Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,230 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
354
260
212
Contributors
1,013
818
688
574
212
Categories
20,443
11,831
5,875
5,151
4,864
4,230
Platforms
2,933
889
585
248
198
Products / Services
2,239
1,453
841
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
ET WEB_SPECIFIC_APPS Brickcom camerainfo.cgi a Parameter Information Disclosure Attempt (CVE-2017-9238)
ET WEB_SPECIFIC_APPS Brickcom configfile.dump action Parameter Information Disclosure Attempt (CVE-2017-9238)
ET WEB_SPECIFIC_APPS OptiLink/GPON admin/formTracert target_addr Parameter Command Injection Attempt (CVE-2025-34049)
ET WEB_SPECIFIC_APPS TVT language Command Injection Attempt (CVE-2025-34036)
ET MALWARE TA398 CurlBack_RAT CnC Activity - Upload Results
ET INFO DYNAMIC_DNS HTTP Request to a *.freeddns .me domain
ET INFO DYNAMIC_DNS HTTP Request to a *.destroyerkisscover .com .br domain
This rule detects HTTP traffic where the User-Agent string contains the case-insensitive substring 'iot'. This is often indicative of compromised IoT devices or botnet activity attempting to blend in or identify themselves.
This rule detects attempts to exploit a buffer overflow vulnerability in Tenda routers via the `/goform/exeCommand` endpoint. Specifically, it looks for HTTP POST requests to this URI where the `cmdinput` parameter contains an unusually long string (100 characters or more) which is indicative of an attempt to overflow a buffer.
This rule detects attempts to exploit a command injection vulnerability in the DCN ip_block.php script. It specifically looks for HTTP POST requests to '/function/audit/newstatistics/ip_block.php' with an 'ip' parameter in the request body that contains command injection characters such as semicolons, newlines, backticks, pipes, or dollar signs.
This rule detects attempts to exploit an authentication bypass vulnerability (CVE-2025-54253) in Adobe Experience Manager Forms. The detection is based on specific HTTP URI patterns and content within the request, including '/adminui/updateLicense1.do', 'login. ', and 'debug=command', which are indicative of an exploit attempt against the application.
This rule detects attempts to exploit an XML External Entity (XXE) injection vulnerability in Adobe Experience Manager Forms. The detection logic specifically looks for HTTP POST requests to the '/edcws/services/urn:EDCLicenseService' URI containing '<EDCSecurity>' and '<!ENTITY' patterns in the request body, along with a PCRE regex to identify the XXE payload structure.
This rule detects attempts to exploit an insecure deserialization vulnerability (CVE-2025-49533) in Adobe Experience Manager Forms. The detection is based on specific HTTP URI patterns and content within the request body, looking for '/FormServer/servlet/GetDocumentServlet' followed by 'serDoc=' and 'H4sIAA', which are indicators of a serialized object being sent to the server.
This rule detects HTTP GET requests to github.com for PNG files where the User-Agent header contains "WindowsPowerShell". This combination could indicate an attempt to download malicious content or C2 instructions disguised as an image file using PowerShell.
This rule detects an attempt to exploit a buffer overflow vulnerability (CVE-2025-9297) in Tenda networking equipment. Specifically, it looks for HTTP POST requests to the '/goform/wxportalauth' URI where the 'type' parameter in the request body contains a string of 100 or more characters, indicating a potential buffer overflow attempt.
This rule detects attempts to exploit a command injection vulnerability in B-Link devices, specifically targeting the `/goform/set_hidessid_cfg` endpoint with the `enable` parameter. Attackers can inject commands by manipulating the `enable` parameter in a POST request, indicated by the presence of command separators like semicolon, newline, backtick, pipe, or dollar sign.
ET WEB_SPECIFIC_APPS Netgear password.cgi http_passwd Parameter Command Injection Attempt
ET WEB_SPECIFIC_APPS D-Link setMAC macCloneMac Parameter Buffer Overflow Attempt (CVE-2023-43237)
This rule detects an attempted buffer overflow vulnerability (CVE-2025-9298) in Tenda routers. Specifically, it looks for HTTP POST requests to the '/goform/QuickIndex' URI where the 'PPPOEPassword' parameter contains an excessively long string (100 or more characters) that could lead to a buffer overflow.
This rule detects an attempt to exploit a buffer overflow vulnerability (CVE-2024-8573) in TOTOLINK devices. The exploit targets the `setParentalRules` function within the `/cgi-bin/cstecgi.cgi` endpoint, specifically looking for HTTP POST requests with multiple parameters (desc, week, sTime, eTime) containing excessively long values (100 or more characters), indicative of a buffer overflow attempt.
This rule detects attempts to exploit a critical authentication bypass vulnerability (CVE-2025-54309) in CrushFTP's WebInterface. The exploit leverages an alternative channel to bypass authentication, specifically targeting the '/WebInterface/function/' URI with a 'command=login' parameter and a 'crushadmin' string in the 'as2-to' HTTP header. Successful exploitation could lead to unauthorized administrative access.
Page 185 of 202