Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,443
11,831
5,875
5,151
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Detects the creation of suspicious files (e.g., web shells, executables) by a Node.js or Next.js server process. This activity is a common post-exploitation step after a successful RCE, such as from exploiting CVE-2025-55182 (React2Shell), where an attacker drops a backdoor for persistence.
Detects the setup for a Time-of-Check-to-Time-of-Use (TOCTOU) attack exploiting CVE-2025-64669 in Windows Admin Center. An attacker uses PowerShell with Register-WmiEvent to monitor for the WAC updater process, intending to perform a DLL hijack for privilege escalation.
Detects potential exploitation of Oracle E-Business Suite vulnerability CVE-2025-61882, which allows for unauthenticated remote code execution. This rule looks for specific web request URIs, post-exploitation process activity, and known indicators of compromise (IOCs).
Detects exploitation of a remote code execution vulnerability (CVE-2025-61882) in Oracle E-Business Suite. The attack involves an authentication bypass followed by the upload and execution of a malicious XSLT template, leading to command execution and potential web shell deployment.
Detects multiple large POST requests to Next.js or React Server Component (RSC) endpoints from the same source IP. This pattern can indicate attempts to exploit unsafe deserialization vulnerabilities like React2Shell (CVE-2025-55182) by sending a crafted, oversized payload.
Detects AWS IAM roles whose trust policies were newly created or updated to allow cross account AWS principals to assume the role without any confused deputy protections in place.
Detects privilege escalation attempts used by the Shai-Hulud malware. This includes checking for passwordless sudo ('sudo -n true') and exploiting Docker to modify the 'sudoers.d' file to grant root privileges.
Detects potential exploitation attempts against Next.js applications vulnerable to CVE-2025-66478 (React2shell). The rule looks for POST requests to Next.js Server Action endpoints with an unusually large request body, which may indicate a malicious payload designed to trigger a deserialization RCE.
Detects attempts to exploit CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) by identifying Prototype Pollution vectors (__proto__, constructor) specifically targeting the React Flight protocol (RSC headers/params). Covers both clear-text and common JSON escape sequences. The rule also correlates with 500 errors to identify potential successful exploitation or blind probing attempts.
Detects attempts to exploit CVE-2025-55182 (Next.js/React) via Server Actions. Target is identified by the 'Next-Action' header or 'RSC' markers, combined with JSON prototype pollution vectors in the body.
Detects attempts to exploit CVE-2025-55182 (React) and CVE-2025-66478 (Next.js) utilizing data from the Imperva WAF leveraging vm#, child_process#, util_#, & fs_# indicators.
Detects potential exploitation attempts against Next.js applications vulnerable to CVE-2025-66478 (React2shell). The rule looks for POST requests to Next.js Server Action endpoints with an unusually large request body, which may indicate a malicious payload designed to trigger a deserialization RCE.
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
This rule detects a possible Remote Code Execution (RCE) attempt targeting a React application, specifically exploiting CVE-2025-55182. It looks for inbound HTTP POST requests containing 'child_process' and 'response' and 'Sync' in the request body, along with specific HTTP headers ('Next-Action', 'rsc-action-id', or 'text/x-component'). The presence of 'child_process' suggests an attempt to execute system commands.
Detects the spawning of a shell process from a Node.js or Next.js server process, which is a strong indicator of post-exploitation activity following a Remote Code Execution (RCE) vulnerability like CVE-2025-55182 or CVE-2025-66478.
Detects attempts to exploit CVE-2025-55182 by injecting prototype pollution vectors ("__proto__", "constructor") into React Server Component (RSC) or Next.js Server Action requests. This vulnerability allows for Remote Code Execution via object serialization flaws.
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
DAI-SS EXPLOIT Possible React Exploit RCE Attempt Inbound (CVE-2025-55182)
Page 122 of 159