Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,439
11,829
5,873
5,151
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
ET EXPLOIT_KIT ZPHP Domain in TLS SNI (fellsminjs .com)
ET EXPLOIT_KIT LandUpdate808 Domain in TLS SNI (varorg .com)
ET EXPLOIT_KIT ZPHP Domain in DNS Lookup (polimakels .com)
ET EXPLOIT_KIT ZPHP Domain in TLS SNI (prajsm .com)
This rule detects the 'Zip Slip' vulnerability pattern within incoming TAR archives. Specifically, it looks for the sequence '|00 00 00 2e 2e 5c|' (which represents '..\') within the file data of a POSIX tar archive. This pattern indicates an attempt to extract files outside of the intended directory, potentially leading to directory traversal and arbitrary file overwrite.
This rule detects attempts to exploit a known authentication bypass vulnerability in Commvault via QCommand Argument Injection. The detection specifically looks for HTTP POST requests to the '/commandcenter/api/Login' endpoint with specific content in the request body, including '_localadmin__' and 'commserver', along with a PCRE match for '-cs' preceded by a space or URL-encoded space, indicating an attempt to inject arguments.
This rule detects an attempted Server-Side Request Forgery (SSRF) via External XML Entity (XXE) injection targeting Xerox FreeFlow Core. The detection is based on HTTP POST requests containing specific XML and entity declarations indicative of an XXE attack, followed by a SYSTEM entity referencing an HTTP URL, which is characteristic of an SSRF attempt.
ET WEB_SPECIFIC_APPS Guetebruck param.cgi group Parameter SQL Injection Attempt (CVE-2025-12463)
ET WEB_SPECIFIC_APPS IPFire ovpnclients.dat CONNECTION_NAME Parameter SQL Injection Attempt (CVE-2025-34304)
ET WEB_SPECIFIC_APPS Tenda SafeUrlFilter page Parameter Buffer Overflow Attempt (CVE-2025-12233)
ET WEB_SPECIFIC_APPS Tenda webExcptypemanFilter page Parameter Buffer Overflow Attempt (CVE-2025-12273)
ET WEB_SPECIFIC_APPS better-auth Unauthenticated API Key Creation (CVE-2025-61928)
ET WEB_SPECIFIC_APPS Nagios Log Server Admin API Credential Disclosure (CVE-2025-44823)
ET WEB_SPECIFIC_APPS Brickcom camerainfo.cgi a Parameter Information Disclosure Attempt (CVE-2017-9238)
ET WEB_SPECIFIC_APPS Brickcom configfile.dump action Parameter Information Disclosure Attempt (CVE-2017-9238)
ET WEB_SPECIFIC_APPS OptiLink/GPON admin/formTracert target_addr Parameter Command Injection Attempt (CVE-2025-34049)
ET WEB_SPECIFIC_APPS TVT language Command Injection Attempt (CVE-2025-34036)
ET EXPLOIT_KIT LandUpdate808 Domain (saeam .com) in TLS SNI
ET EXPLOIT_KIT LandUpdate808 Domain (dolmain .com) in TLS SNI
ET EXPLOIT_KIT LandUpdate808 Domain (forrbes .com) in TLS SNI
ET EXPLOIT_KIT ZPHP Domain in TLS SNI (dotauan .pro)
Page 130 of 159