Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,443
11,831
5,875
5,151
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
Detects attempts to exploit a path traversal vulnerability (CVE-2025-64446) in FortiWeb. Attackers send a crafted POST request to create a new administrative user by targeting a specific URI and including keywords in the request body indicative of new admin creation.
Detects network traffic to domains associated with Intellexa front companies, such as Pulse Advertise and MorningStar TEC, which are linked to the 'Aladdin' zero-click infection vector. This vector abuses the digital advertising ecosystem to deliver Predator spyware.
Detects HTTP requests targeting the Oracle Identity Manager REST API that contain known authentication bypass suffixes, such as `?WSDL` or `;.wadl`. This indicates an attempt to exploit the initial authentication bypass stage of the CVE-2025-61757 exploit chain.
Detects unique strings associated with the JSKit iOS exploitation framework in network traffic. This framework is used by multiple threat actors, including the commercial surveillance vendor Intellexa, to deliver spyware like Predator.
Detects the creation of a project-local OpenAI Codex configuration file (`.codex/config.toml`) followed by the execution of the `codex` CLI from the same directory. This pattern is indicative of an attempt to exploit CVE-2025-61260, a command injection vulnerability that allows for arbitrary code execution.
Detects the ToolShell exploit chain used against SharePoint servers. This exploit involves a POST request to ToolPane.aspx with a spoofed Referer header pointing to SignOut.aspx, which is a key indicator of this specific attack.
This rule detects web requests targeting SharePoint endpoints associated with the ToolShell exploit chain (CVE-2025-49704, CVE-2025-49706, CVE-2025-53770, CVE-2025-53771). This activity is linked to the threat actor CL-CRI-1040 (also known as Storm-2603). The rule specifically looks for requests to "/_layouts/15/ToolPane.aspx" or "/_layouts/15/SignOut.aspx" that also contain suspicious strings indicative of command execution or file manipulation attempts, such as "cmd.exe", "powershell", "whoami", "ipconfig", "systeminfo", "&cmd=", or "&file=".
Detects Remote Procedure Call (RPC) authentication coercion attempts where a machine is forced to authenticate to an external IP address. Attackers use this technique to capture credentials by tricking a server into connecting to a listener they control. This rule identifies known vulnerable RPC interfaces and functions (including rare ones like MS-EVEN/ElfrOpenBELW) being used with a UNC path parameter that points to a public IP address.
Detects HTTP requests attempting to exploit several IoT device vulnerabilities leveraged by the ShadowV2 botnet to spread. This rule looks for specific URI paths and command injection payloads associated with known CVEs.
Detects potential command injection attempts against Citrix NetScaler ADC and Gateway devices. This detection is based on the patterns described in a hypothetical proof-of-concept for CVE-2025-7775, which involves injecting shell commands and referencing sensitive system paths in HTTP requests.
Detects exploitation attempts targeting a code injection vulnerability in XWiki's SolrSearch macro (CVE-2025-24893). Attackers can inject malicious Groovy code through specially crafted requests to the SolrSearch endpoint, leading to unauthenticated remote code execution.
Detects a sequence of file operations indicative of CLFS Base Log File (.blf) tampering, a technique used in CVE-2024-49138 exploitation. The detection looks for a process writing to a .blf file, immediately followed by a read of the same file, which is an unusual pattern as regular applications use CLFS APIs, not direct file writes.
Detects the RedTail cryptominer targeting exposed Docker APIs by looking for specific HTTP request patterns, including the 'libredtail-http' user agent and 'docker.selfrep' parameter in the request body.
This rule detects a high rate of ICMP echo requests from a single source to a server within the home network, indicating a potential Denial of Service (DoS) attack. It triggers an alert if more than 50 ICMP echo requests are observed from the same source within a 1-second interval.
Detects attempts to load unsigned kernel extensions, which may indicate rootkit installation or malicious kernel-level access. All legitimate kernel extensions should be signed with a developer ID.
Detects the crash of lsass.exe caused by WLDAP32.dll, which is a strong indicator of exploitation of the LDAPNightmare vulnerability (CVE-2024-49113). This exploit causes a denial of service on unpatched Windows Servers.
Detects potential DLL sideloading activity associated with Cephalus ransomware, where a legitimate SentinelOne executable is launched from a non-standard path and loads a malicious DLL.
Detects attempts to exploit the Triofox authentication bypass vulnerability (CVE-2025-12480) by sending a request with a 'localhost' Host header from an external IP address to access administrative pages. This allows an attacker to create a new administrative account.
This rule detects inbound network traffic attempting to exploit a path traversal vulnerability (CVE-2025-8088) related to RAR files and Alternate Data Streams (ADS). The detection logic specifically looks for a pattern indicative of path traversal attempts within the RAR file structure over raw TCP connections, excluding HTTP traffic. This exploit could allow an attacker to write files to arbitrary locations on a compromised system.
SQL Database Version Discovery
Suricata
This rule detects attempts to discover the version of a SQL database, often a precursor to SQL injection attacks or other reconnaissance activities. It specifically looks for SQL queries containing keywords like 'select' and 'version' in various common formats used to retrieve database version information.
Detects the ClickOnce service (dfsvc.exe) DLL sideloading an unsigned DLL from the ClickOnce application cache directory. This behavior is indicative of a malicious ClickOnce deployment, a technique used for initial access and code execution as seen in 'OneClik' and 'SesameOp' campaigns.
Page 123 of 159