Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,228 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
352
260
212
Contributors
1,013
818
688
574
212
Categories
20,440
11,829
5,874
5,151
4,864
4,228
Platforms
2,931
889
585
248
198
Products / Services
2,239
1,453
839
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
Detects GET requests to '/SetupWizard.aspx/[anythinghere]' that indicate exploitation of the ScreenConnect vulnerability CVE-2024-1709, which is an authentication bypass vulnerability.
Detects exploitation attempts of CVE-2023-22518 in Confluence Data Center and Confluence Server. This vulnerability allows an attacker to exploit specific endpoints to potentially create administrator accounts and execute arbitrary commands. The rule identifies POST requests to known vulnerable URIs associated with setup and restore actions, or server information, which are indicative of an exploitation attempt.
Detects exploitation attempts of CVE-2023-46214, a remote code execution (RCE) vulnerability in Splunk Enterprise. The rule specifically looks for patterns associated with known public proof-of-concept (POC) code that leverages insecure XML parsing. It identifies POST requests to specific Splunk API endpoints (`/splunkd/__upload/indexing/preview` or `/api/search/jobs/results`) with particular URI query parameters (`NO_BINARY_CHECK=1`, `input.path=shell.xsl`, `/opt/splunk/var/run/splunk/dispatch/`, `/shell.xsl`) that indicate an attempt to upload and execute a malicious XSL stylesheet.
Detects exploitation attempts of CVE-2023-22518, an improper authorization vulnerability in Confluence Data Center and Server. Attackers can exploit vulnerable endpoints to create admin accounts or execute arbitrary commands. The rule specifically looks for POST requests to known vulnerable URIs associated with setup and restore functionalities.
Detects GET requests to specific files ('/human2.aspx' or '/_human2.aspx') that are known indicators of exploitation attempts targeting the MOVEit Transfer vulnerability CVE-2023-34362. These requests are typically associated with web shell deployment or interaction after initial compromise.
Detects when a low prevalence hash is seen during a process launch event, and a low prevalence domain is accessed within 10m.
Detects potential exploitation of CVE-2023-46214, a remote code execution (RCE) vulnerability in Splunk Enterprise. The rule looks for specific HTTP POST requests containing 'NO_BINARY_CHECK=1' and 'input.path' in the URI query, ending with '.xsl', and resulting in a 200 or 302 HTTP status code. These patterns are indicative of an attempt to leverage the insecure XML parsing vulnerability.
Detects exploitation attempts of CVE-2023-43261, an information disclosure vulnerability in Milesight UR5X, UR32L, UR32, UR35, UR41 routers before v35.3.0.7. This vulnerability allows attackers to access sensitive router components by requesting the '/lang/log/httpd.log' file, which can contain passwords and other critical information.
Detects exploitation attempts on Cisco ASA FTD systems exploiting CVE-2020-3452. The rule specifically looks for HTTP requests containing URI query strings indicative of the vulnerability, combined with a successful HTTP status code (200), suggesting a successful exploitation or at least a successful attempt to trigger the vulnerable endpoint.
Detects exploitation attempts targeting Oracle WebLogic servers using the CVE-2020-14882 vulnerability. The rule specifically looks for URI query patterns indicative of directory traversal attempts used in the exploit.
This rule detects attempts to exploit the ProxyLogon vulnerability (CVE-2021-26858) against Microsoft Exchange Server. Specifically, it looks for POST requests to '/ecp/DDI/DDIService.svc/SetObject' with query parameters indicating a 'schema=Reset' and 'VirtualDirectory' operation, combined with a username ending in '$', which is characteristic of the Server-Side Request Forgery (SSRF) phase of the attack used to manipulate virtual directories.
Detects suspicious and malformed user agent strings in proxy logs that may indicate malicious activity, including the use of specific malware or tools like Cobalt Strike, APT28 malware, Racoon Stealer, and Erbium stealer. The rule identifies various anomalies such as incorrect formatting, typos, and specific user agent strings known to be associated with adversary tools.
This rule detects suspicious user agent strings commonly associated with various Advanced Persistent Threat (APT) groups and malware families. It specifically targets patterns found in proxy logs, indicating potential command and control (C2) communications or other malicious web activity. The rule includes a broad list of user agent strings linked to specific APTs like Backspace, GrizzlySteppe, Comment Crew, Naikon, Sofacy (Xtunnel, Zebrocy), Derusbi, Winnti, APT17, Bronze Butler (Daserf), TSCookie, Delphi downloader, VPNFilter, FELIXROOT, RMS, Cmstar, KerrDown, APT33 (PowerTon), Hidden Cobra, Strong Pity, Mustang Panda, BackdoorDiplomacy, SideWalk, LitePower (WRITE), ZINC, PlugX, and RedCurl.
Detects exploitation attempts targeting the VMware vCenter Server using the file upload vulnerability CVE-2021-22005. The rule specifically looks for POST requests to the '/analytics/telemetry/ph/api/hyper/send?' URI, which is indicative of an attempt to leverage this vulnerability for file upload.
Detects attempts to exploit the Grafana path traversal vulnerability (CVE-2021-43798) by looking for specific path traversal sequences combined with requests to known Grafana plugin directories that result in a successful HTTP status code (200).
This rule detects potential SQL injection attempts by looking for common SQL injection strings and keywords within the URI of GET requests in web server access logs. It specifically targets patterns often used to extract database information, bypass authentication, or execute arbitrary SQL commands.
This rule detects attempts to execute common Windows operating system commands via HTTP GET requests, which is a common characteristic of web shell activity. The rule specifically looks for URL-encoded versions of commands like 'whoami', 'net user', 'cmd /c', 'powershell', 'tasklist', 'wmic', 'ssh', 'python', 'ipconfig', 'wget', 'curl', 'certutil', 'copy \\', 'dsquery', and 'nltest'. These commands are often used by attackers to gain information about the compromised system, escalate privileges, or establish further persistence after deploying a web shell.
Detects exploitation attempts against the Log4j RCE vulnerability (CVE-2021-44228), commonly known as Log4Shell. The rule specifically looks for various JNDI injection patterns within web server log fields such as User-Agent, URI query, and Referer headers, which are common vectors for this vulnerability.
Detects the exploitation of OMIGOD (CVE-2021-38647) which allows remote execute (RCE) commands as root with just a single unauthenticated HTTP request. Verify successful exploitation by viewing the HTTP client (request) body to see what was passed to the server (using PCAP). Within the client body is where the code execution would occur. Additionally, check the endpoint logs to see if suspicious commands or activity occurred within the timeframe of this HTTP request.
Detects attempts to exploit Java-based web applications by identifying common payload strings often used in vulnerabilities like those affecting Confluence (CVE-2022-26134, CVE-2021-26084) and other Java deserialization or expression language injection flaws. The rule looks for specific patterns in web access logs that indicate the presence of Java code execution attempts, such as references to Java classes, runtime execution commands, and encoded characters often used in exploit payloads.
Detects HTTP requests to URIs ending with the ".class" extension. This can indicate attempts to download Java classes, potentially as part of exploitation attacks such as Log4shell against Log4j vulnerabilities. This rule is useful for threat hunting to identify such activities.
Page 198 of 202