APT28, to force authentication or exfiltrate data.
This rule detects suspicious child processes spawned by 'WsusService.exe', which is indicative of successful exploitation of a vulnerability like CVE-2025-59287. The rule specifically looks for the WSUS service initiating common command-line utilities such as cmd.exe, powershell.exe, curl.exe, wget.exe, certutil.exe, bitsadmin.exe, and msiexec.exe, which are often used for post-exploitation activities like command execution, downloading additional payloads, or system manipulation. The severity is dynamically assigned based on the spawned process, with download utilities like curl.exe, certutil.exe, and bitsadmin.exe being flagged as 'Critical'.
This rule set detects potential post-exploitation activity and exploitation attempts targeting Ivanti EPMM (formerly MobileIron Core). The first rule, `ivanti_epmm_java_spawns_shell`, identifies suspicious process creation where a Java or Tomcat process (parent process) spawns a shell process (cmd.exe, bash, sh, or powershell.exe). This behavior is indicative of an attacker gaining remote code execution and using the compromised Java/Tomcat process to execute system commands. The second rule, `ivanti_epmm_http_featureusage_exploit`, detects HTTP requests to the `/api/v2/featureusage` endpoint that contain parameters indicative of Expression Language (EL) injection or format string abuse, specifically looking for `format=` along with keywords like `${`, `Runtime`, `exec`, or `getRuntime` in the URL. This suggests an attempt to exploit a vulnerability in the Ivanti EPMM application to achieve remote code execution.
Detects network traffic on TCP port 18789, the default gateway port for OpenClaw. Monitoring for unauthorized external access to this port helps identify exposed admin dashboards or exploitation.
Detects HTTP requests containing the specific parameter 'k0f53cf964d387' in the query string or POST body. This parameter is the unique trigger used to activate the dormant 'base.Info' in-memory loader on vulnerable Ivanti EPMM instances.
Detects attempts to deliver a Base64-encoded Java class to an Ivanti EPMM
server. This is characteristic of the "Sleeper Shell" campaign where attackers
plant a dormant in-memory backdoor. The rule looks for the Base64 string
'yv66vg', which corresponds to the 'CAFEBABE' Java magic bytes, in requests
targeting the known vulnerable path.
server. This is characteristic of the "Sleeper Shell" campaign where attackers
plant a dormant in-memory backdoor. The rule looks for the Base64 string
'yv66vg', which corresponds to the 'CAFEBABE' Java magic bytes, in requests
targeting the known vulnerable path.
This detection monitors for web requests to the specific URI path "/mifs/403.jsp". This path is known to be used by attackers to deploy a dormant Java-based webshell ("sleeper shell") on vulnerable Ivanti Endpoint Manager Mobile (EPMM) instances as part of an initial access campaign.
Detects the creation of a symbolic link or junction point by a non-elevated process where the target is a critical system file or directory. This is a key step in exploits like CVE-2025-0921, where a privileged process is tricked into writing to a sensitive location by following a malicious link.
Detects potential exploitation of CVE-2026-25253, a 1-click RCE in OpenClaw, by identifying the 'gatewayUrl' query parameter in HTTP traffic. This parameter is used to hijack authentication tokens.
Detects HTTP POST requests to n8n webhook endpoints containing patterns associated with CVE-2026-25049, a type confusion vulnerability leading to Remote Code Execution. The detection looks for specific JavaScript destructuring or property access patterns used to bypass sanitization.
This query utilizes the IOCs provided by Rapid7 and focuses on columns in the DeviceFileEvents, DeviceProcessEvents and DeviceNetworkEvents tables. This is a high FP query, however each event will require an investigation to its legitimacy. The query accounts for all devices that have installed notepad++ in the past 400d and only looking for IOCs within time of known compromise in order to save on resources. Some IOCs are commented out due to high FP rate.
Detects the loading of specific DLLs from AppData paths associated with the Notepad++ supply chain attack. This activity is related to DLL sideloading and Lua script execution techniques used by the threat actor. Sysmon EVID 7 is critical for detecting the library load.
Detects DNS lookups to known Out-of-Band Application Security Testing (OAST) domains. These are often used by attackers to verify successful exploitation of vulnerabilities like SSRF or RCE.
This detection identifies common web attack patterns including SQL Injection (SQLi), Cross-Site Scripting (XSS), and Local File Inclusion (LFI) by inspecting URL and POST data for specific malicious patterns. It looks for indicators such as script tags, onerror/onload attributes, javascript: URIs, alert() functions for XSS; SQL keywords like UNION SELECT, xp_cmdshell, sp_configure, and common SQLi bypass patterns for SQLi; and directory traversal sequences (../../, ..%2f..%2f), and sensitive file paths like /etc/passwd, /windows/win.ini, php://filter for LFI.
Detects attempts to exploit a vulnerability in Google Looker (CVE-2025-12743) by using error-based SQL injection within LookML dimension definitions. Attackers can use this to exfiltrate the internal Looker database.
Detects the creation or loading of the vulnerable EnCase forensic driver 'OemHwUpd.sys'. This driver is being exploited in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security products.
Detects Microsoft Office applications establishing outbound network connections to non-private, non-Microsoft IP addresses. This behavior can be indicative of exploitation of vulnerabilities like CVE-2026-21509, where an embedded OLE object or malicious macro attempts to download a payload or beacon out.
Detects execution of cryptocurrency mining software often spawned by web server processes or executed from temporary directories. This behavior is common in post-exploitation scenarios, such as those involving vulnerabilities like XWiki CVE-2025-24893, where attackers deploy miners like XMRig. Sysmon For Linux EventID 1 is the best way to detect this behavior.
Page 119 of 159