Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,443
11,831
5,875
5,151
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
ET WEB_SPECIFIC_APPS Tenda openNetworkGateway wpapsk_crypto2_4g Parameter Buffer Overflow Attempt (CVE-2025-12619)
ET WEB_SPECIFIC_APPS IPFire mail.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34316)
ET WEB_SPECIFIC_APPS IPFire qos.cgi Multiple Parameters Cross Site Scripting Attempt (CVE-2025-34310)
ET WEB_SPECIFIC_APPS IPFire firewalllogip.dat pienumber Parameter Cross Site Scripting Attempt (CVE-2025-34307)
ET WEB_SPECIFIC_APPS Tenda VirtualSer page Parameter Buffer Overflow Attempt (CVE-2025-12265)
ET WEB_SPECIFIC_APPS ASMAX CGI script system Parameter Command Injection Attempt (CVE-2009-5156)
ET WEB_SPECIFIC_APPS TVT queryDevInfo Information Disclosure (CVE-2024-7339)
ET WEB_SPECIFIC_APPS Tenda SetFirewallCfg firewallEn Parameter Buffer Overflow Attempt (CVE-2025-8810, CVE-2025-29358, CVE-2025-1851, CVE-2024-2809)
ET WEB_SPECIFIC_APPS D-Link SetWifiDownSettings Multiple XML Tags Buffer Overflow Attempt (CVE-2023-43235)
ET WEB_SPECIFIC_APPS Tenda addressNat Multiple Parameters Buffer Overflow Attempt (CVE-2025-12272)
This rule detects attempts to exploit CVE-2024-30043, a vulnerability in Microsoft SharePoint's SPXmlDataSource that allows for XML External Entity (XXE) injection. The rule specifically looks for HTTP responses containing SharePoint XML data source declarations and a 'DataFile' attribute with a path that starts with 'file://', 'smb://', or '\\', indicating an attempt to fetch local or network files.
This rule detects attempts to exploit a buffer overflow vulnerability in the 'index' parameter of the '/goform/WifiWpsStart' endpoint on Tenda Wifi routers. The detection is triggered by HTTP POST requests to this specific URI containing 'index=' followed by a string of 100 or more characters, indicating an attempt to overflow the buffer. This vulnerability could lead to denial of service or arbitrary code execution.
ET WEB_SPECIFIC_APPS Tenda SysRunCmd getui Parameter Buffer Overflow Attempt (CVE-2025-12622)
ET WEB_SPECIFIC_APPS IPFire urlfilter.cgi BE_NAME Parameter Command Injection Attempt (CVE-2025-34312)
ET WEB_SPECIFIC_APPS IPFire time.cgi UPDATE_VALUE Parameter Cross Site Scripting Attempt (CVE-2025-34308)
ET WEB_SPECIFIC_APPS Atlassian Confluence Server-Side Request Forgery (CVE-2021-26072)
ET WEB_SPECIFIC_APPS Kaseya VSA Authenticated SQL Injection in exportFldr (CVE-2021-30117)
ET WEB_SPECIFIC_APPS Tenda SafeMacFilter page Parameter Buffer Overflow Attempt (CVE-2025-12234)
ET WEB_SPECIFIC_APPS Ilevia index.php error Parameter Cross Site Scripting Attempt
ET WEB_SPECIFIC_APPS ICTBroadcast Command Injection (CVE-2025-2611)
ET WEB_SPECIFIC_APPS Gladinet CentreStack and Triofox Local File Inclusion (CVE-2025-11371)
Page 127 of 159