Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,437
11,828
5,871
5,150
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
Detects potential exploitation of a SAML-related vulnerability in Citrix NetScaler appliances by correlating a surge in SAML authentication traffic to Gateway/AAA endpoints followed by application crashes or core dumps on the device. This behavioral pattern is indicative of a crash-inducing exploitation attempt targeting SAML processing.
Detects the AdFection multi-stage infection chain where a device sequentially contacts advertising infrastructure, Candiru validator servers, exploit servers, and Candiru Command and Control domains within a short time window.
Detects the AdFection multi-stage infection chain where a device sequentially contacts advertising infrastructure, Candiru validator servers, exploit servers, and Candiru Command and Control domains within a short time window.
This analytic detects Windows processes such as cmd.exe, PowerShell, and common Windows LOLBINs being spawned by React or Next.js application servers.
In the context of CVE-2025-55182 / React2Shell / CVE-2025-66478 for Next.js, successful exploitation can lead to arbitrary JavaScript execution on the server, which in turn is used to invoke Node's child_process APIs (for example child_process.execSync) to run OS-level commands.
This detection focuses on suspicious child processes where a Next/React server process spawns an uncommon process.
Such activity might be a strong indicator of exploitation of the aforementioned vulnerability.
In the context of CVE-2025-55182 / React2Shell / CVE-2025-66478 for Next.js, successful exploitation can lead to arbitrary JavaScript execution on the server, which in turn is used to invoke Node's child_process APIs (for example child_process.execSync) to run OS-level commands.
This detection focuses on suspicious child processes where a Next/React server process spawns an uncommon process.
Such activity might be a strong indicator of exploitation of the aforementioned vulnerability.
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.
Detects potential exploitation attempts targeting unpatched Citrix NetScaler ADC or Gateway devices, specifically looking for unauthenticated requests to management or sensitive endpoints that contain command execution indicators. This rule is designed to identify activity associated with vulnerabilities similar to CVE-2026-88771.
Detects an exploitation attempt against PoeLLM or LiteLLM MCP test/connection endpoint using a python3 stdio payload that fetches data from port 81.
Detects the AdFection multi-stage infection chain where a device sequentially contacts advertising infrastructure, Candiru validator servers, exploit servers, and Candiru Command and Control domains within a short time window.
Detects the AdFection multi-stage infection chain where a device sequentially contacts advertising infrastructure, Candiru validator servers, exploit servers, and Candiru Command and Control domains within a short time window.
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.
Detects anomalous unauthenticated HTTP requests targeting Citrix NetScaler ADC/Gateway, characterized by suspicious URI patterns, non-standard HTTP methods, and malformed request parameters. This rule is designed to identify potential exploitation attempts consistent with CVE-2026-88771.
This rule monitors NetScaler ADC logs for indicators associated with the PitScaler campaign, specifically targeting exploitation of CVE-2026-88771 and CVE-2026-88772. It detects exploitation artifacts (DTLS handshake errors, NSPPE crashes), deployment of WHIPSHOT/SLAPSHOT malware, web shell installation, httpd.conf configuration tampering, persistence mechanisms involving privilege escalation (chmod), and connections to known malicious infrastructure.
Detects the execution of suspicious child processes (shells, interpreters, or system reconnaissance tools) directly spawned by critical Citrix NetScaler service binaries (nsppe, httpd, nsaaad). This behavior is indicative of post-exploitation activity, such as command injection or lateral movement following the exploitation of a public-facing NetScaler application vulnerability.
Detects potential exploitation attempts targeting unpatched Citrix NetScaler ADC or Gateway devices, specifically looking for unauthenticated requests to management or sensitive endpoints that contain command execution indicators. This rule is designed to identify activity associated with vulnerabilities similar to CVE-2026-88771.
Detects an unauthenticated remote code execution attempt against AhsayCBS via the UpdateReceivers.do endpoint using the checkSysPwd parameter, associated with CVE-2026-105133 and CVE-2026-105134.
This rule monitors for Cisco ASA/FTD device logs indicating an unexpected process crash (e.g., 'crashinfo', 'Traceback', 'decode-CF process restart') in conjunction with logs related to WebVPN activity or malformed HTTP requests. This pattern is indicative of potential exploitation attempts against the Cisco WebVPN service, such as those targeting CVE-2026-20349.
Detects a multi-stage compromise sequence involving anomalous authentication followed by VPN session establishment and a burst of outbound connections from Citrix ADC/Gateway appliances. Tightened to reduce false positives from legitimate admin access, routine VPN sessions, and authorized appliance telemetry/updates.
Detects an exploitation attempt against PoeLLM or LiteLLM MCP test/connection endpoint using a python3 stdio payload that fetches data from port 81.
This rule detects indicators of the PitScaler campaign targeting Citrix NetScaler ADC and Gateway appliances, exploiting vulnerabilities (CVE-2026-88771, CVE-2026-88772). It identifies the full attack chain including initial DTLS heap corruption exploitation, WHIPSHOT web shell C2 patterns, SLAPSHOT tunneling artifacts, web shell deployment files, httpd.conf PHP configuration tampering for persistence, privilege escalation via setuid /bin/sh modification, and anti-forensic log tampering.
Detects HTTP requests directed at NetScaler AAA or Gateway authentication endpoints that exhibit characteristics indicative of exploitation attempts against CVE-2026-88771. The rule monitors for anomalies such as excessive Content-Length headers, unusually large URI query parameters, or the presence of duplicated HTTP headers, which may be leveraged to bypass security controls or trigger buffer-related vulnerabilities during the authentication process.
Page 4 of 159