Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,228 detections
Filters
Last updated
All Time
Detection languages
2,175
1,018
352
260
212
Contributors
1,013
818
688
574
212
Categories
20,440
11,829
5,874
5,151
4,864
4,228
Platforms
2,931
889
585
248
198
Products / Services
2,239
1,453
839
416
344
MITRE Techniques
1,164
1,087
870
798
439
CVEs
22
20
20
18
17
IDS Classtypes
927
408
222
146
104
IDS Protocols
1,914
105
70
47
6
This rule detects HTTP requests containing user-agent strings commonly associated with known scanning and reconnaissance tools such as Wfuzz, WPScan, and Recon-ng. These tools are often used by attackers to gather information about web applications and infrastructure before launching an attack.
Detects exploitation attempts against Fortinet SSL VPNs using the CVE-2018-13379 vulnerability. This vulnerability allows an unauthenticated attacker to read arbitrary files on the system via a specially crafted URI.
This rule detects HTTP POST requests that exhibit characteristics commonly associated with the Empire post-exploitation framework. Specifically, it looks for a combination of a distinct user-agent string ('Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko') and specific URI paths ('/admin/get.php', '/news.php', '/login/process.php'). This pattern is indicative of an Empire agent communicating with its command and control server.
This rule detects Cobalt Strike Malleable C2 profile patterns by analyzing HTTP proxy logs. It looks for specific User-Agent strings, HTTP methods (GET/POST), URIs, and hostnames that are characteristic of known Cobalt Strike profiles, including those mimicking Amazon, generic browsers, OCSP, and OneDrive traffic. The rule aims to identify command and control communications attempting to blend in with legitimate web traffic.
Detects the exploitation of the Wazuh RCE vulnerability described in CVE-2021-26814. This rule specifically looks for a URI query containing '/manager/files?path=etc/lists/../../../../..' which is indicative of a path traversal attempt to access sensitive files outside the intended directory.
Detects exploitation attempts of CVE-2021-41773, a path traversal vulnerability in Apache HTTP Server 2.4.49. This flaw allows an attacker to map URLs to files outside the expected document root, potentially leading to information disclosure (e.g., source code of CGI scripts) or arbitrary file access if not properly protected. This vulnerability has been actively exploited in the wild and specifically affects Apache HTTP Server version 2.4.49.
Detects exploitation attempts against Citrix Netscaler, Application Delivery Controller (ADS), and Citrix Gateway by identifying specific URI query patterns associated with CVE-2020-8193 and CVE-2020-8195.
Detects exploitation attempts targeting CVE-2021-27905, an arbitrary file read and SSRF vulnerability affecting Apache Solr versions up to and including 8.8.1. The rule looks for specific patterns in HTTP request URIs that are indicative of this vulnerability being exploited, such as requests containing '/solr/', '/debug/dump?', 'param=ContentStream', or 'command=fetchindex' with 'masterUrl='.
Detects a potential exploitation attempt of CVE-2023-25157, a SQL injection vulnerability in GeoServer. The rule looks for specific GET requests to '/geoserver/ows' containing 'CQL_FILTER=' along with known vulnerable functions or SQL injection keywords in the query string.
This rule detects attempts to access a webshell that has been dropped into a keystore folder on an Oracle WebLogic server. The detection is based on the URI query containing '*/config/keystore/*.js*', which is indicative of an attacker trying to interact with a webshell placed in a specific directory often associated with the CVE-2018-2894 vulnerability.
Detects exploitation attempts of the OWASSRF vulnerability targeting Microsoft Exchange servers using publicly available Proof-of-Concept (POC) code. This rule specifically looks for requests to the OWA endpoint attempting to access the PowerShell backend endpoint, characterized by a specific user agent, POST method, successful status code (200), and URI query containing both '/owa/mastermailbox' and '/powershell'. This indicates an attempt to leverage the vulnerability for remote code execution.
Detects attempts to download executable files via WebDAV. This activity has been observed in campaigns attributed to APT29, where adversaries leverage WebDAV to transfer malicious tools into a compromised environment.
Detects exploitation attempts of the OWASSRF variant targeting Exchange servers. This exploit leverages the OWA endpoint to access the PowerShell backend endpoint, often associated with CVE-2022-41080 and CVE-2022-41082.
Detects exploitation attempts against Citrix Netscaler, Application Delivery Controller, and Citrix Gateway devices targeting CVE-2019-19781. The rule looks for specific URI query patterns indicative of directory traversal or direct access to vulnerable scripts.
Detects Server-Side Template Injection (SSTI) attempts made via GET requests. The rule looks for common SSTI payload strings within the request, specifically excluding requests that result in a 404 Not Found status code to reduce false positives.
This rule detects attempts to inject Cross-Site Scripting (XSS) payloads via GET requests in web access logs. It specifically looks for common XSS strings and encoded variations within the request URL, such as '<script>', '<iframe>', '<svg>', 'document.cookie', 'document.domain', 'onerror=', 'onresize=', 'onload=', 'onmouseover=', '${alert', 'javascript:alert', and their URL-encoded forms. The rule filters out requests that result in a 404 HTTP status code to reduce false positives.
Detects access attempts to the SUPERNOVA webshell, specifically looking for requests to 'logoimagehandler.ashx' with 'clazz' in the query string, or requests to 'logoimagehandler.ashx' resulting in a 500 HTTP status code. This activity is indicative of an adversary interacting with a deployed webshell.
Detects an attempt to leverage the vulnerable servlet "mboximport" for an unauthenticated remote command injection in Zimbra Collaboration Suite Email Server, specifically targeting CVE-2022-27925. The rule looks for POST requests to the '/service/extension/backup/mboximport' endpoint with specific query parameters ('account-name', 'ow', 'no-switch', 'append') and then checks for subsequent requests to '/zimbraAdmin/*.jsp' with a 200 status code, indicating potential successful exploitation and web shell access.
This rule detects HTTP requests where the User-Agent header contains ' WindowsPowerShell/'. This pattern is indicative of PowerShell making web requests, potentially for downloading files, interacting with web services, or command and control activities. This can be a legitimate administrative activity but is also frequently abused by adversaries.
This rule detects potential ReGeorg webshell activity by looking for specific query parameters in web server logs. It focuses on requests that contain 'cmd=read', 'connect&target', 'cmd=connect', 'cmd=disconnect', or 'cmd=forward' in the URI query string, combined with a null referrer and null user agent, and using the POST method. This combination of indicators is highly suspicious for webshell communication.
Detects access patterns indicative of the DEWMODE webshell, which was used in attacks exploiting Accellion FTA. The rule looks for specific query parameters ('?dwn=', '&fn=', '.html?' or '&dwn=', '?fn=', '.html?') within the URI query string, which are characteristic of how this webshell operates.
Page 199 of 202