Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,438
11,829
5,872
5,150
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
Detects potential exploitation attempts of CVE-2023-2283, an authentication bypass vulnerability in libSSH. The exploitation method causes an error message indicating that keys for curve25519 could not be generated. This error message serves as a sign of an exploitation attempt, not necessarily a successful exploitation.
Detects a unique URL marker '/MSHTML_C7/' used in GET requests, which has been associated with RomCom exploitation attempts, potentially leveraging CVE-2023-36884. This marker is indicative of command and control communication or initial access related to the exploit.
Detects process execution related exceptions in JVM based applications, which can often indicate Remote Code Execution (RCE) attempts. The rule specifically looks for keywords like 'Cannot run program', 'java.lang.ProcessImpl', and 'java.lang.ProcessBuilder' in application error logs.
This rule detects attempts to exploit CVE-2019-3398, a path traversal vulnerability in Confluence. The detection logic specifically looks for HTTP POST requests to '/upload.action' containing the path traversal sequence 'filename=../../../../'. This pattern indicates an attempt to upload a file to an arbitrary location on the server, which is characteristic of the CVE-2019-3398 exploitation.
Detects the exploitation of Zoho ManageEngine Desktop Central Java Deserialization vulnerability (CVE-2020-10189) by monitoring for suspicious child processes spawned by the Java executable associated with Desktop Central. This exploitation often leads to the execution of command-line utilities for further compromise.
Detects Microsoft Outlook attempting to initiate a connection to a WebDAV or SMB share by querying specific registry keys. This behavior is indicative of an exploitation attempt related to CVE-2023-23397, where an attacker could force Outlook to connect to a malicious share and leak NTLM hashes.
Detects a potential exploitation attempt of CVE-2023-25717, a Remote Code Execution vulnerability via an unauthenticated HTTP GET Request, in Ruckus Wireless Admin. The rule looks for specific URI query parameters including '/forms/doLogin', 'login_username', 'password', and the presence of '$(' or its URL-encoded version '%24%28', which are indicative of command injection.
This rule detects potential local file read vulnerabilities in JVM-based applications by looking for specific keywords in application error logs. It triggers when a 'FileNotFoundException' occurs in conjunction with path traversal payloads like '/../../..'. This combination suggests an attacker is attempting to read arbitrary files from the system by manipulating input paths, which could lead to sensitive information disclosure.
Detects potential XML External Entity (XXE) exploitation attempts in JVM-based applications by looking for specific XML parsing error keywords in application error logs. These errors, such as 'SAXParseException' and 'DOMException', can indicate that an attacker is trying to manipulate XML input to access local files, perform server-side request forgery (SSRF), or execute other malicious actions. The rule is designed to identify issues where an application expects to work with XML and the parser might not be initialized safely.
Detects exploitation attempts against the Oracle WebLogic server vulnerability CVE-2021-2109. The rule specifically looks for GET requests containing 'com.bea.console.handles.JndiBindingHandle', 'ldap://', and 'AdminServer' in the URI query, which are indicators of an attempted JNDI injection via LDAP.
Detects exploitation attempts targeting the VMware View Planner vulnerability, CVE-2021-21978. This vulnerability allows for arbitrary file upload due to an unrestricted file upload flaw in the 'upload' function, specifically within the 'wsgi_log_upload.py' script. Attackers can leverage this to upload malicious files, potentially leading to remote code execution.
Detects the spawning of suspicious child processes by the Atlassian Confluence server, which may indicate successful exploitation of CVE-2021-26084. The rule specifically looks for the Confluence Java process spawning common command-line utilities and scripting interpreters often used in post-exploitation activities.
This rule detects potential successful exploitation of CVE-2021-26857, a Microsoft Exchange Server vulnerability. It specifically looks for abnormal child processes spawning from the 'UMWorkerProcess.exe' (Unified Messaging service) on Exchange servers. The rule filters out legitimate Windows Error Reporting processes ('wermgr.exe' and 'WerFault.exe') to reduce false positives, indicating that any other process spawned by 'UMWorkerProcess.exe' is considered suspicious and a potential indicator of compromise.
Detects successful exploitation attempts of the Microsoft Exchange Server vulnerability CVE-2021-28480. This vulnerability allows for remote code execution. The rule specifically looks for POST requests to '/owa/calendar/a' that result in an HTTP 503 status code, indicating a potential successful exploitation or a server error due to the exploit.
Detects exploitation attempts of the SonicWall SSL/VPN Jarrewrite vulnerability. The rule looks for requests to '/cgi-bin/jarrewrite.sh' combined with specific patterns in the 'cs-user-agent' header that indicate command injection attempts, such as ':;', '() {', or '/bin/bash -c'. This targets a known vulnerability allowing attackers to execute arbitrary commands.
This rule detects a specific HTTP GET request pattern associated with potential exploitation of CVE-2023-36884 by the RomCom threat group. The pattern involves a URI containing '/MSHTML_C7/' and a query parameter 'd' followed by an IPv4 address.
This rule detects various suspicious exceptions within Django web applications. These exceptions, such as 'SuspiciousOperation' and its subclasses (e.g., 'DisallowedHost', 'InvalidSessionKey', 'RequestDataTooBig'), as well as 'PermissionDenied', often indicate attempts to exploit vulnerabilities, bypass security controls, or engage in other malicious activities against the web application. Monitoring these exceptions can help identify potential attacks like web parameter tampering, session hijacking attempts, or unauthorized access attempts.
Detects suspicious VSFTPD error messages that indicate a fatal or suspicious error that could be caused by exploiting attempts. These errors often suggest malformed requests or attempts to trigger vulnerabilities in the VSFTPD service.
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell. SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite. This activity is indicative of the OMIGOD vulnerability exploitation.
Detects suspicious child processes spawned from web browsers on macOS. This activity often indicates a potential web browser exploitation attempt, where an attacker leverages a browser vulnerability to execute arbitrary commands or scripts on the system. The rule specifically looks for common scripting and command-line interpreters being launched as child processes of various browsers, while filtering out known legitimate browser-related activities like updates or recovery scripts.
Detects exploitation attempts using the JNDI-Exploit-Kit by looking for specific URI patterns in web server logs. These patterns are indicative of various JNDI injection payloads designed to achieve remote code execution, reverse shells, or memory shell deployments on vulnerable applications like Tomcat, Jetty, Weblogic, JBoss, Websphere, and Spring.
Page 156 of 159