Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,443
11,831
5,875
5,151
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
ET WEB_SPECIFIC_APPS Planet formPingCmd Multiple Parameters Command Injection Attempt (CVE-2025-54405, CVE-2025-54406)
ET WEB_SPECIFIC_APPS LILIN dvr_box Server Parameter Command Injection Attempt (CVE-2025-34132)
ET WEB_SPECIFIC_APPS Tenda SetIpMacBind Multiple Parameters Buffer Overflow Attempt (CVE-2025-9089, CVE-2025-1853, CVE-2024-40417, CVE-2023-41556, CVE-2023-40902, CVE-2023-40896)
ET WEB_SPECIFIC_APPS D-Link web_keyword.data Multiple Parameters Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link wan_ping.data wan_ping Parameter Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link jingx.data Multiple Parameters Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link hictlist_show.data enable Parameter Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link dns_more_check.data enable Parameter Buffer Overflow Attempt
ET WEB_SPECIFIC_APPS D-Link SetWLanRadioSecurity Multiple XML Tags Buffer Overflow Attempt (CVE-2023-44839, CVE-2022-46569)
ET WEB_SPECIFIC_APPS D-Link ipportFilter sip_address Parameter Buffer Overflow Attempt (CVE-2023-43240)
ET EXPLOIT_KIT LandUpdate808 Domain in DNS Lookup (guiasexo .com)
This rule detects attempts to exploit multiple command injection vulnerabilities (CVE-2025-9149, CVE-2025-10958, CVE-2025-10960, CVE-2025-10961) in Wavlink wireless.cgi. The detection is based on HTTP POST requests to '/cgi-bin/wireless.cgi' with specific parameters ('Guest_ssid', 'macAddr', or 'delete_list') followed by command injection characters such as semicolon, newline, or backtick.
Detects post-exploitation behavior of LANDFALL spyware on Samsung devices. After exploiting CVE-2025-21042, the spyware uses LD_PRELOAD to inject a malicious shared object (.so) from its working directory (`/data/data/com.samsung.ipservice/files/`) into the benign `/system/bin/id` process, often via a shell wrapper.
ET WEB_SPECIFIC_APPS IPFire dns.cgi TLS_HOSTNAME Parameter Cross Site Scripting Attempt (CVE-2025-34317)
ET WEB_SPECIFIC_APPS IPFire dnsforward.cgi REMARK Parameter Cross Site Scripting Attempt (CVE-2025-34305)
ET WEB_SPECIFIC_APPS IPFire weakeonlan.cgi CLIENT_COMMENT Parameter Cross Site Scripting Attempt (CVE-2025-34305)
ET WEB_SPECIFIC_APPS Tenda SafeClientFilter page Parameter Buffer Overflow Attempt (CVE-2025-12232)
ET WEB_SPECIFIC_APPS Tenda SetIpBind page Parameter Buffer Overflow Attempt (CVE-2025-12235)
ET WEB_SPECIFIC_APPS Draytek recvCMD Command Injection Attempt (CVE-2024-41585)
ET WEB_SPECIFIC_APPS Ilevia mbus_build_from_csv.php Multiple Parameters Command Injection Attempt (CVE-2025-34513)
ET WEB_SPECIFIC_APPS Brickcom syslog.dump action Parameter Information Disclosure Attempt (CVE-2017-9238)
Page 128 of 159