Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,443
11,831
5,875
5,151
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
This rule detects suspicious WebAssembly (WASM) code in HTTP responses that indicates the allocation of Read-Write-Execute (RWX) memory pages. This pattern is a common precursor to shellcode execution within a web browser, often used by exploit kits or malicious websites to achieve arbitrary code execution. The rule specifically looks for JavaScript code that initializes a WebAssembly module with a byte array containing specific patterns indicative of RWX memory allocation, followed by instantiation and export calls.
ET WEB_SPECIFIC_APPS Monsta FTP Arbitrary File Upload Attempt (CVE-2025-34299)
ET WEB_SPECIFIC_APPS Adobe Coldfusion BlazeDS Java Object Deserialization Remote Code Execution (CVE-2017-3066)
ET WEB_SPECIFIC_APPS Tenda DatabaseiniSet Time Parameter Buffer Overflow Attempt (CVE-2025-12618)
ET WEB_SPECIFIC_APPS IPFire proxy.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34318)
ET WEB_SPECIFIC_APPS IPFire config.dat REMOTELOG_ADDR Parameter Cross Site Scripting Attempt (CVE-2025-34315)
ET WEB_SPECIFIC_APPS IPFire urlfilter.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34314)
ET WEB_SPECIFIC_APPS IPFire calamaris.dat Multiple Parameters Command Injection Attempt (CVE-2025-34311)
ET WEB_SPECIFIC_APPS IPFire ddns.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34309)
ET WEB_SPECIFIC_APPS IPFire firewalllogip.dat pienumber Parameter Cross Site Scripting Attempt (CVE-2025-34306)
ET WEB_SPECIFIC_APPS IPFire dns.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305)
ET WEB_SPECIFIC_APPS IPFire vpnmain.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305)
ET WEB_SPECIFIC_APPS IPFire connscheduler.cgi ACTION_COMMENT Parameter Cross Site Scripting Attempt (CVE-2025-34305)
ET WEB_SPECIFIC_APPS IPFire dhcp.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34305)
ET WEB_SPECIFIC_APPS IPFire fwhosts.cgi PROT Parameter Cross Site Scripting Attempt (CVE-2025-34302)
ET WEB_SPECIFIC_APPS Tenda RouteStatic page Parameter Buffer Overflow Attempt (CVE-2025-12271)
ET WEB_SPECIFIC_APPS Adobe Commerce & Magento SessionReaper Unauthenticated Remote Code Execution (CVE-2025-54236)
ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (dotauan .pro)
This rule detects attempts to exploit the Zip Slip vulnerability by identifying the sequence '../' within a ZIP archive being uploaded to a server. This pattern indicates an attempt to write files outside the intended directory, potentially leading to arbitrary file overwrite or remote code execution.
ET WEB_SPECIFIC_APPS Adobe ColdFusion Access Control Bypass (CVE-2023-38205)
ET WEB_SPECIFIC_APPS Wavlink login.cgi pagelogin Parameter Buffer Overflow Attempt (CVE-2025-61128)
Page 126 of 159