Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,324 detections
Filters
Last updated
All Time
Detection languages
1,225
935
481
239
184
Contributors
626
512
469
337
261
Categories
20,438
11,829
5,872
5,150
4,864
3,324
Platforms
1,411
1,220
873
142
138
Products / Services
973
444
393
392
360
MITRE Techniques
1,525
1,085
885
593
540
CVEs
42
28
26
26
24
IDS Classtypes
390
220
127
40
26
IDS Protocols
671
150
30
18
12
This rule detects potential exploitation of the Oracle PeopleSoft PSEMHUB component vulnerability (CVE-2026-35273). It identifies suspicious POST requests to the PSEMHUB HttpListeningConnector servlet, including obfuscated URL paths, followed by the creation of suspiciously named .jsp or .jspx files in the PSEMHUB.war application directory, which is indicative of a web shell deployment.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects a multi-stage exploit chain targeting iOS Safari clients, characterized by the sequential fetching of specific JavaScript modules (platform_module.js, utility_module.js, Stage1, Stage3, and bootstrap.dylib) and subsequent callback communication to a remote server. This pattern is consistent with a browser-based exploit framework targeting iOS devices.
Detects a sequence of potentially malicious activity targeting LLM-related API endpoints. The rule identifies a client IP performing rapid, distinct endpoint discovery, followed by a POST request to sensitive paths, and concluding with a spike in 5xx server-side errors, indicating potential exploitation attempts or fuzzing against Large Language Model interfaces.
This rule detects potentially malicious POST requests to SharePoint endpoints (such as AddGallery.aspx) that include indicators of WebPartMarkup or ToolPane payloads. This activity attempts to bypass the SPUtility.EnsureAuthentication() check that is typically enforced on the ToolPane.aspx page, potentially allowing unauthorized code execution or configuration manipulation.
Detects potential exploitation attempts targeting CVE-2026-16232 in Check Point SmartConsole. The rule identifies specific authentication error messages indicating that a username length validation vulnerability is being triggered by a remote attacker attempting to bypass authentication.
Detects instances where the Ivanti Sentry service process spawns suspicious child processes (shells, network utilities, or interpreters) while running with root privileges. This behavior is indicative of exploitation of CVE-2026-10520, an OS command injection vulnerability in Ivanti Sentry that enables unauthenticated remote code execution with root permissions.
This rule detects an exploitation attempt targeting the ConnectWise ScreenConnect Path Traversal vulnerability (CVE-2024-1708). The detection monitors incoming HTTP traffic for attempts to traverse the file system by inspecting the URI for repeated '..' sequences within the '/App_Extensions/' directory, a hallmark of this vulnerability.
Detects incoming HTTP POST requests to the 'diffpatch' endpoint in Gitea that contain suspicious 'diff --git' patterns combined with path traversal sequences ('../') targeting 'hooks/' directories. This indicates an attempt to exploit CVE-2026-60004 to achieve unauthorized file system access or remote code execution via repository hooks.
Detects attempts to exploit a vulnerability (CVE-2026-68536) in the Apache MyFaces JSF resource handler. The rule monitors for malicious URI parameters ('ln' or 'library') that attempt Server-Side Request Forgery (SSRF) targeting cloud metadata services, path traversal, or URI-based injection attacks.
This rule detects attempts to exploit CVE-2026-93647, a Stored Cross-Site Scripting (XSS) vulnerability in the Zimbra Classic Webclient. The exploit involves injecting malicious script tags or JavaScript event handlers into calendar fields such as SUMMARY, DESCRIPTION, or LOCATION. The detection monitors inbound TCP traffic on web ports used by the application, specifically looking for common XSS injection patterns within calendar-related fields.
Detects potential SQL injection attempts targeting Cisco AsyncOS Email Gateways via the SMTP DATA command. The rule monitors for malicious patterns, specifically those attempting to execute unauthorized commands or database queries (such as COPY TO PROGRAM or embedded SQL statements) within SMTP traffic.
Detects attempts to exploit an unauthenticated OS command injection vulnerability in Cisco ISE (CVE-2026-20130). The rule monitors inbound HTTP traffic for shell metacharacters and common command-line binaries in the URI or request body, indicating an attempt to execute arbitrary commands on the underlying host.
Detects network traffic patterns characteristic of the EternalBlue (MS17-010) exploit targeting the SMBv1 protocol. Specifically, it monitors for a malformed SESSION_SETUP request containing an unusually large payload, which is indicative of an attempt to trigger a buffer overflow in the SMB service.
Detects unauthorized attempts to access exposed Chroma or Weaviate vector database APIs via standard HTTP requests (GET/POST) targeting known API endpoints for collections or objects. This may indicate an adversary conducting reconnaissance on publicly accessible database infrastructure.
Detects a potential automated exploit sweep or brute-force attempt, identified by a high frequency of HTTP requests (GET or POST) directed to the same URI from a single source IP address within a short time frame.
Detects a suspicious sequence of events where a known web server process (e.g., IIS, Nginx, Apache) spawns a command shell process, followed shortly by the creation of a file with a web shell-like extension (.aspx, .jsp, .php) in the same environment. This pattern is indicative of an adversary exploiting a public-facing application to upload and potentially access a web shell.
Detects anomalous access to the SharePoint WebPartPages.asmx SOAP endpoint, specifically using the GetWebPartPageConnectionInfo method. This query identifies patterns consistent with the exploitation of CVE-2026-65660, where adversaries attempt to smuggle WebPart template markup (e.g., <%@ Register, XamlServices) after legitimate preview methods have been disabled.
Detects incoming HTTP traffic containing a custom 'X-Quad' header, which is indicative of exploitation attempts targeting PaperCut MF vulnerabilities (CVE-2026-82078/CVE-2026-81578). This header is associated with the deployment or interaction with a Java-based web shell to establish unauthorized access.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Page 9 of 159