Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,438
11,829
5,872
5,150
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
Detects an exploitation chain originating from a Chrome browser process, characterized by the execution of an anomalous child process followed by the creation of an executable file named 'chrome_cleanup.exe' within a short time window. This sequence is indicative of multi-stage exploitation, involving remote code execution via browser vulnerability and subsequent privilege escalation.
Detects potential exploitation of AI agent frameworks, such as Semantic Kernel, where plugin or tool invocation primitives are abused to execute arbitrary commands or manipulate files via path traversal. The rule monitors for AI-hosting processes (e.g., python.exe, node.exe) spawning shell child processes or file-related commands containing path traversal sequences (e.g., '..\..\') paired with file operation keywords.
Detects network traffic attempting to exploit CVE-2021-33044, an authentication bypass vulnerability in Dahua NetKeyboard devices, by identifying specific login request strings used in the exploit chain.
This rule detects malicious HTTP POST requests attempting a path traversal attack against Grav CMS, specifically targeting the __unique_form_id__ parameter. The rule looks for directory traversal sequences ('..') following the parameter, which is characteristic of attempts to read sensitive files outside the intended web directory.
This rule detects malicious HTTP POST requests attempting a path traversal attack against Grav CMS, specifically targeting the __unique_form_id__ parameter. The rule looks for directory traversal sequences ('..') following the parameter, which is characteristic of attempts to read sensitive files outside the intended web directory.
Detects anomalous execution of the Microsoft Support Diagnostic Tool (msdt.exe) or its host process (sdiagnhost.exe) when spawned by Microsoft Office applications or when invoked with specific command-line arguments indicative of the CVE-2022-30190 (Follina) exploit.
Detects the exploitation of WinRAR CVE-2023-38831, where a maliciously crafted archive triggers WinRAR to execute a secondary payload (such as a script, LNK, or binary) from its temporary extraction directories (Rar$EXa, Rar$DIa, Rar$SR). This behavior is characteristic of adversaries using WinRAR as an initial access vector to bypass security controls.
Detects Heartbleed (CVE-2014-0160) exploitation attempts by monitoring for malformed TLS heartbeat requests (undersized payload) followed by oversized responses from the server that indicate potential memory disclosure.
Detects SQL injection exploitation attempts against MOVEit Transfer targeting the CVE-2023-34362 vulnerability, followed by the deployment and subsequent interaction with the 'human2.aspx' webshell associated with Cl0p ransomware mass-exploitation campaigns.
Detects evidence of a SharePoint pre-authentication RCE exploit chain where an adversary injects a malicious Namespace containing an ExpandedWrapper-wrapped XamlServices payload (e.g., ObjectDataProvider or LosFormatter gadget) into the w3wp.exe worker process. This specifically looks for command-line arguments indicative of deserialization-based exploit attempts targeting SharePoint web server components.
This rule detects potential prompt injection attacks against AI agents by monitoring tool-invocation parameters. It identifies indicators such as common instruction-overriding phrases, large base64-encoded blobs, or embedded shell metacharacters within parameters when the agent's context is derived from external content (web, email, URLs, etc.).
This rule detects potential prompt injection attacks against AI agents by monitoring tool-invocation parameters. It identifies indicators such as common instruction-overriding phrases, large base64-encoded blobs, or embedded shell metacharacters within parameters when the agent's context is derived from external content (web, email, URLs, etc.).
Detects attempts to bypass AI agent safety guardrails by using obfuscated payloads (Base64/hex) or known jailbreak/roleplay trigger phrases. The rule specifically monitors sequences where an initial prompt is blocked by safety filters and is immediately followed by a structurally similar, potentially re-encoded prompt that is subsequently allowed, indicating an active filter evasion attempt.
Detects attempts to perform path traversal attacks against the MikroTik RouterOS WebFig interface via the jsproxy endpoint. The rule monitors HTTP proxy traffic for directory traversal sequences (e.g., '../' or URL encoded equivalents) within the query parameters of requests directed to the jsproxy URI.
Detects LLM input containing known instruction-override patterns (e.g., 'ignore previous instructions', 'DAN' jailbreak) paired with requests for privileged system operations, indicating a malicious attempt to bypass guardrails and gain unauthorized control over the LLM model.
Detects LLM input containing known instruction-override patterns (e.g., 'ignore previous instructions', 'DAN' jailbreak) paired with requests for privileged system operations, indicating a malicious attempt to bypass guardrails and gain unauthorized control over the LLM model.
Detects HTTP requests directed at edge appliances (FortiOS/FortiProxy, SonicWall, Cisco ASA) that match known CVE-associated URI paths, alongside successful administrative authentication to management or VPN interfaces originating from external source IP addresses. This rule is designed to identify potential initial access via vulnerability exploitation or unauthorized administrative login to critical infrastructure.
Detects unauthorized attempts to access SharePoint's WebPartPage ToolPane and Gallery endpoints via anonymous web requests. This pattern, characterized by the 'DisplayMode=Design' query parameter and suspicious markup in the request body, is indicative of exploitation attempts targeting vulnerable SharePoint installations to execute arbitrary code or bypass authentication mechanisms.
This rule detects unauthorized or unauthenticated attempts to call the NetrServerPasswordSet2 method on a Domain Controller via the MS-NRPC (Netlogon) interface, which is indicative of an exploitation attempt related to CVE-2020-1472 (Zerologon). This vulnerability allows an attacker to bypass authentication and reset a Domain Controller's computer account password, leading to full domain compromise.
Detects automated API exploitation attempts, specifically Broken Object Level Authorization (BOLA) scanning. The rule triggers when a single source IP or API token exhibits high-frequency request patterns (5+ requests per second) against resource endpoints with sequentially incrementing IDs. It specifically correlates a spike in 401/403 authorization failures followed by a small count of 200 successes, indicating a potential successful bypass of authorization controls.
Detects anomalous child process execution from SharePoint's w3wp.exe worker process following the loading of suspicious .NET assemblies (PresentationFramework.dll, System.Xaml.dll, System.Data.Services.dll). This behavior is indicative of a post-exploitation stage for SharePoint SafeControls bypass vulnerabilities, where a gadget chain is utilized to execute unmanaged or child processes.
Page 15 of 159