Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,437
11,828
5,871
5,150
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
Detects signs of the exploitation of Local Privilege Escalation (LPE) vulnerability CVE-2021-41379. This specific rule identifies the creation of an 'elevation_service.exe' file by 'msiexec.exe' within the Microsoft Edge application directory, which is a known indicator of this exploit.
Detects potential initial exploitation attempts against VMware Horizon deployments running a vulnerable version of Log4j (CVE-2021-44228). Specifically, this rule looks for process creation events where the parent process is 'ws_TomcatService.exe' and the created process is NOT 'cmd.exe' or 'powershell.exe'. This aims to catch unexpected executables launched by the vulnerable Tomcat service as a result of successful Log4j exploitation.
Detects potential exploitation attempts of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager. The rule specifically looks for PowerShell or cmd.exe processes being spawned as child processes of the legitimate Tomcat "prunsrv.exe" process, which was observed as part of the attack chain by Morphisec.
Detects the creation of an HTA file in the Windows Startup folder by FoxitPDFReader. This activity is indicative of potential exploitation of CVE-2023-27363, a vulnerability in Foxit Reader that could allow an attacker to achieve persistence by placing a malicious HTA file in a location that executes upon user login.
This rule detects exploitation indicators for CVE-2023-20198, a privilege escalation vulnerability in Cisco IOS XE Software Web UI. It looks for specific log messages related to Web UI installation operations, system configuration changes, or successful web logins, in conjunction with the use of specific user accounts ('cisco_tac_admin', 'cisco_support', 'cisco_sys_manager') that are not typically created by default or used by Cisco representatives. The combination of these events suggests an attempt to exploit the vulnerability.
Detects exploitation attempts of CVE-2023-43261, an information disclosure vulnerability in Milesight UR5X, UR32L, UR32, UR35, UR41 routers before v35.3.0.7. Attackers can access sensitive router components, specifically the 'httpd.log' file, through proxy logs. This rule looks for GET requests to the '/lang/log/httpd.log' path with a successful HTTP status code (200).
Detects exploitation attempts of CVE-2023-43261, an information disclosure vulnerability in Milesight UR5X, UR32L, UR32, UR35, UR41 routers before v35.3.0.7. This vulnerability allows attackers to access sensitive router components by requesting the '/lang/log/httpd.log' file, which can contain passwords and other critical information.
Detects potential exploitation attempts of CVE-2022-29072, a 7-Zip privilege escalation and command execution vulnerability. This vulnerability affects 7-Zip version 21.07 and earlier on Windows, allowing privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The rule specifically looks for child processes like cmd.exe, powershell.exe, or pwsh.exe being spawned under the 7zFM.exe process, excluding common command line arguments or file extensions that might indicate legitimate usage.
Detects the creation or update of Active Directory Certificate Services (AD CS) certificate templates that are configured with risky Extended Key Usages (EKUs) and allow the enrollee to supply the subject. This combination can be exploited for privilege escalation and credential access, as described in the 'Certified Pre-Owned' whitepaper, by allowing an attacker to request certificates with arbitrary subject names, potentially impersonating privileged accounts.
Detects suspicious error messages from the OpenSSH daemon that may indicate an attempted exploit or a fatal error during an SSH connection attempt. These errors could be triggered by malformed requests or unusual client behavior designed to uncover vulnerabilities or bypass authentication.
This rule detects suspicious user agent strings commonly used by various hacking tools, including vulnerability scanners, brute-force tools, and SQL injection tools, within proxy logs. The rule identifies specific strings indicative of tools like Arachni, Hydra, DirBuster, SQLMap, and others, which are often employed during reconnaissance, initial access, and credential access phases of an attack.
Detects exploitation attempts on Cisco ASA FTD systems exploiting CVE-2020-3452. The rule specifically looks for HTTP requests containing URI query strings indicative of the vulnerability, combined with a successful HTTP status code (200), suggesting a successful exploitation or at least a successful attempt to trigger the vulnerable endpoint.
Detects exploitation attempts targeting Oracle WebLogic servers using the CVE-2020-14882 vulnerability. The rule specifically looks for URI query patterns indicative of directory traversal attempts used in the exploit.
This rule detects attempts to exploit the ProxyLogon vulnerability (CVE-2021-26858) against Microsoft Exchange Server. Specifically, it looks for POST requests to '/ecp/DDI/DDIService.svc/SetObject' with query parameters indicating a 'schema=Reset' and 'VirtualDirectory' operation, combined with a username ending in '$', which is characteristic of the Server-Side Request Forgery (SSRF) phase of the attack used to manipulate virtual directories.
Detects remote printer driver load from a Detailed File Share event in Windows Security logs, which is indicative of successful exploitation attempts against the Print Spooler vulnerabilities CVE-2021-1675 (PrintNightmare) and CVE-2021-34527.
Detects suspicious shell commands commonly used in various exploit codes, including those associated with Apache Struts vulnerabilities and Metasploit framework activities. The rule looks for patterns indicative of downloading and executing scripts, setting up reverse shells, or modifying file permissions for persistence or privilege escalation.
This rule detects suspicious error messages generated by various SQL database systems (Oracle, MySQL, SQL Server, SQLite) that are indicative of an attempted SQL injection attack. The rule looks for specific syntax error messages that are commonly returned when an attacker probes for SQL injection vulnerabilities.
Detects exploits that leverage CVE-2017-11882 by monitoring for the execution of EQNEDT32.EXE as a parent process, which is indicative of the vulnerability being exploited to launch further malicious processes like mshta.exe.
Detects exploitation attempts targeting the VMware vCenter Server using the file upload vulnerability CVE-2021-22005. The rule specifically looks for POST requests to the '/analytics/telemetry/ph/api/hyper/send?' URI, which is indicative of an attempt to leverage this vulnerability for file upload.
This rule detects potential exploitation attempts of CVE-2021-42278, also known as "noPac" or "sAMAccountName spoofing". The exploit involves an attacker creating a computer object with known credentials, then clearing its ServicePrincipalName (SPN) attribute. This manipulation grants the attacker additional permissions on the object, allowing them to make further changes. The detection logic specifically looks for Kerberos Key Distribution Center (KDC) events (EventIDs 35, 36, 37, 38) which indicate anomalies in PAC (Privilege Attribute Certificate) or ticket requests, consistent with the post-exploitation phase of CVE-2021-42278 where forged tickets are used.
This rule detects exploitation attempts against the Log4j RCE vulnerability, also known as Log4Shell (CVE-2021-44228). It looks for various JNDI (Java Naming and Directory Interface) lookup patterns, including LDAP, RMI, LDAPS, DNS, NIS, NDS, CORBA, and IIOP, as well as obfuscated forms of these patterns, which are commonly used to trigger the vulnerability. The rule specifically filters out known vulnerability scanning traffic from Nessus to reduce false positives.
Page 153 of 159